Application.Bundler.DomaIQ.Q_ce54353def – Adaware

not-a-virus:AdWare.MSIL.DomaIQ.ahty (Kaspersky), Application.Bundler.DomaIQ.Q (AdAware), SearchProtectToolbar_pcap.YR (Lavasoft MAS)Behaviour: Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: ce54353defcd2a3e31e25c8ecf6c484e

SHA1: bde28f477d07f36d0c5dbcc8332b25dcbc0af138

SHA256: 44a0f5545202e252701b8bc3117305d27887bca0888306e6ed0d9ab43647853e

SSDeep: 12288:duudwYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQf4CR5TqOM:duewYT/hmflRBmqPeQ93D4AQPjM

Size: 560504 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: download manager

Created at: 2009-12-06 00:50:41

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

rstart.exe:688
%original file name%.exe:1232

The Application injects its code into the following process(es):

e%original file name%.exe:1576

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process e%original file name%.exe:1576 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Browser app shoppinginfo.dfe (734 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\bullet-shortw.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-olivebrowser.png (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\check.png (398 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position3C.css (638 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\finish.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\percentage-bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\base.css (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\vuupc.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\logo-win.jpg (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Media Player Enhanceinfo.dfe (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\doma[1].js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position1A.css (421 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\bullet-short.gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\TheBestDeals\info.html (1217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\TheBestDealsinfo.dfe (750 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\Media Player Enhance\info.html (1219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-zipper.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\config.dll (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\optimizerpro2.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\boton_xl.jpg (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\butplay.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\bg_app.png (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\SM Mystart\info.html (1217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\more.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-gevideoconverter.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\instalando.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\cross.jpg (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-vafmusic.png (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\SM Mystartinfo.dfe (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\box.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\mypcbackup.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\Browser app shopping\info.html (296 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\aartemis.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\close.html (384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\progress_small.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position2B.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\check-close.png (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\Catchall Revizer\info.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\butpause.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Dockings.dfe (2597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position3B.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-ifish.png (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-geaudioconverter.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position2A.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Browser appinfo.dfe (734 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\templateDisplays.dfe (606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\Vuupc\info.html (1919 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\templateStyle.dfe (6081 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\browserapp.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\PPI OptimizerProinfo.dfe (1902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\bullet.gif (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\options.html (965 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\MyBackupPc\info.html (1217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\progress.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Vuupcinfo.dfe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-printpdf.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\boton.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position3A.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\check.jpg (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\mystart.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\MyBackupPcinfo.dfe (606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\optimizerpro-img.png (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\Browser app\info.html (1217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-vafplayer.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position4A.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\optimizerpro-logo.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\style.css (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\jquery.min.js (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-miul.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\feven.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\mystart-toolbar-gris.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\show.png (235 bytes)
%System%\wbem\Logs\wbemprox.log (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position2C.css (578 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\less.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\progress_small_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\PPI OptimizerPro\info.html (1219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\thebestdeals.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position3D.css (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\welcome.html (151 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\hide.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\mypcbackup.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Catchall Revizerinfo.dfe (979 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\optimizerpro-logo-big.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\group.html (10 bytes)

The process %original file name%.exe:1232 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\e%original file name%.exe (5918 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\rstart.exe.config (359 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\installer.exe (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\rstart.exe (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\%original file name%.exe.config (690 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\rstart.exe.config (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\rstart.exe (0 bytes)

Registry activity

The process e%original file name%.exe:1576 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 14 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "e%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1376923655"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A2 48 66 1E FC 4F 96 28 60 F7 A4 0B BC FC 54 F6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process rstart.exe:688 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FA F8 0A A2 FD 99 A6 9D E3 81 AA 9F 69 9F 6C 45"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process %original file name%.exe:1232 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 1F 4E 09 31 F1 7E CC D8 0A 6B 3C BD F4 A1 4D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

MD5	File path
a626437b4821f5b37ddc89f479d11a7f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\e%original file name%.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
rstart.exe:688
%original file name%.exe:1232
Delete the original Application file.
Delete or disinfect the following files created/modified by the Application:
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Browser app shoppinginfo.dfe (734 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\bullet-shortw.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-olivebrowser.png (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\check.png (398 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position3C.css (638 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\finish.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\percentage-bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\base.css (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\vuupc.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\logo-win.jpg (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Media Player Enhanceinfo.dfe (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\doma[1].js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position1A.css (421 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\bullet-short.gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\TheBestDeals\info.html (1217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\TheBestDealsinfo.dfe (750 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\Media Player Enhance\info.html (1219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-zipper.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\config.dll (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\optimizerpro2.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\boton_xl.jpg (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\butplay.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\bg_app.png (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\SM Mystart\info.html (1217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\more.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-gevideoconverter.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\instalando.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\cross.jpg (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-vafmusic.png (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\SM Mystartinfo.dfe (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\box.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\mypcbackup.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\Browser app shopping\info.html (296 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\aartemis.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\close.html (384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\progress_small.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position2B.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\check-close.png (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\Catchall Revizer\info.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\butpause.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Dockings.dfe (2597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position3B.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-ifish.png (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-geaudioconverter.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position2A.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Browser appinfo.dfe (734 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\templateDisplays.dfe (606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\Vuupc\info.html (1919 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\templateStyle.dfe (6081 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\browserapp.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\PPI OptimizerProinfo.dfe (1902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\bullet.gif (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\options.html (965 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\MyBackupPc\info.html (1217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\progress.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Vuupcinfo.dfe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-printpdf.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\boton.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position3A.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\check.jpg (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\mystart.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\MyBackupPcinfo.dfe (606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\optimizerpro-img.png (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\Browser app\info.html (1217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-vafplayer.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position4A.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\optimizerpro-logo.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\style.css (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\jquery.min.js (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\screen-miul.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\feven.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\mystart-toolbar-gris.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\show.png (235 bytes)
%System%\wbem\Logs\wbemprox.log (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position2C.css (578 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\less.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\progress_small_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\PPI OptimizerPro\info.html (1219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\thebestdeals.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\position3D.css (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\welcome.html (151 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\hide.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\mypcbackup.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\temp\Catchall Revizerinfo.dfe (979 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\css\images\optimizerpro-logo-big.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\bin\exe\group.html (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\e%original file name%.exe (5918 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\rstart.exe.config (359 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\installer.exe (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\%original file name%.exe\efcbea222c7a44a0adc609f06e3defab\%original file name%.exe.config (690 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	22738	23040	4.45908	c69726ed422d3dcfdec9731986daa752
.rdata	28672	4496	4608	3.59034	a2c7710fa66fcbb43c7ef0ab9eea5e9a
.data	36864	110456	1024	3.20082	e59cdcb732e4bfbc84cc61dd68354f78
.ndata	147456	61440	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	208896	25648	26112	4.29742	d25af015f1b708d62c89977f8bfe9711

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 790
1fd64b26c08904cbfcf8b8d8d94b5ecb
8e9725c08b4fea5755b35de3c0752c9c
20f5b49a961e65250fbaef73347c98ca
1e7ecb4ace87a3c204da95e07f26cd1b
2b315801224cbe96b29fceb936167632
319f55f5dab95ee90e6418c2a40f5055
592f83f8055b37841bd040c6c604d04d
1185a5a79cc9a9ea89c23de5d23f8c08
5d4004f44d76aa93528903ab90bec2bf
ef77ef37fd7829464973f49beca0a831
9ea06e2438e54c943a75fd71de204ed8
67960c3acd5b64cb6355d789d617f15f
7b11b9ef4db26eed8460fb926973ccba
1dff57ecc097f9ce4ca510e55f303498
3e5c113fa8048b7911aec1b768dda33c
0c291eab5c90a35c2c709f028a0b585d
71f00956c175405cf836e32ddf23bda3
5ec787acfd62b8d01a846205b2f473d4
6bc08206e4f327713dded823a41f6e0f
fad41b412733f1e1c1226c4bdcb51d49
8d529db46da0e06a80527e40ffc2251c
10c2e83b145fdc2728c72b2f17491d34
def5024f673c2b72d61da065c4fded80
76d6e290e280e4da6cdb9677621a53e9
f26dea89cd64973e336eb7eab2ee42e7
18d80bc4cb482e19aed3868541fc855e

Network Activity

URLs

URL	IP
hxxp://api.v2.sslsecure1.com/test.html	204.11.56.26
hxxp://API-XML-1918203848.us-west-2.elb.amazonaws.com/test.html
hxxp://staticrr.tgusrv.com/test.html
hxxp://Track-903226030.us-west-2.elb.amazonaws.com/test.html
hxxp://API-XML-1918203848.us-west-2.elb.amazonaws.com/index.php/api/151/Setup/477/545/English.xml
hxxp://staticrr.tgusrv.com//Dictionaries/English.xml
hxxp://staticrr.tgusrv.com//Styles/Templates/e9c1a9ca_Win_A_Banner_DeclineLink.zip
hxxp://staticrr.tgusrv.com//Displays/Templates/8a204893_Win_A_Banner_DeclineLink.zip
hxxp://staticrr.tgusrv.com//Docking/Docking.zip
hxxp://staticrr.tgusrv.com//Styles/Softwares/70e7b9d8_mystart.zip
hxxp://staticrr.tgusrv.com//Displays/Softwares/222ac0df_display.html
hxxp://staticrr.tgusrv.com//Styles/Softwares/844a2c3b_browserapp.zip
hxxp://staticrr.tgusrv.com//Displays/Softwares/9103144e_display (1).html
hxxp://staticrr.tgusrv.com//Styles/Softwares/9c04a3ed_thebestdeals.zip
hxxp://staticrr.tgusrv.com//Displays/Softwares/c9c92824_display.html
hxxp://staticrr.tgusrv.com//Styles/Softwares/e7bf26c3_mypcbackup.zip
hxxp://staticrr.tgusrv.com//Displays/Softwares/16220985_display.html
hxxp://staticrr.tgusrv.com//Styles/Softwares/db393704_vuupc.zip
hxxp://staticrr.tgusrv.com//Displays/Softwares/1d58e78d_display.html
hxxp://staticrr.tgusrv.com//Styles/Softwares/0ba5df4c_optimizerpro2.zip
hxxp://staticrr.tgusrv.com//Displays/Softwares/7f3e6cee_display.html
hxxp://staticrr.tgusrv.com//Styles/Softwares/03652e13_aartemis.zip
hxxp://staticrr.tgusrv.com//Displays/Softwares/ac80703b_display.html
hxxp://staticrr.tgusrv.com//Styles/Softwares/a616773d_feven.zip
hxxp://staticrr.tgusrv.com//Displays/Softwares/217ec6eb_display.html
hxxp://staticrr.tgusrv.com/sdb/doma.js
hxxp://api.v2.sslsecure2.com/test.html	204.11.56.26
hxxp://staticrr.paleokits.net//Styles/Softwares/e7bf26c3_mypcbackup.zip	85.12.5.27
hxxp://staticrr.paleokits.net//Styles/Softwares/9c04a3ed_thebestdeals.zip	85.12.5.27
hxxp://staticrr.paleokits.net//Styles/Softwares/844a2c3b_browserapp.zip	85.12.5.27
hxxp://track.v2.sslsecure3.com/test.html	204.11.56.26
hxxp://api.v2.sslsecure3.com/test.html	204.11.56.26
hxxp://staticrr.paleokits.net//Displays/Softwares/16220985_display.html	85.12.5.27
hxxp://staticrr.paleokits.net//Displays/Softwares/222ac0df_display.html	85.12.5.27
hxxp://staticrr.paleokits.net//Displays/Softwares/217ec6eb_display.html	85.12.5.27
hxxp://staticrr.paleokits.net//Docking/Docking.zip	85.12.5.27
hxxp://staticrr.paleokits.net//Styles/Softwares/03652e13_aartemis.zip	85.12.5.27
hxxp://staticrr.paleokits.net//Displays/Softwares/1d58e78d_display.html	85.12.5.27
hxxp://staticrr.paleokits.net//Displays/Softwares/9103144e_display (1).html	85.12.5.27
hxxp://staticrr.paleokits.net//Displays/Softwares/c9c92824_display.html	85.12.5.27
hxxp://track.v2.sslsecure1.com/test.html	204.11.56.26
hxxp://staticrr.paleokits.net//Displays/Softwares/7f3e6cee_display.html	85.12.5.27
hxxp://staticrr.paleokits.net//Styles/Softwares/a616773d_feven.zip	85.12.5.27
hxxp://staticrr.paleokits.net/test.html	85.12.5.27
hxxp://staticrr.paleokits.net//Styles/Templates/e9c1a9ca_Win_A_Banner_DeclineLink.zip	85.12.5.27
hxxp://staticrr.paleokits.net//Displays/Softwares/ac80703b_display.html	85.12.5.27
hxxp://staticrr.paleokits.net//Styles/Softwares/70e7b9d8_mystart.zip	85.12.5.27
hxxp://staticrr.paleokits.net//Displays/Templates/8a204893_Win_A_Banner_DeclineLink.zip	85.12.5.27
hxxp://api.v2.sslsecure4.com/test.html	54.213.138.138
hxxp://api.v2.sslsecure4.com/index.php/api/151/Setup/477/545/English.xml	54.213.138.138
hxxp://staticrr.paleokits.net/sdb/doma.js	85.12.5.27
hxxp://staticrr.paleokits.net//Styles/Softwares/0ba5df4c_optimizerpro2.zip	85.12.5.27
hxxp://track.v2.sslsecure4.com/test.html	54.186.105.91
hxxp://staticrr.paleokits.net//Styles/Softwares/db393704_vuupc.zip	85.12.5.27
hxxp://staticrr.paleokits.net//Dictionaries/English.xml	85.12.5.27
hxxp://track.v2.sslsecure2.com/test.html	204.11.56.26

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /sdb/doma.js HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: staticrr.paleokits.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:16 GMT

Content-Type: application/x-javascript

Content-Length: 2184

Last-Modified: Wed, 07 Aug 2013 11:37:26 GMT

Connection: keep-alive

ETag: "52023176-888"

Accept-Ranges: bytes

.. //muestra una capa y oculta otra.. function changeVisibility(capamostrar,capaocultar) {.. div = document.getElementById(capamostrar);.. div.style.display = "";.. div = document.getElementById(capaocultar);.. div.style.display = "none";.. }.. // funcion para mostrar u ocultar el progreso de la instalacion separado por ofertas.. function mostrardiv() {.. div = document.getElementById('multipleProgress');.. div.sty..

GET /test.html HTTP/1.1

Host: api.v2.sslsecure4.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Date: Tue, 11 Nov 2014 20:04:45 GMT

Server: nginx

Content-Length: 8

Connection: keep-alive

correct.HTTP/1.1 200 OK..Content-Type: text/html..Date: Tue, 11 Nov 2014 20:04:45 GMT..Server: nginx..Content-Length: 8..Connection: keep-alive..correct.....

GET /index.php/api/151/Setup/477/545/English.xml HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: api.v2.sslsecure4.com

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Content-Type: text/xml; charset=utf-8

Date: Tue, 11 Nov 2014 20:05:01 GMT

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Pragma: no-cache

Server: nginx

Set-Cookie: symfony=rmp3ekhtj5e6t3eeppksdr0sn5; path=/

transfer-encoding: chunked

Connection: keep-alive

371f..<?xml version="1.0" encoding="utf-8"?>...<doma>... <config>... . <time><![CDATA[0.05463695526123]]></time>... . <time3><![CDATA[[0.012609958648682][0.17381596565247][-11-] [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] ]]></time3>... . <time4><![CDATA[52]]></time4>... . <time5><![CDATA[ [0.18646693229675] [0.44606113433838] [0.00013494491577148] [1.0013580322266E-5] [0.049944877624512] ]]></time5>... <formCaption><![CDATA[New Player]]></formCaption>.... <server><![CDATA[hXXp://staticrr.safetydownload.net/]]></server>.... <formControlBox><![CDATA[1]]></formControlBox> ... <urlConfig><![CDATA[Dictionaries/English.xml]]></urlConfig>... <templateUrl><![CDATA[Displays/Templates/8a204893_Win_A_Banner_DeclineLink.zip]]></templateUrl><templateApp></templateApp><styles><![CDATA[Styles/Templates/e9c1a9ca_Win_A_Banner_DeclineLink.zip]]></styles> ... <dockingUrl><![CDATA[Docking/Docking.zip]]></dockingUrl>... <DownloadPath><![CDATA[temp]]></DownloadPath>... <DeleteOnEnd><![CDATA[]]></DeleteOnEnd>... <MultipleBars><![CDATA[]]></MultipleBars>... <declineShowChilds><![CDATA[1]]></declineShowChilds>... <hideWhenInstalling><![CDATA[1]]></hideWhenInstalling>..

<<< skipped >>>

GET /test.html HTTP/1.1

Host: track.v2.sslsecure1.com

Connection: Keep-Alive

HTTP/1.0 500 Internal Server Error

Date: Tue, 11 Nov 2014 20:04:48 GMT

Server: Apache

Set-Cookie: vsid=902vr1632818885129735; expires=Sun, 10-Nov-2019 20:04:48 GMT; path=/; domain=track.v2.sslsecure1.com; httponly

Vary: Accept-Encoding,User-Agent

Content-Length: 0

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

GET /test.html HTTP/1.1

Host: track.v2.sslsecure4.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Date: Tue, 11 Nov 2014 20:04:51 GMT

Server: nginx

Content-Length: 8

Connection: keep-alive

correct...

GET /test.html HTTP/1.1

Host: api.v2.sslsecure1.com

Connection: Keep-Alive

HTTP/1.0 500 Internal Server Error

Date: Tue, 11 Nov 2014 20:04:41 GMT

Server: Apache

Set-Cookie: vsid=918vr1632818814416723; expires=Sun, 10-Nov-2019 20:04:41 GMT; path=/; domain=api.v2.sslsecure1.com; httponly

Vary: Accept-Encoding,User-Agent

Content-Length: 0

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

GET /test.html HTTP/1.1

Host: api.v2.sslsecure3.com

Connection: Keep-Alive

HTTP/1.0 500 Internal Server Error

Date: Tue, 11 Nov 2014 20:04:43 GMT

Server: Apache

Set-Cookie: vsid=924vr1632818837002987; expires=Sun, 10-Nov-2019 20:04:43 GMT; path=/; domain=api.v2.sslsecure3.com; httponly

Vary: Accept-Encoding,User-Agent

Content-Length: 0

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

GET /test.html HTTP/1.1

Host: track.v2.sslsecure3.com

Connection: Keep-Alive

HTTP/1.0 500 Internal Server Error

Date: Tue, 11 Nov 2014 20:04:50 GMT

Server: Apache

Set-Cookie: vsid=917vr1632818906521954; expires=Sun, 10-Nov-2019 20:04:50 GMT; path=/; domain=track.v2.sslsecure3.com; httponly

Vary: Accept-Encoding,User-Agent

Content-Length: 0

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

GET /test.html HTTP/1.1

Host: staticrr.paleokits.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:04:46 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

8..correct...0......

GET //Dictionaries/English.xml HTTP/1.1

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:05 GMT

Content-Type: text/xml

Content-Length: 626

Last-Modified: Fri, 12 Apr 2013 09:51:55 GMT

Connection: keep-alive

ETag: "5167d93b-272"

Accept-Ranges: bytes

<dictionary>. <installed> Installed </installed> . <installing>Installing</installing> . <installingetc>Installing...</installingetc> . <downloadError>An Error has occurred</downloadError> . <takeFewMinutes>It may take a few seconds</takeFewMinutes> . <confirmExit>Are you sure you want to exit?</confirmExit> . <installClose>Do you want to install the remaining offers?</installClose> . <welcome>Welcome</welcome> . <license>Welcome</license> . <options>Additional Options</options> . <instalando>Installing</instalando> . <finish>Finished</finish>. <downloadingetc>Downloading...</downloadingetc> .</dictionary>HTTP/1.1 200 OK..Server: nginx..Date: Tue, 11 Nov 2014 20:05:05 GMT..Content-Type: text/xml..Content-Length: 626..Last-Modified: Fri, 12 Apr 2013 09:51:55 GMT..Connection: keep-alive..ETag: "5167d93b-272"..Accept-Ranges: bytes..<dictionary>. <installed> Installed </installed> . <installing>Installing</installing> . <installingetc>Installing...</installingetc> . <downloadError>An Error has occurred</downloadError> . <takeFewMinutes>It may take a few seconds</takeFewMinutes> . <confirmExit>Are you sure you want to exit?</confirmExit> . <installClose>Do you want to install the remaining offers?</installClose> . <welcome>Welcome</w

<<< skipped >>>

GET //Styles/Templates/e9c1a9ca_Win_A_Banner_DeclineLink.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:06 GMT

Content-Type: application/zip

Content-Length: 344899

Last-Modified: Fri, 07 Mar 2014 11:17:00 GMT

Connection: keep-alive

ETag: "5319aaac-54343"

Accept-Ranges: bytes

PK.........YgD..l>9....c......style.css..ko......?....M-G.#q...m...p.-..^...D.... ..w....S")JvrIp-b#.I.3...p.....\....,Z.PZ.......Q..._D.,*.%h.K..a.*..r8......R.s]....<.*T............^.Sx?,QD....A..<._..$.>_..|;<..`........#..!(s...:.....< VC..|].A.6.,.... X,p:u..A.......!.......u...3.}.D...eIVL...9}...j9=;w..-..^,.i0.e.8..... j]..,......,.S.k:....Q...Q1O.....1Jy......y..t...I.rX@.g)*@....J~. F....-.U..,&.P......arr.>%.1..W..........l%..p.W..h.........LJ....<....m..U..........!H..vN`:s........D....{D4..e.i.........%..t...!~\......F..^..Sgt...."...x...<.-.`...t..w..@..8....X.. (."=U.....(....(.....JL-..@...=...W..1.p..2.j..y...rlK.l..{|D....s.%.2....3.\ 'H3.... ......'.....iu....D..D....D!..A.....Q....@..y(`>.3b0?;..1..CW... ..V.W.gd.......R1..2.P.|.......^..p.."...5..L."mF.......R..8...[.PB..#]}F8- .....%E.......F#.D.!....."..:.,.:R\Y...g>...R.u].....B...B....@C./.DP.Zc.....g.d#i.2.A......af.D.4;.@~WW.......&..Srfk.8--.....n..s..b....d).......e..W.d......?l=...5...GG...G......$&..=.......tV.W....p...1........p...xF. ..1..pL.sD....;......._,....3..,....a.....s<.L...<..`.....)9.4...x(...P2...w...e......a....wqIe...6.8.....5..mx.gD.1G.....`.IA...>.X.<.... .~..b..dq..8.^...uN>.d..!...8*.2.W.. .....H.U........7. ...w..D.O_r.W....9....0.F..._..L.........V.VI5Y.s..sZ ]` #%Z..p ..Z .;olx.........M.C..^.....7.......p.....O.6.m.....zd.<..G.,g...Y.j.|..TP...|...d2.r.....K.6......b....vu..|..s.. ... 7.....9'.c..[...sD0C........F..,I..R....IcL._...I ...(ZB....LZ.m.2.....;h

<<< skipped >>>

GET //Displays/Templates/8a204893_Win_A_Banner_DeclineLink.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:11 GMT

Content-Type: application/zip

Content-Length: 8012

Last-Modified: Mon, 03 Mar 2014 12:55:03 GMT

Connection: keep-alive

ETag: "53147ba7-1f4c"

Accept-Ranges: bytes

PK.........fcDg...............box.html.V.n.6....}.......\.!..E..h.6....~..tl..H..b{E.y..CI.;E2t./...|.J6....D...$u.$..7..:...}>.0v...?.F....p.D. ...K...........x...Cm.,..&^......[.......'...$......?>>.. f.........(...?./>.h..a.).|....Q.*..<N....q...p[....h.@. ..@I\.....c..).Sn,...:8:zu..S...'......K.hC. MVQq[.5"..A..!..e}n!..%.d.Z7.`S.G.C......@.W....hy....66"G!k.y.....1a.%..p6T..M.,....X.n.J_.........^..-:....'..$C...X .V..~...e.)n..V........Kl..!_ ...Rsw"a.N...H\z....5.[.....u.^\.u2%Z...E....&(...J..7..d.....y........RRjk..0V.........J..f".H,..j.i.B...9..O...]...V.H........g......'._z..\.M........L!.M.6.f...dEsl...2.K.J],=X...^.<.F......5.X.b...r..ON......:......c.....jD..l..yOK.O..6m..;.OIEj2>..oj ..=.."....W...c.1....y..f. =......;3....'.c..{..)G.mP.o.m_..J.j.7p5......=.3].....MH..).....<....,....eWE?.n..[........B....A.D9Ae`.......$..JPX...@.Y........V.......|P......~.o1..8..%.15.....q.T...d............1.z..H..'...5B...Y.m1..as..'..6....-..%..s...N.........../q<...F..@R..?..?....V.h....}<R_.......0.%A.l...(..1...~'...........ln....g..5w.....^..b}.0.v.s.?..!.].....i.)....n....fg...T...*/...EHj.K..../..E..!6~...$......t.78...,..A~1.....-......]T...5......oxB1)....E.\ZX.~. .WbX..#......rw...).. U*.U.4.s%...&...Y...3.H."%.s...Ii.q.0.F"'gR>>'..ws......7.......^.y$..............|...Z.yt.k...^.BO.,S......~.O'\..PK.........F.C.2..............close.html]PAN.0.</..09p }.f.x.G.M.."8U.".=N.E .....L2>.....'..4d.:..p..v...E.n0 .a...^2D.....u>z.Q@..N.q[ryK....].c...)...E.f.F.

<<< skipped >>>

GET //Docking/Docking.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:12 GMT

Content-Type: application/zip

Content-Length: 37048

Last-Modified: Tue, 26 Nov 2013 13:00:11 GMT

Connection: keep-alive

ETag: "52949b5b-90b8"

Accept-Ranges: bytes

PK........1Q.A..T.............position1A.css.....0.D..W\.n....H.Q... .~@l...Ii"*..k.......9..]..t.jp.../.......6.<7Th...5L....}..E.. ....L.S...........V*...8.;r...,6..r..'.?WC......yX.'c............&.XHA...PK........,g.B^P.]............position2A.css.S.N.0.}n..b.K...m$p^v.j%^...~..............!.RB....c.9s.L~f...[r.....y.x..\.V.7d.-..L..}o.3k.........Dp.....99....x...P)3....(..V........EL..I..B.G.A..{.y........en....<.&.l...[..~.U..'..7..sCC.....O.Z....H.J..G.p;...`.>.....-V ..g6R.......qQ%.Ua....E.7>..o...W.....f..k.L.ME.....cTSF.....s|....#..%....| ..hBv...Lqf(..@.w=...~P$<p.E...y.u..........W.k0[...w.Z......fye.../...&Q.....c.q........1.0.g..ay......|.gI....W.4...GJ...R..e...;.....}b.5.3.^\...A[..O.FX..'5o.%r......F..:....PK.........H.@....Z...........position2B.css.Q.N.0.....D..a..Fp.1B............]....mA......$=.|?=.uF.U.....[ot..~...9Ld.Y.......N.y`~................#.||..j)y.(/..n.....^....45.....\.."..k$. ...0..@C'.$....Q..V.:k&.Z%.U ?.X.-..F..E.Ra.<u..;($g...}.......Ah...)...L.*5.Q0(.M.v.....t`....ho..........d/4.p...A.7.....Ee.$*J...S..r.=.<.... l..%.|!j..6..c"...%:.d.......Hen.[xK...O./....U.}fuV..PK.........lMBjre.....B.......position2C.css.....0....S...bL/....A...P}....h3%....nE.*..Y...}.]..FZ.m7s:.%..0MS...PIm.g....7...U..,VK..}....c..c..-b.g.FS...(.P.x.0.\.?\.'TS...k.2!WG4.....#G%l.. .'.{.....ix...B.}a..m..R.v......(.........,..#E.3'8.._....?...z.PK........VG.@! h.............position3A.css..Qo.0....S.:...-..R.........}..N.f|..k...}6Ic.%.:x;.......TT.l....._..Y._]..r._.x..Ppq.C

<<< skipped >>>

GET //Styles/Softwares/70e7b9d8_mystart.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:12 GMT

Content-Type: application/zip

Content-Length: 4152

Last-Modified: Tue, 03 Jun 2014 10:06:47 GMT

Connection: keep-alive

ETag: "538d9e37-1038"

Accept-Ranges: bytes

PK.........Y.D................images/PK.........Y.D,...I...........images/mystart-toolbar-gris.jpg}T.<........%.K....m63..f.h.s;..e...6.J.....".....R!....pR.RBEr ...?.s......]..y...}..}~?.3q...&....(.M......@.:< $......E...#...........9..T.......1(.4@......0.0.F..M..W..a.@"...j@....L....5..- &$.4.ni.#D.E..,......e.......f......-Q.!D8i1.....#sx......`....x..g..c.....,.@r........k....d6^.n3.....$...mQ....HC...........b........E!.|......... `r..E..... ........?.......SY.?.|.....l.[4...1..p^.CB.Y.s..<....s.pB...s0G...s.0. ......d/:.K.*..........5......@3 .....1..........`.lm0VV.F.&x........b......j..U..._...3..h...`K.6c.C-F&$#kc.Sk[..?......Z.iI..EK.A..Q.wI.gq.G.Z..l}.[..<Ic........E...$.....?.^.....o....@ZV...Y99yy99...$...H.....).C... I.|.R..Ka... ...P@....).R. .2H.....'.......I.B.2Pi9...K....,.[..........2...z....sYm.D<....;...k.*H.........'O..R.....]...$)...X..=.N<.!.o...%.<.A.Zg...D...J..e...8N........QkU...2..f .b?..W..........edO.....B.=.1.....d......6.7..*=.%m9.?.L.;.u ..D...a....6.......PB,ag.3...Z...9.n..kX...t.r.%..M.EBM8.>.lj1..9.....q&.FP.y..7..>.........@....B.0..|.}`......X..; ..6....L.J.".I.F'4.#..%......e.{.mK.14.A.r..uf.f*.N.."..g..-{z.Vm.....|.f.!..}.THn.v[AZMr.L.sg.../.Uk:`s.f...8...b.......4.j43_X.K.<f....P..E.....'3.X'....Zi......M.S..{d.a..O..6&3.%%8.......;F...%l9.. F.S..^..g.....[...GE<......e?..8#u.C..B7.}...}.S.yJ.v...zR...<...>........t.E|.4"..<.p..MIY....~.......g..6....6.=..\R....lp.......*.;..c...h.............7.S....S}......3 t=.U.a.....t..l.

<<< skipped >>>

GET //Displays/Softwares/222ac0df_display.html HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:12 GMT

Content-Type: text/html

Content-Length: 12475

Last-Modified: Tue, 03 Jun 2014 10:09:14 GMT

Connection: keep-alive

ETag: "538d9eca-30bb"

Accept-Ranges: bytes

..<div name="container-in" class="position-typenum mystart-win">...<h2 id="titleh">Welcome to the <span name="titulo_descarga"></span> Setup Wizard</h2>. . <h3></h3>. <h4><pre>Follow the on-screen instructions outlined in this wizard to install the new version of <span name="titulo_descarga"></span> and benefit from all the latest features and updates <span name="titulo_descarga"></span> has to offer.</pre></h4>....<div class="imagen-01"></div> . <p>Get the best of the Web delivered to you!</p> . <p>Instantly access tons of apps, games, video and social network directly in your browser, Facebook, Youtube, Shopping, email and so much more!</p>..<div class="options-form">. <div class="options-check">. </div>. <div class="options-radio">. </div>. </div>. . . <div class="textarea">.. PLEASE READ THE FOLLOWING TERMS OF USE CAREFULLY..THIS AGREEMENT IS MEANT TO APPLY TO ANY AND ALL ONLINE CONTENT AND SERVICES, INCLUDING ANY SOFTWARE PRODUCTS OF ANY KIND SUCH AS TOOLBARS, PLUGINS, EXTENSIONS, WIDGETS AND APPS (COLLECTIVELY "Tools") THAT MAY BE DISTRIBUTED OR MADE AVAILABLE BY VISICOM MEDIA INC. ("VISICOM") IN ASSOCIATION WITH THIS DOCUMENT AND THE FOLLOWING TERMS OF USE. BY DOWNLOADING, ACCESSING, INSTALLING AND/OR ACTIVATING ANY O

<<< skipped >>>

GET //Styles/Softwares/844a2c3b_browserapp.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:12 GMT

Content-Type: application/zip

Content-Length: 734

Last-Modified: Tue, 01 Jul 2014 09:26:57 GMT

Connection: keep-alive

ETag: "53b27ee1-2de"

Accept-Ranges: bytes

PK........YE.D...=....=.......browserapp.css.S.N.1.='R.aJ......j.\@TH\z.U........l.."...I..JI.:....y...}U..:.p...- Nf....n....U......q...ki.(-u..0.>V}8..A.....w_......\'GF.H....?.4.:..e..}?.X.Y....E..._L..>..!..... .......C...R(,/...o.Hx.p.B....s.. ..0KY.=s.'...m...o..8}..Fd.$....b...... b....Y>..<&...%...Jjd....p...XQK.g... ...F.......fp.E..7S>b......"..>.it.W......k..4.E....,).<...H.dk....p.d.....^..'....=.U.v3Q5L......6B...//l.....^........R..t^...fp<I.!....Eb...G............#`/.../PK.........k3C................images/PK..........YE.D...=....=.....$....... .......browserapp.css.. .................\.5.....\.5.....PK...........k3C..............$...............images/.. .........x..,3.....7.......7.....PK........................

GET //Displays/Softwares/9103144e_display (1).html HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:12 GMT

Content-Type: text/html

Content-Length: 21047

Last-Modified: Tue, 01 Jul 2014 09:28:50 GMT

Connection: keep-alive

ETag: "53b27f52-5237"

Accept-Ranges: bytes

....<div name="container-in" class="position-typenum browserapp-win">...<h2 id="titleh">Welcome to the <span name="titulo_descarga"></span> Setup Wizard</h2>.. .. <h3></h3>.. <h4><pre>Follow the on-screen instructions outlined in this wizard to install the new version of <span name="titulo_descarga"></span> and benefit from all the latest features and updates <span name="titulo_descarga"></span> has to offer.</pre></h4> .. .. <p>Browser-app helps you save time & money on your online shopping. We'll help you find attractive offers while you browse your favorite store.</p>.. <p>You can use your Browser-app with any browser installed on your computer, it is not necessary to install any particular browser just for saving money during online shopping.</p>.. .. <div class="options-form">.. <div class="options-check">.. </div>.. <div class="options-radio">.. </div>.. </div>.. .. <div class="textarea">..Acceptance of Terms of Use..The following license and terms of use (jointly: ...Terms of Use...) govern your access and use of the Browser-app.com.com website (...Site...) and your download, install, access and use of the Browser-app.com Browser Add-On (...Browser-app.com Add-On...) and all Site and Browser-app.com Add-On contained o

<<< skipped >>>

GET //Styles/Softwares/844a2c3b_browserapp.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:12 GMT

Content-Type: application/zip

Content-Length: 734

Last-Modified: Tue, 01 Jul 2014 09:26:57 GMT

Connection: keep-alive

ETag: "53b27ee1-2de"

Accept-Ranges: bytes

GET //Displays/Softwares/9103144e_display (1).html HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:13 GMT

Content-Type: text/html

Content-Length: 21047

Last-Modified: Tue, 01 Jul 2014 09:28:50 GMT

Connection: keep-alive

ETag: "53b27f52-5237"

Accept-Ranges: bytes

<<< skipped >>>

GET //Styles/Softwares/9c04a3ed_thebestdeals.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:13 GMT

Content-Type: application/zip

Content-Length: 750

Last-Modified: Thu, 09 Jan 2014 10:45:27 GMT

Connection: keep-alive

ETag: "52ce7dc7-2ee"

Accept-Ranges: bytes

PK.........S)D6.lz............thebestdeals.css..QO.0....)..F.....F.:/cP.I.^.i.NrM,....-C.........v..........u..E.G...drT......s.R.m....(.{[.55J,>.>.......9.....I...p.....n...."z.9.D.......B..d.....0H....i...&..K.!o;G....w...8&].f.z3.~.;._#*.....r]... ...N'.....Kz...!.O?...J:b...E...he.g-J..Q..V.vO..x@:dJ;..%Ke.]..@....K.iJ(C.......Rp.....y..a.W`5...|,.b..\..h.4\.4.b..4`..G;wK.W...1.,..\.X...7.Q..........[.%Dtfx.#.V.AC!..U.70....@....Y.{...}.@.S..!...l.xz.p....t.i.p.:...^......x....A..>w._;..X|.-....PK.........^.B................images/PK...........S)D6.lz..........$....... .......thebestdeals.css.. ...........0.%.....Ts%.....Ts%...PK...........^.B..............$...............images/.. ............A.V....Ts%.....Ts%...PK........................

GET //Displays/Softwares/c9c92824_display.html HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:13 GMT

Content-Type: text/html

Content-Length: 14037

Last-Modified: Thu, 09 Jan 2014 10:45:56 GMT

Connection: keep-alive

ETag: "52ce7de4-36d5"

Accept-Ranges: bytes

....<div name="container-in" class="position-typenum thebestdeals-win">..<h2 id="titleh">Welcome to the Installer Setup Wizard</h2>.. .. <h3></h3>..  ...<p><b>TheBest-Deals</b></p>...<p>TheBest-Deals will save you money and time while shopping online, delivering the best deal straight to your browser.</p>.. <p>Lowest price, effort free</p>...<div class="imagen-01"></div> .. .. .. <div class="options-form">.. <div class="options-check">.. </div>.. <div class="options-radio">.. </div>.. </div>..... <div class="textarea">....Terms of Service..Last Updated: October 1, 2013..Please read these terms of service as they constitute a legally binding agreement between BetterDeals (the ...Service...) and yourself. By accepting this agreement in the installation process, or by downloading or installing the TheBestDeals browser extension or by using any of the services included in it, you agree to be bound by the terms and conditions of this agreement, and you pro

<<< skipped >>>

GET //Styles/Softwares/e7bf26c3_mypcbackup.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:13 GMT

Content-Type: application/zip

Content-Length: 7774

Last-Modified: Tue, 15 Oct 2013 10:54:23 GMT

Connection: keep-alive

ETag: "525d1edf-1e5e"

Accept-Ranges: bytes

PK.........]OC................images/PK.........fJC..2.....T.......images/bullet-shortw.gifs.t..L.d.dh`d......#|..\.K....}EAbrvj.BRjzf........2Sl..M}.|..S32=..R...B....-S....l*.*r.rSK..*rs...*l..S..R..l.....XII...#HB.d.s~Q.....n...........................X..Y.. @......4. .7.]@..RFII...~yy.^..^~Q.....%..##]...........be......E..%..y. ~bR~i........pc......K....H,.7.3.GR..._in.\uqIPj.~..!....A....E..@.. ..V.E..%.E!..9.P..././../Pp.6S..ML....h.u..Zy...$.%.z..*.E.23S..L.,.M,..,....]....M....,......\.z.z]..KsS.J`zS.z-p..%............\....2q....yP.)..b.S.>.1.hQ........p...I?5............~......._>.......o^.z.....O.?z.....wn..y....W._.x....gN.:y....G..:x`...{v...c...[6o..a...kV.Z.b...K./Z.`...sf..9c...S&O.8................................ ?/7'; 3#=-5%9)1!>.6&:*2"<,4$8(0................................@_OWG[KSC]MUEYIQA^NVFZJRB\LTDXHP.................A.'..dd.a..P.........{...........PK.........N.C.U.?}...w.......images/mypcbackup.png}X.T.....CW....tH(...".wA..B.PBS..."H/"..).D:"E.*M.P..D@........[..Y_.9..=g...Y.....J......T.jJ..w(.f!'.?/....40...C.=.....P.C..@.n6.(...]......@t....c..%.D.......w...)2r..6H...d.rprG..Z:. ';.......PD9:.=.B.>.1B>rA...r. ..)<...c..wsu...G........!`._......A.j....^(.LHT...............@"Pa........I...D$@.,`|o^v.R.J*....B..1..)....O.OT.........8DD..........Awo....P.H/'.......mc... ......./Zw.....0....DX..._...........1.(.....(...1@y.}..........R.B.`.^Fh...Y.sDc...h....8.G.........B[[J...c..D. !.x.......TY...S.T.... .((....%....I...%..*..>n(w..X..cU. .....Fy9...T..n...-...b

<<< skipped >>>

GET //Displays/Softwares/16220985_display.html HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:13 GMT

Content-Type: text/html

Content-Length: 19650

Last-Modified: Thu, 03 Oct 2013 10:28:07 GMT

Connection: keep-alive

ETag: "524d46b7-4cc2"

Accept-Ranges: bytes

..<div name="container-in" class="position-typenum mypcbackup-win">...<h2 id="titleh">Welcome to the <span name="titulo_descarga"></span> Setup Wizard</h2>. . <h3></h3>. <h4><pre>Follow the on-screen instructions outlined in this wizard to install the new version of <span name="titulo_descarga"></span> and benefit from all the latest features and updates <span name="titulo_descarga"></span> has to offer.</pre></h4>....<h6>MyPcBackup</h6>..<ul>...<li>Fast and Easy to Install</li>...<li>Protect all your files</li>..</ul>..<ul>...<li>For Windows, Mac and Linux</li>...<li>Free Mobile and Tablet app</li>..</ul>. <div class="options-form">. <div class="options-check">. </div>. <div class="options-radio">. </div>. </div>. . <div class="textarea">...MyPCBackup EULA - End User Licence Agreement..IMPORTANT-READ CAREFULLY: This MyPCBackup ("MyPCBackup") License Agreement ("License" or "Agreement") is a legal agreement between You (either an individual or an entity, who will be referred to in this License as "You" or "Your") and MyPCBackup for the use of desktop, laptop, and mobile device software applications, and which may include associated media, printed materials, and other component

<<< skipped >>>

GET //Styles/Softwares/db393704_vuupc.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:13 GMT

Content-Type: application/zip

Content-Length: 741

Last-Modified: Fri, 10 Jan 2014 15:21:49 GMT

Connection: keep-alive

ETag: "52d0100d-2e5"

Accept-Ranges: bytes

PK.........^.B................images/PK........op*D.r.8....C.......vuupc.css.S.N.0.=7R.a......@.:.].B...@{v.7.p<...e .}mC.[....!q2~o.....53-.pr.wM.'y.......~b.5\Y8..._...Pb.u.....G....Q..o~..........YD9g...Q...... ...f.....A#....jK.T...h4....}.....t7{.<P..3C.h..I..Dik:..>..J(z.8.H......*KZ...4...EF.a.W$IC.R.Z.G.P..8.V.j..M. ...]aN......DC...$../........c:. .B..rb..B".T.E.@...........>.=On...5-_[f8.}..^.K..x..v......k.,..A).,..!.n4%7...iQ...W!.....u."........37..a...)`........b..E.E..^.'=.......I.....,\.............[.....>.k..11......PK...........^.B..............$...............images/.. ............A.V...B]......B].....PK..........op*D.r.8....C.....$....... ...%...vuupc.css.. ...........k.....R.[.....R.[.....PK........................

GET //Displays/Softwares/1d58e78d_display.html HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:13 GMT

Content-Type: text/html

Content-Length: 15298

Last-Modified: Fri, 10 Jan 2014 15:52:57 GMT

Connection: keep-alive

ETag: "52d01759-3bc2"

Accept-Ranges: bytes

..<div name="container-in" class="position-typenum vuupc-win">..<h2 id="titleh">Welcome to the Installer Setup Wizard</h2>. . <h3></h3>.  ..<p><b>VuuPC</b></p>..<p>Access your PC rom anywhere!</p>. <ul>. <li>Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile</li>. <li>Access All Your Files transfer them between computers (copy and paste, no need to send)</li>. <li>Invite friends to view your LiveScreen and share presentations</li>.. </ul>...<div class="imagen-01"></div> . . . <div class="options-form">. <div class="options-check">. </div>. <div class="options-radio">. </div>. </div>... <div class="textarea">..End User License Agreement..NOTICE TO USER: THE TERMS BELOW ARE A BINDING AGREEMENT. BY CLICKING "I ACCEPT" BELOW OR BY DOWNLOADING, INSTALLING OR ACTIVATING OR USING THIS SOFTWARE, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS LICENSE AGREEMENT, TH

<<< skipped >>>

GET //Styles/Softwares/0ba5df4c_optimizerpro2.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:13 GMT

Content-Type: application/zip

Content-Length: 65688

Last-Modified: Tue, 08 Jul 2014 14:49:06 GMT

Connection: keep-alive

ETag: "53bc04e2-10098"

Accept-Ranges: bytes

PK.........i.D................images/PK.........N.C..mT............images/optimizerpro-img.png....~.PNG........IHDR..............L......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$...

<<< skipped >>>

GET //Displays/Softwares/7f3e6cee_display.html HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:14 GMT

Content-Type: text/html

Content-Length: 8445

Last-Modified: Tue, 08 Jul 2014 14:47:05 GMT

Connection: keep-alive

ETag: "53bc0469-20fd"

Accept-Ranges: bytes

..<div name="container-in" class="position-typenum optimizerpro2-win">...<h2 id="titleh">Welcome to the <span name="titulo_descarga"></span> Setup Wizard</h2>. . <h3></h3>. <h4><pre>Follow the on-screen instructions outlined in this wizard to install the new version of <span name="titulo_descarga"></span> and benefit from all the latest features and updates <span name="titulo_descarga"></span> has to offer.</pre></h4>....<div class="imagen-02"></div>... <p>Optimizer Pro will automatically:</p>. . ....<ul>...<li>Diagnose and Scan for System Errors.</li>. <li>Optimize your PC to reach Peak Performance.</li>. <li>Maintain and Manage for extended PC Health.</li>..</ul>. . . . . . <div class="textarea">...The Acceptance of the Terms and Conditions:...By selecting to use our site PCUtilititesPro.com, you the user express your agreement to these Terms, (as well as to future changes which can be made to the Terms in the process of your further usage of our services offered). The Terms in

<<< skipped >>>

GET //Styles/Softwares/03652e13_aartemis.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:14 GMT

Content-Type: application/zip

Content-Length: 979

Last-Modified: Tue, 01 Apr 2014 16:23:37 GMT

Connection: keep-alive

ETag: "533ae809-3d3"

Accept-Ranges: bytes

PK.........OgC/w..............aartemis.css.U.O.0.~.........&..5/.`H<l....n.....9.-T....B..5.u.p.&=...}w..9.`UP..?o..........__..L.3*4..[....[..`......k..w.0[.7......1.4....)(....K(q....|.Ud..0V.f..fLDn%,........ .3F............e..F.8..'..Ri,......Io}...CL9.....X.#..F....s4.....1..k...1o.A......8.Yf>.!U.y.p&]X4.q..&Rg.i(9...*r,.SUH...H`.WSi.\3).hd6..%.. ....l1$..5OOO........Lp&h4.2....,..@.r....#...1..sS.~....5...{.<XVJ^%9M.:/..... kM.....Q..J6..pY..TD...%r...F.XQ\:i=..C........uhNyN.."U.sW.......T.*..T..3..s7Vi.N|xf.{..Re..E.(...sL..c...o9y..$...f.D9.c.^.%\.!.$Yz..........W=..y&...qE?.g..P..4.....G.._Vh.C....p...6..k.P.yr.\r....t`pq.EV..Lf[e......0..Y...^V.qv' ....JHnG.R.V[CW...Zz.....].[....*8..b...$V..*8~.P.?;..j.o.....'.....PK..........*C................images/PK...........OgC/w............$....... .......aartemis.css.. ...........&.....................PK............*C..............$...............images/.. ..........tVdE....K.......K......PK........................

GET //Displays/Softwares/ac80703b_display.html HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:14 GMT

Content-Type: text/html

Content-Length: 5460

Last-Modified: Tue, 01 Apr 2014 16:24:05 GMT

Connection: keep-alive

ETag: "533ae825-1554"

Accept-Ranges: bytes

....<div name="container-in" class="position-typenum aartemis-win-recom">..... <h2 id="titleh">Welcome to the <span name="titulo_descarga"></span> Setup Wizard</h2>......<h3></h3>...<h4><pre>Follow the on-screen instructions outlined in this wizard to install the new version of <span name="titulo_descarga"></span> and benefit from all the latest features and updates <span name="titulo_descarga"></span> has to offer.</pre></h4> ......<p>Express Installation Includes: Aartemis.com Homepage, Default Search and New Tab</p>...<p>Installation Options</p>......<h5><span id="spanRecomended" class="spanRecomended"> </span></h5>...<div class="imagen-01"></div>......<div class="textarea">.....Koyoter Technology Limited ("us" or "we") operate the website VVV.aartemis.com. We respects your privacy and we want you to be confident in sharing your information with us. This Website Privacy Statement is designed to inform you of the types of information we collect from users,how we use that information,and the circumstances under which we will share it with third parties. This Website Privacy Statement applies only to the Websites. It does not apply to your use of any other websites (whether or not operated by us),including any websites to which we provide links or websites of our partne

<<< skipped >>>

GET //Styles/Softwares/a616773d_feven.zip HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:14 GMT

Content-Type: application/zip

Content-Length: 723

Last-Modified: Tue, 15 Oct 2013 09:27:22 GMT

Connection: keep-alive

ETag: "525d0a7a-2d3"

Accept-Ranges: bytes

PK.........k3C................images/PK........PSOC l..............feven.css.SMO.0.=.R..,..$.).(u/ .J{.....d.X...1m........~..9$.g..7..E^.[....w#...[...\...O......t...bgk..].....5..V.../.......x[z....#Rca...Lp...............S.Y....?.....SC....! ..l?......s...1.*@M....N......{......XE..Z.E.....e.*>..w1B....k6!;.........!.."..i...B.F.'.....XQ..w.7.V...6B{1.csv#.B..'k..8..........p..E..^.. X...........4.E..A.[R*:.....d......I...W1.....Z?..=.e...A0.....Z..B-_,\Ox.|..Cy^.*.....J.3Y;..y\....w.Mt..E....>..f..15.#........_.PK...........k3C..............$...............images/.. .........x..,3...x..,3...x..,3...PK..........PSOC l............$....... ...%...feven.css.. ...........{.....a..S....a..S....PK........................

GET //Displays/Softwares/217ec6eb_display.html HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Host: staticrr.paleokits.net

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Nov 2014 20:05:14 GMT

Content-Type: text/html

Content-Length: 8927

Last-Modified: Thu, 03 Oct 2013 08:49:37 GMT

Connection: keep-alive

ETag: "524d2fa1-22df"

Accept-Ranges: bytes

..<div name="container-in" class="position-typenum feven-win">...<h2 id="titleh">Welcome to the <span name="titulo_descarga"></span> Setup Wizard</h2>. . <h3></h3>. <h4><pre>Follow the on-screen instructions outlined in this wizard to install the new version of <span name="titulo_descarga"></span> and benefit from all the latest features and updates <span name="titulo_descarga"></span> has to offer.</pre></h4> . . <p>Feven helps you save time & money on your online shopping. We'll help you find attractive offers while you browse your favorite store.</p>. <p>You can use your Feven with any browser installed on your computer, it is not necessary to install any particular browser just for saving money during online shopping.</p>. . <div class="options-form">. <div class="options-check">. </div>. <div class="options-radio">. </div>. </div>. . <div class="textarea">. .General. This Privacy Policy is intended for those using the feven.com website (...Site...), the feven browser Add-On (...feven Add-On...) and all Site and feven Add-On contained or displayed information and material (including but not limited to images, software, text, information, articles, graphics, pictures, sounds, solutions, metatags, trademarks and other

<<< skipped >>>

GET /test.html HTTP/1.1

Host: track.v2.sslsecure2.com

Connection: Keep-Alive

HTTP/1.0 500 Internal Server Error

Date: Tue, 11 Nov 2014 20:04:49 GMT

Server: Apache

Set-Cookie: vsid=922vr1632818893303279; expires=Sun, 10-Nov-2019 20:04:49 GMT; path=/; domain=track.v2.sslsecure2.com; httponly

Vary: Accept-Encoding,User-Agent

Content-Length: 0

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

GET /test.html HTTP/1.1

Host: api.v2.sslsecure2.com

Connection: Keep-Alive

HTTP/1.0 500 Internal Server Error

Date: Tue, 11 Nov 2014 20:04:42 GMT

Server: Apache

Set-Cookie: vsid=908vr1632818827801948; expires=Sun, 10-Nov-2019 20:04:42 GMT; path=/; domain=api.v2.sslsecure2.com; httponly

Vary: Accept-Encoding,User-Agent

Content-Length: 0

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

Map

The Application connects to the servers at the folowing location(s):

Strings from Dumps