MemScan.Adware.OutBrowse.A_d3a9632b6d – Adaware

not-a-virus:AdWare.Win32.OutBrowse.f (Kaspersky), MemScan:Adware.OutBrowse.A (B) (Emsisoft), MemScan:Adware.OutBrowse.A (AdAware), Trojan.NSIS.StartPage.FD, Trojan.Win32.IEDummy.FD, Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR, TrojanDropperVtimrun.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: d3a9632b6d00aae007a23d449fabf6aa

SHA1: 6ee28fb19adba86bbe6dbe2a43211e8c65d18670

SHA256: 33ae9049f5c93a1154f87a095d3de2e0df43b613577ca5afa72717cb5b58cfb0

SSDeep: 24576:znk Bd3ksSVACXBUtNXT Xqkk9qrKjuip:I Bd3kscACXStNXpRaKy

Size: 999688 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2009-12-06 00:50:52

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The MemScan creates the following process(es):

%original file name%.exe:236
wmic.exe:2032
dxwsetup.exe:860
6_Offer_7.exe:456

The MemScan injects its code into the following process(es):

f.exe:1580

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:236 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\instructionsMad.dat (24860 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\f.exe (149252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\Convert.dll (3005 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\instructionsMad.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp (0 bytes)

The process f.exe:1580 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7I3S7CX\jquery-ui-1.8.19.custom[1].css (5521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GFKJAXIB\DynamicOfferScreen[2].htm (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHYZ85SN\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8NQJKLMH\dc[1].js (1657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6_Offer_7.exe (14612 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8NQJKLMH\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHYZ85SN\jquery.min[1].js (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHYZ85SN\Setup_product_6416[1].exe (28164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7I3S7CX\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GFKJAXIB\DynamicOfferScreen[1].htm (1140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7I3S7CX\button_over[1].png (921 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (0 bytes)

The process wmic.exe:2032 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (238 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (0 bytes)

The process dxwsetup.exe:860 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%WinDir%\DirectX.log (1635 bytes)
%System%\DirectX\websetup\SET6.tmp (10815 bytes)
%System%\DirectX\websetup\SET5.tmp (601 bytes)
%WinDir%\setupapi.log (5088 bytes)

The MemScan deletes the following file(s):

%System%\DirectX\websetup\SET6.tmp (0 bytes)
%System%\DirectX\websetup\SET5.tmp (0 bytes)
%WinDir%\inf\oem10.inf (0 bytes)

The process 6_Offer_7.exe:456 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\dxwsetup.inf (477 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\dsetup32.dll (25519 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\dxwsetup.exe (8906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\dxwsetup.cif (1111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\dsetup.dll (2104 bytes)

Registry activity

The process %original file name%.exe:236 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 02 FE 03 6E 5A 57 7E 7E 3B 52 CA 2E 02 7F 6A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process f.exe:1580 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014112720141128]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014112720141128]
"CachePrefix" = ":2014112720141128:"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014112720141128]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014112720141128\"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014112720141128]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 2C EA C2 C1 8A 34 DC 38 25 FF C5 8A 45 B7 52"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014112720141128]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The MemScan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040820140409]

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wmic.exe:2032 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED 8E B4 F7 AA 13 7F C1 E0 62 0B 25 E6 6B 3B 42"

The process dxwsetup.exe:860 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 F9 20 57 86 A1 94 29 58 9D BF CB 4E 72 6A D7"

[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem10.inf" = "1"
"INF/oem10.PNF" = "1"

The process 6_Offer_7.exe:456 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD 7B C3 4B 07 CA A8 27 B0 19 A2 1C E8 1B C5 DE"

To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

Dropped PE files

MD5	File path
8bbb35f59be1f16ca639c8621771f397	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\6_Offer_7.exe
10711c112b8b6b910df358b8d723fdbc	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\dsetup.dll
d89abac89ff70bb6de7e287b7200aa91	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\dsetup32.dll
8b40e232719c34324eee465976a5cb16	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\dxwsetup.exe
ff745d855bc0ade231860517b7413bf4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\f.exe
00321d477f76e401373c1fc71c7c4502	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso2.tmp\Convert.dll
8bbb35f59be1f16ca639c8621771f397	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\IHYZ85SN\Setup_product_6416[1].exe
10711c112b8b6b910df358b8d723fdbc	c:\WINDOWS\system32\DirectX\websetup\dsetup.dll
d89abac89ff70bb6de7e287b7200aa91	c:\WINDOWS\system32\DirectX\websetup\dsetup32.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:236
wmic.exe:2032
dxwsetup.exe:860
6_Offer_7.exe:456
Delete the original MemScan file.
Delete or disinfect the following files created/modified by the MemScan:
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsMad.dat (24860 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\f.exe (149252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\Convert.dll (3005 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7I3S7CX\jquery-ui-1.8.19.custom[1].css (5521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GFKJAXIB\DynamicOfferScreen[2].htm (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHYZ85SN\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8NQJKLMH\dc[1].js (1657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6_Offer_7.exe (14612 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8NQJKLMH\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHYZ85SN\jquery.min[1].js (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHYZ85SN\Setup_product_6416[1].exe (28164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7I3S7CX\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GFKJAXIB\DynamicOfferScreen[1].htm (1140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7I3S7CX\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (238 bytes)
%WinDir%\DirectX.log (1635 bytes)
%System%\DirectX\websetup\SET6.tmp (10815 bytes)
%System%\DirectX\websetup\SET5.tmp (601 bytes)
%WinDir%\setupapi.log (5088 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\dxwsetup.inf (477 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\dsetup32.dll (25519 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\dxwsetup.exe (8906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\dxwsetup.cif (1111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\dsetup.dll (2104 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: DirectX
Product Version: 3.0
Legal Copyright: DirectX
Legal Trademarks: DirectX
Original Filename:
Internal Name:
File Version:
File Description: DirectX
Comments: setup Installer
Language: English (United States)

Company Name: Product Name: DirectXProduct Version: 3.0Legal Copyright: DirectXLegal Trademarks: DirectXOriginal Filename: Internal Name: File Version: File Description: DirectXComments: setup InstallerLanguage: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	65536	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	258048	3176	3584	2.76239	23c6fdcfafaa85328556c2a67b7fa90c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 67
4802e2dc15d27c987792504e09af1c7c
87757b23da5aeabbd23a89392f78efe7
405239c5af3b8b1d94f481ccbf6f5a7a
9259d8b4b270a1077624191752fe1075
2a08f470eab68d0c1df934d6fb930360
145e93a0762d1601be7bf622efcc12a8
91abdefded146999db4fe1a6819e4de1
fbbec612a190ffa2234d9306190f0d9a
6dfda597b9af365a7de82a6223f3ab4f
1f392f50126fa7d9321934cd3f1793e6
14a4fbd502d6a8e2d41c4d5c4177ff4c
f720066388972c6f4f6f933f27ec3f81
4696b62f912496bf56214383008d837c
22170cfee2bbdfc491ceaf10beb7dc23
f196a2eb920c0f2257144462db039dd1
2504e51edace88506e0c19a54885ba2d
bc575ac5260c15ff8cc54f7c5a7ddd83
e4c641363ad2727f97f8878f5df0a163
44402a4cc2aa34d88afcd678af1f4483
dfe55d802b5d07bdc4f36d4136520759
d962952f284dcf17c45f4ca21d24bb29
a62b3c50d50c7b7e881ae57e338e0d76
369eb04479f02a21d2899979247245ae
bfa78289d8692cafaf6c4d1217517c60
971e9dcd4d2c8f3be4ecfc6b73c54f10

Network Activity

URLs

URL	IP
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=1184&distid=7623&productid=6416&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:3F:C9:30&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/Files//Setup_product_6416.exe
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=2&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Track?pubid=1184&distid=7623&productid=6416&subpubid=0&campaignid=0&networkid=1&reqid=167417161&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:3F:C9:30&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=6416&offerscreenid=&offerorder=7&downloadduration=8063&installduration=359
hxxp://smartinstaller.elasticbeanstalk.com/Installer/TrackFinish?reqid=167417161&x=y&clickid=8ce9fa275528afc182baf4b835fa668e
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.5/jquery.min.js
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&
hxxp://smartinstaller.elasticbeanstalk.com/installer/thankyou?productid=6416&pubid=1184&distid=7623&countryid=262&reqid=167417161&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0
hxxp://stats.l.doubleclick.net/dc.js
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topLine.jpg
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topComp.png
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bgImg.jpg
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bodyImg.png
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bottomLine.jpg
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/nextCase.jpg
hxxp://smartinstaller.elasticbeanstalk.com/installer/ThankYouInner?productid=6416&productname=DirectX
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button_over.png
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button.png
hxxp://n20.adshostnet.com/js/show_ads.js	199.167.149.97
hxxp://n20.adshostnet.com/ads?v=1&key=6c2c19aff050b202bf7c7970cb59cde3&ch=&click=&tz=2&t=1417050832847&scrWidth=1276&scrHeight=846	199.167.149.97
hxxp://n20.adshostnet.com/impression.gif?b=16&p=11&ch=&ap=&cps=&c=16&l=UA&h=601aaa7c277e8dfa44e431f41e9b18d8&t=1417050833066&s=d733401daca461ac9ff420e846d915ba	199.167.149.97
hxxp://d.delivery49.com/widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd	166.78.35.128
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.1/jquery.min.js
hxxp://a1834.g1.akamai.net/js/widgets/clkL.min.js
hxxp://a1834.g1.akamai.net/styles/widget/static/theme6_template8.css
hxxp://a1834.g1.akamai.net/images/addons/icons/34388/ss.jpg
hxxp://a1834.g1.akamai.net/images/widget/6/addon.png
hxxp://a1834.g1.akamai.net/images/widget/6/widget.png
hxxp://a1834.g1.akamai.net/images/widget/6/header.png
hxxp://a1834.g1.akamai.net/images/widget/button.png
hxxp://dualstack.counter-817696455.us-east-1.elb.amazonaws.com/blank.gif?t=142953942343&h=68a1a1d0f6fba9cabe1c0ab89eeadccd&cids=11ik
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&	54.235.69.147
hxxp://static.revenyou.com/offers/images/Theme8/button.png	198.232.124.224
hxxp://cdn.delivery49.com/styles/widget/static/theme6_template8.css	88.221.132.115
hxxp://cdn.delivery49.com/images/widget/6/header.png	88.221.132.115
hxxp://installer.apps-track.com/Installer/TrackFinish?reqid=167417161&x=y&clickid=8ce9fa275528afc182baf4b835fa668e	50.17.229.113
hxxp://cdn.delivery49.com/images/widget/6/widget.png	88.221.132.115
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js	64.233.166.95
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css	64.233.166.95
hxxp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css	198.232.124.224
hxxp://cdn.delivery49.com/images/addons/icons/34388/ss.jpg	88.221.132.115
hxxp://dl.revenyou.com/Files//Setup_product_6416.exe	198.232.124.224
hxxp://cdn.delivery49.com/images/widget/button.png	88.221.132.115
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&	54.235.69.147
hxxp://static.revenyou.com/offers/images/Theme8/button_over.png	198.232.124.224
hxxp://cdn.delivery49.com/js/widgets/clkL.min.js	88.221.132.115
hxxp://installer.apps-track.com/Installer/Track?pubid=1184&distid=7623&productid=6416&subpubid=0&campaignid=0&networkid=1&reqid=167417161&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:3F:C9:30&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=6416&offerscreenid=&offerorder=7&downloadduration=8063&installduration=359	50.17.229.113
hxxp://cdn.delivery49.com/images/widget/6/addon.png	88.221.132.115
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js	64.233.166.95
hxxp://installer.apps-track.com/installer/thankyou?productid=6416&pubid=1184&distid=7623&countryid=262&reqid=167417161&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0	50.17.229.113
hxxp://static.revenyou.com/offers/images/Theme8/bgImg.jpg	198.232.124.224
hxxp://installer.apps-track.com/Installer/Flow?pubid=1184&distid=7623&productid=6416&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:3F:C9:30&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1	50.17.229.113
hxxp://stats.g.doubleclick.net/dc.js	74.125.143.156
hxxp://static.revenyou.com/offers/images/Theme8/topLine.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/bottomLine.jpg	198.232.124.224
hxxp://installer.apps-track.com/installer/ThankYouInner?productid=6416&productname=DirectX	50.17.229.113
hxxp://static.revenyou.com/offers/images/Theme8/bodyImg.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/topComp.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/nextCase.jpg	198.232.124.224
counter.d.delivery49.com	54.243.56.0

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /offers/images/Theme8/topComp.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 27 Nov 2014 01:12:00 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">....</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<< skipped >>>

GET /offers/images/Theme8/bodyImg.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 27 Nov 2014 01:12:00 GMT

Content-Type: image/png

Content-Length: 1914

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 10:27:32 GMT

ETag: "36dd864c691ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 04 Dec 2014 01:12:00 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR.......:.....j.......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...0PLTE................................................{.......IDATx......:..`..p..J.4.ty.:......)v..\....,.fwv..U...!.....b.f.....Cy(..OW......w......]R..l..2My}<..]..8hn{*..X.).m..4w.U.J.....u..l.J...<...>uJ.....i.>o.%......I.\..S......U.D.}OK..J`......sJ`.}..M.9%..A....u.T.%........K....OQ..._..d.>..L....]I. U.].c.Je...|.W.U?..E.}...*.vZ...K...M....).W...^V..>).e(.].Z.}dg%@....S.*/...........Y.W.]}...|.SgO........rrj...4UY../..r.~.....Z.ep.wui.sP^..X.g%$(.......C........Ze....4yn}....U.({.V..{o..}O...w.G.Q.^..r..p....0y............8......6.v....zz~....-...F*..f.F]...R..*. -......e{mO.s.i.9.U....zz.6.f.T>.f.DQ%.. ...l.q\N."eA({_W7..Q.....d........>...Y.."e.\....s,.. .Li)%....R.o.....C.9wQ....8........KNY..t..)...k...v)P*.....I...4&../.{)..qe..R.'...2..*..d.z&.T;y..)Q*....)R..2..)Tj.B..)V..b..)W......QB!rj.B.J)..N)b*...R)q..<S...z%.LPr..%.LQ2.4e.....q&*c.De,..J.x& ig...g..b.(.g..p.)Qf..uf*1g..af .Y...... .;(.....s......r.v. ...s'...K.0wS.....sG%.......-.R..}......4S.....W.....=.9eN(..OS..Jt(...<...P.(..DJ;_)..Y. ..7.>.@.Bi....HS)eM.qi;...........$.z%.[..P...SJzT*E]......2zT.t..L%6.TJ..Y.a...}.V..J...,.....H... ....;..2_._/[.^/[.\.W.\.!..%oT*y.Z....#Q.Bw.FI.7...H..2Jt.*..../........2.F..X.....gqJ.q:.U.q.. V...B..s.(.J2.x..()#1@.'d4.Hh.h.J.I.i.G.#.;.J....*Q$Z..?.........sR..D.<...| ......2.1b.A3...v.....X.y{..R....{h..pzJ.I.).Y..Kn.z;%Jn..c.W...bL........t..!...A..(..*

<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 27 Nov 2014 01:12:01 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<<< skipped >>>

GET /offers/images/Theme8/button_over.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 27 Nov 2014 01:12:02 GMT

Content-Type: image/png

Content-Length: 921

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT

ETag: "f072da2a092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 04 Dec 2014 01:12:02 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...;IDATx..Z;o.1..Y.D...W."$=D..*=BPR@..5..........DHi...M.i...e.r............;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.sh..e..z.A....G.p..IZ.z...?Ra8........Y......O.......[........sL..?@.o....y..-.....Lc.0......O..|z.O/...k.....e...n..!......G.p...9....3. .'?7 ..GD@..{.<....C$....N.........Q...<.,@...].;Q.'<.(.X.r.,.6.......QrB..h..d&r....6....G..Shr.... .....4r..= ..f.....B.qP..l.K........YB.Z....H....../:.l.(.S.D...nM7..P.%R........&_uR.H6A..(raP.H9...[\D. .(....d...`.8.A......r5Q..........:v.e....u.....-&.1.....&.........Z.|....).L...$....)K%a-....b..a*{<(W..P<..w7_Z.....h.%6.N........*\FB...A...#..f.N...C..(.p...........K.|..5d..3u-........(.k. 7..6..tsvP!.U0.q.......9z.e ..0.ALt..@l..2iR.2............. .>=...{WVim....f.c6.:...|.....0X.yk...../z..!.SHW.d......o.s........a..8..g.|zvg...o6......@..........n.^......IEND.B`.HTTP/1.1 200 OK..Date: Thu, 27 Nov 2014 01:12:02 GMT..Content-Type: image/png..Content-Length: 921..Connection: keep-alive..Cache-Control: max-age=604800..Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT..ETag: "f072da2a092ce1:0"..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..Expires: Thu, 04 Dec 2014 01:12:02 GMT..X-Cache: HIT..Accept-Ranges: bytes...PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...;IDATx..Z;o.1..Y.D...W."$=D..*=BPR@..5..........DHi...M.i...e.r............;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.sh..e..z.A....G.p..IZ.z...?Ra8

<<< skipped >>>

GET /widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://n20.adshostnet.com/ads?v=1&key=6c2c19aff050b202bf7c7970cb59cde3&ch=&click=&tz=2&t=1417050832847&scrWidth=1276&scrHeight=846

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.delivery49.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Vary: Accept-Encoding

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Date: Thu, 27 Nov 2014 01:12:03 GMT

Connection: Keep-Alive

X-Powered-By: PHP/5.4.26-1~dotdeb.1

Content-Length: 1133

...........V.r.6.}.L...L.............z\9r.< ...A.. K...H...Y.SS..C\v.....'.'...._...d.]..~yq....y........<.r.|..f.....s"0>.. '5..a.\..e..*..k...|k\..f....:..I.p..\.;........2B...~.C.E7....>.$e.u......'.=..S...7..c....P0.E27,7.sq..f.A..7..oy8......67le..6FQJ.f&X............4z.:...B...e.. .m4g.#j..3.".M.....?.......O."IF....D)........b..G.-.q.{".SH../[.~.v...t..0.{4n...Qk..Z....[..O;..s.....)^..U.,.rOV^"e".).."..sX.P....Sk.{}...^.s.^;........?..G..O`.....5^r.0.q$...8<x~<..<.@.$S %.PI.D.h..L........ T{k.0..G..,cGw.e.U.. }..o..f...W'.`.J.F.....-.!.RN)...Q..G.b5v..L...4pHl..r..Ih..d!...a..n.L..D`...j....Y.....D.$....I.3.....C.ai{;..s....Ã‰.M0....&$..o.......4..q......Y...S<I.....-P......*.kH.z.s....$zH.\..\..*. XlFda..*H....j..2.#...$.x.2.Zc..6.1.8;_....a4.c]..e.....L<...$<O.c..........0......Cbx.<s....w...kL(....D.N.3.`..."q..@..{..v.4t.<i..gR....itu."-.W./...9....N.2.p....7.Y..p;..z'..%..$.G.2.r.l.c..&.L).4Zr.".D.#...QN.\....i].DI).....i.b{......Gh...I.*.u.l.o....b)..nf..u.....W!"...*.L5=... D.l......I...oh.-g....4pZPLf...P*.T.Z..jf.z...;C...J_..Kx....n{....m.p...h@|..V|..d....Q...!..$....S..>.(.w.ko......sz..M#.y......

GET /installer/thankyou?productid=6416&pubid=1184&distid=7623&countryid=262&reqid=167417161&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 27 Nov 2014 01:11:54 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 1288

Connection: keep-alive

..<html>.. <head>.. <title>Thank you for installing DirectX</title>.. <script type="text/javascript"> var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]);.. _gaq.push(['_trackPageview']);.. (function() {.. var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.. ga.src = ('https:' == document.location.protocol ? 'hXXps://' : 'hXXp://') 'stats.g.doubleclick.net/dc.js';.. var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.. })(); </script> .. </head>.. <body>.. <div style="position:relative;left:0px;top:0px;color:white; height: 1px; visibility: hidden;"></div>.. <iframe src="hXXp://installer.apps-track.com/installer/ThankYouInner?productid=6416&productname=DirectX" width=100% height=100% frameborder=0 scrolling=no marginheight=0 marginwidth=0 > </iframe> .. .. </body>..</html>......

<<< skipped >>>

GET /installer/ThankYouInner?productid=6416&productname=DirectX HTTP/1.1

Referer: hXXp://installer.apps-track.com/installer/thankyou?productid=6416&pubid=1184&distid=7623&countryid=262&reqid=167417161&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 27 Nov 2014 01:11:55 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 907

Connection: keep-alive

..<html>.. <head>.. <script type="text/javascript"> </script>.. .. </head>.. <body>.. .. .. <center>.. .. <script type="text/javascript">.. //<![CDATA[.. epom_key = "6c2c19aff050b202bf7c7970cb59cde3";.. epom_channel = "";.. epom_code_format = "ads";.. epom_ads_host = "//n20.adshostnet.com";.. epom_click = "";.. epom_custom_params = {};.. epom_width = "1200";.. epom_height = "1400";.. document.write("<script type='text\/javascript' src='" (location.protocol == 'https:' ? 'https:' : 'http:') "//n20.adshostnet.com\/js/show_ads.js'><\/script>");.. //]]>.. </script>.. .. </center>.. </body>..</html>HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html; charset=utf-8..Date: Thu, 27 Nov 2014 01:11:55 GMT..Server: Microsoft-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Powered-By: ASP.NET..Content-Length: 907..Connection: keep-alive....<html>.. <head>.. <script type="text/javascript"> </script>.. .. </head>.. <body>.. .. .. <center>.. .. <script type=

<<< skipped >>>

GET /images/addons/icons/34388/ss.jpg HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery49.com/widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery49.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Mon, 17 Nov 2014 14:52:02 GMT

ETag: "15e132-456-5080f1f0c8880"

Accept-Ranges: bytes

Content-Length: 1110

Content-Type: image/jpeg

Cache-Control: max-age=43200

Date: Thu, 27 Nov 2014 01:12:04 GMT

Connection: keep-alive

GET /images/widget/6/widget.png HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery49.com/widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery49.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Thu, 27 May 2010 09:24:52 GMT

ETag: "201b5-1f5-4878ff6786100"

Accept-Ranges: bytes

Content-Length: 501

Content-Type: image/png

Cache-Control: max-age=43200

Date: Thu, 27 Nov 2014 01:12:05 GMT

Connection: keep-alive

.PNG........IHDR.......d.............tEXtSoftware.Adobe ImageReadyq.e<...KPLTE...........................................................................J.......tRNS..........................4......IDATx....QBQ....n(.(p..."........Z..........Es.A........dl.c.B..@..i.}. c.........Ms............4..dl.c.!h. h.!..4....y. c....A..A..9.......'..=.....;.26.........?-.(n..M.....cl....c..........c..........c..........c..16......c..16......c..16......c..16.............*.<{4.hv.dl..[. ........#.....IEND.B`.HTTP/1.1 200 OK..Server: Apache/2.2.16 (Debian)..Last-Modified: Thu, 27 May 2010 09:24:52 GMT..ETag: "201b5-1f5-4878ff6786100"..Accept-Ranges: bytes..Content-Length: 501..Content-Type: image/png..Cache-Control: max-age=43200..Date: Thu, 27 Nov 2014 01:12:05 GMT..Connection: keep-alive...PNG........IHDR.......d.............tEXtSoftware.Adobe ImageReadyq.e<...KPLTE...........................................................................J.......tRNS..........................4......IDATx....QBQ....n(.(p..."........Z..........Es.A........dl.c.B..@..i.}. c.........Ms............4..dl.c.!h. h.!..4....y. c....A..A..9.......'..=.....;.26.........?-.(n..M.....cl....c..........c..........c..........c..16......c..16......c..16......c..16.............*.<{4.hv.dl..[. ........#.....IEND.B`.....

<<< skipped >>>

GET /images/widget/button.png HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery49.com/widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery49.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Thu, 11 Mar 2010 15:16:22 GMT

ETag: "c981-3fd-48187e5c05d80"

Accept-Ranges: bytes

Content-Length: 1021

Content-Type: image/png

Cache-Control: max-age=43200

Date: Thu, 27 Nov 2014 01:12:05 GMT

Connection: keep-alive

.PNG........IHDR...,...,.......u.....tEXtSoftware.Adobe ImageReadyq.e<....PLTE.....MV..k.*.....k~.:...D..K|.S.)a..9r.9.......WS.....6........{.A..@9...q....b..:.#l.D|.6E....F3..j.$"d._..S..P../..p.-[."..IB....`r.3g.Em.6m..K..0....I...`.$...U..g..{.[^.1l.XW....~N..Y..I..p.I"].g.&...7..h.&...e. Z..Q..X..(z.U.?...W.A?r.5..e....ls.;@..c. T......<n....XtRNS........................................................................................x......'IDATx...[S.@.........6 ..........4m=.....h..7qs.:.m.....Ln.............bVCI Q..p.;.7..~....c..D...L...T....N\...s.B).-D,....L7"..>..N.B.........i.........=.r,b...Sâ€°..)#c....R/.... ...W.X.M.0...c.W....GK.~......m.h8..K.vnAbd...fF....)qtPX'.u.7.D.#..../..a.I.,,7.H.Q.\?.HG*jUi.....6... -..K.....M..F...2...3....9......g...P3.......;..[.#X....t...Q...t.._....C..~..B/"...A.}...>|.....\...8.<...!H.s.......7 5.4._$^d....Pl<.Y/!.U....3.....]....j...(V.4Oc...Y......L......... ........3{H"........m..D....4.UZX.t......;...$....g....d.&..g.d`...B6.X...?......{...k....IEND.B`.HTTP/1.1 200 OK..Server: Apache/2.2.16 (Debian)..Last-Modified: Thu, 11 Mar 2010 15:16:22 GMT..ETag: "c981-3fd-48187e5c05d80"..Accept-Ranges: bytes..Content-Length: 1021..Content-Type: image/png..Cache-Control: max-age=43200..Date: Thu, 27 Nov 2014 01:12:05 GMT..Connection: keep-alive...PNG........IHDR...,...,.......u.....tEXtSoftware.Adobe ImageReadyq.e<....PLTE.....MV..k.*.....k~.:...D..K|.S.)a..9r.9.......WS.....6........{.A..@9...q....b..:.#l.D|.6E....F3..j.$"d._..S..P../..p.-[."..IB..

<<< skipped >>>

GET /js/widgets/clkL.min.js HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery49.com/widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery49.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Mon, 12 Aug 2013 15:00:20 GMT

ETag: "ecdb-252-4e3c1620c2900"

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Length: 348

Content-Type: application/javascript

Cache-Control: max-age=43200

Date: Thu, 27 Nov 2014 01:12:04 GMT

Connection: keep-alive

Vary: Accept-Encoding

.............N.0...<.f..H!..).B.#...!.&...%U.vL[..dEk..5...c.....)..1~.p8fl..0.T....{...". .....q$.....b.....<..HKf.Yz}...~...:..l..."!...4....`..n.1.m..j........Xd...ak...b(m.@....4.*.3a..Y...&......*.......V14..EA...j......P=...^...@..d..............,..h,-.b.Ig.G.=.....k.T=........>./...7.]....../..D.... ..F.q......Zo'....._..q.c!6..&...C..R.......

GET /styles/widget/static/theme6_template8.css HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery49.com/widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery49.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Wed, 11 Aug 2010 13:36:53 GMT

ETag: "204f3-177a-48d8c57b10740"

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Length: 1178

Content-Type: text/css

Cache-Control: max-age=43200

Date: Thu, 27 Nov 2014 01:12:04 GMT

Connection: keep-alive

Vary: Accept-Encoding

...........X.n.:.}. ...vW%uHI.x............i7.._.@.......5M...........1.....Y.I....)&...Q....p....X..|..0,..Ny......JJ..Y}.1.ET ..<.U.Q.......0...=...Tx...tMw...Y...$.GE`yPY.............1.....\....#&.b.7.j.Q..[..R.i.v..!.q.K..8'a.k$.0.v.'..iW...5......r.fv..............@$.E. Q...K&......W."8.0..3z$ixd..'|.9........UE.......C..|>...w.B...H...f.2u.....T\.sL.t.......Gm>DAXG.y..=..4A...>..>a._.;..P.IW...X..`.".._,.....bT..y....a>...2.l.....V.I.i....... Xn...,2hCx.&..y......a^QVE4.Ec...t.Q....8.....E4.nv...c...H.)P........^..a...l...6.".Z......m.rRCj...T.yi[....`L....ou.J..qC.{..E.:...k..8/.B..t......A.,w....%J...<r.5...&...m.C......X.)...J..H..4..Ms2>....<...'.Y.BBO.VQ...x.......<wM...N......P........FlCEk.~..,..........G.....e.....E.k(..s..z$..4....7.Jn.<.C.I(;....Y-..(V.....$..8...r..N= .7..h.....q.S.....<'...]o..6.../. .....u..J..Zh...Z^i4..*....."X~.^........X..f_.K.....wl.6..A..E.......i....%Zqis...C[P3.Mz._.....I2`.h."7Q-.7...Dy.1..K&.......d..g..&..k ..&....6../...."..^\.R.q.W....MD......q.Z;ZN..77S.....O...S..AQ##7...4T.]..w.....2.J].i...*.o.3..<....D#.8...........k.........Dq.U.R...).<j.Mw....z.ov...=.\.W#.n........}<.02}W3......5....F......51&5.....Iz.......

<<< skipped >>>

GET /images/widget/6/addon.png HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery49.com/widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery49.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Thu, 27 May 2010 09:24:52 GMT

ETag: "201b2-226-4878ff6786100"

Accept-Ranges: bytes

Content-Length: 550

Content-Type: image/png

Cache-Control: max-age=43200

Date: Thu, 27 Nov 2014 01:12:04 GMT

Connection: keep-alive

.PNG........IHDR..............5.?....tEXtSoftware.Adobe ImageReadyq.e<....PLTE.....................................................................aaa<<<...BBB........................ppp...ccc===...mmm......XXX...WWW.......2IDATx....q.....'..2..px.$.O.(....ajj.m..4.I-d ..:".......................................................................;D.6.k?@$k...=D.6.k?A$k..v......M..................."Y...?!R.B$k.../D...dmR...H....M..=.dmR.~.H.&u...dmR...H...`m.6X......`m.6X....&u...$Z.@....f5..4.............f.q7.(.c;...p.@..a9..0.....[.......IEND.B`.....

GET /images/widget/6/header.png HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery49.com/widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery49.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Thu, 01 Apr 2010 11:12:58 GMT

ETag: "201b3-1c9-4832af1f3e280"

Accept-Ranges: bytes

Content-Length: 457

Content-Type: image/png

Cache-Control: max-age=43200

Date: Thu, 27 Nov 2014 01:12:05 GMT

Connection: keep-alive

.PNG........IHDR..............]'.....tEXtSoftware.Adobe ImageReadyq.e<...`PLTE...YYV.........332""..........mmkEED ).........%% {{y............//,QQM))$bb_......??>.........9.xW... tRNS................................\\......IDATx.\.... .F.BP....B{..l..u.p>...........7PV......}9y..v..W.*...,......Y6g.....8G.....9.'D!...*]d\......8.#.5M.C"A...a_u..,..0E5....h|....HI@cv..G.....[a.........4U.....i.-mI.Jw./.vrk.,....p..z..V.......9......$..zh......IEND.B`.HTTP/1.1 200 OK..Server: Apache/2.2.16 (Debian)..Last-Modified: Thu, 01 Apr 2010 11:12:58 GMT..ETag: "201b3-1c9-4832af1f3e280"..Accept-Ranges: bytes..Content-Length: 457..Content-Type: image/png..Cache-Control: max-age=43200..Date: Thu, 27 Nov 2014 01:12:05 GMT..Connection: keep-alive...PNG........IHDR..............]'.....tEXtSoftware.Adobe ImageReadyq.e<...`PLTE...YYV.........332""..........mmkEED ).........%% {{y............//,QQM))$bb_......??>.........9.xW... tRNS................................\\......IDATx.\.... .F.BP....B{..l..u.p>...........7PV......}9y..v..W.*...,......Y6g.....8G.....9.'D!...*]d\......8.#.5M.C"A...a_u..,..0E5....h|....HI@cv..G.....[a.........4U.....i.-mI.Jw./.vrk.,....p..z..V.......9......$..zh......IEND.B`...

GET /js/show_ads.js HTTP/1.1

Accept: */*

Referer: hXXp://installer.apps-track.com/installer/ThankYouInner?productid=6416&productname=DirectX

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n20.adshostnet.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

ETag: W/"6947-1416167328000"

Last-Modified: Sun, 16 Nov 2014 19:48:48 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Thu, 27 Nov 2014 01:12:02 GMT

a..............200...Yms.6.. 2....M;w3.@...n2q...Qr.....$$.....m ...-^H........`..}..z.......=^GzP.sJ..~....2...!...:g.~..R..a%$.Y.<_.Cz$........n.9.a....s..q...@...p..@}SN0..<s?....u.q^...r....(.iE.I..p.!.@.W.M.rND\4.D.e..%...K.n..../..H.V\.........*@._.(Dc<F..j..1~.E.....V..>.q.".....,..|a.'*....d#k..XV.....".. .....4. .\2.W..73Le,.%{..<.8.c..z...hJ8..'..d..<.EN..Db..eO.!...r9.yNK....M$'t....0....<.w.......G.(..^.H...h|.N^..NF............g...l.*..bc."P?..c...........V....-a..G....9c...w.-/Y./&..|...B.-.yD.......C...;.s`.2.....200...hQ....t...q .....^.7V..M.>*5............@TP<.W...t.24...&.Y..x..L............#4.aX;..7v...%.`...]]...a.x.!..d\(0(p...2.r..q!.g.$..M.J..%. Ba..h....-.%.j.qk....H..0...Py(.7.KP...Q .....d.)9<4....&7..".0.1_z..3]...........' ........:.e..:.......(~.>!..Ba.1..JJM.... &.2......KR.......z..p.p....;s.-..#.k...$h.`k........"/pp...b...?...U.2O..........5..3.W.....:.0N...}]E.3V.'Za.."@v.5....k...v.F..Z.F.d..k.q...~.C.S....(..X."..>P...gc..P..._......(\b.:h....4..S......7.....n.p!5.C......(p-...X...H.da.ap...^9Q .[....200......%D.... .....n..r.....Le...........,PGt2_..nG!.A..g..8.HDcHuB.....R...D.[.....JU...&....K.x....v....v...PE..........Iu..s..-M..x.8.._P....9.N..U..H. ........g$...#.U:.V...uu.V..2...hh..F8.....n._?....*.t.ap ....$.5...}`.....,.jLkT.~...I...9..N....s..i. ....%v.....Z.....2.$wg.C.b.el.6;......?.).{....].3......uC.{B3....=&..u.....t.nH..}.6'.q......:....=T.p.63...Y.....S..........:L..L2.$....J..',..Rn.x..-........m..z...X/xo5...b. .....w$.

<<< skipped >>>

GET /ads?v=1&key=6c2c19aff050b202bf7c7970cb59cde3&ch=&click=&tz=2&t=1417050832847&scrWidth=1276&scrHeight=846 HTTP/1.1

Referer: hXXp://installer.apps-track.com/installer/ThankYouInner?productid=6416&productname=DirectX

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n20.adshostnet.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: no-cache

Pragma: no-cache

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP="CAO PSA OUR"

Set-Cookie: epomUUID=650e85b0-75d2-11e4-b202-002590aa01de; Domain=.adshostnet.com; Expires=Wed, 22-Nov-2034 01:12:02 GMT; Path=/

Content-Type: text/html;charset=UTF-8

Content-Length: 649

Date: Thu, 27 Nov 2014 01:12:02 GMT

<html><head></head><body leftmargin='0' topmargin='0' marginwidth='0' marginheight='0' style='background-color:transparent; width: 100%; text-align: center;'><center> <iframe scrolling="no" frameborder="0" allowtransparency="true" height="250" width="300" style="border:0;" src="hXXp://d.delivery49.com/widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd"></iframe></center><script type="text/javascript">new Image().src = "hXXp://n20.adshostnet.com" "/im" "pressi" "on.gif?b=16" "&p=11&ch=&ap=&cps=&c" "=16&l=UA" "&h=601aaa7c277e8dfa44e431f41e9b18d8&t=" new Date().getTime() "&s=d733401daca461ac9ff420e846d915ba";</script></body></html>....

GET /impression.gif?b=16&p=11&ch=&ap=&cps=&c=16&l=UA&h=601aaa7c277e8dfa44e431f41e9b18d8&t=1417050833066&s=d733401daca461ac9ff420e846d915ba HTTP/1.1

Accept: */*

Referer: hXXp://n20.adshostnet.com/ads?v=1&key=6c2c19aff050b202bf7c7970cb59cde3&ch=&click=&tz=2&t=1417050832847&scrWidth=1276&scrHeight=846

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n20.adshostnet.com

Connection: Keep-Alive

Cookie: epomUUID=650e85b0-75d2-11e4-b202-002590aa01de

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: no-cache

Pragma: no-cache

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP="CAO PSA OUR"

Set-Cookie: ucv=16-UA-1417137122923--; Domain=.adshostnet.com; Expires=Fri, 27-Nov-2015 01:12:02 GMT; Path=/

Accept-Ranges: bytes

ETag: W/"49-1395933738000"

Last-Modified: Thu, 27 Mar 2014 15:22:18 GMT

Content-Type: image/gif

Content-Length: 49

Date: Thu, 27 Nov 2014 01:12:02 GMT

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Server: Apache-Coyote/1.1..Cache-Control: no-cache..Pragma: no-cache..Expires: Thu, 01 Jan 1970 00:00:00 GMT..P3P: CP="CAO PSA OUR"..Set-Cookie: ucv=16-UA-1417137122923--; Domain=.adshostnet.com; Expires=Fri, 27-Nov-2015 01:12:02 GMT; Path=/..Accept-Ranges: bytes..ETag: W/"49-1395933738000"..Last-Modified: Thu, 27 Mar 2014 15:22:18 GMT..Content-Type: image/gif..Content-Length: 49..Date: Thu, 27 Nov 2014 01:12:02 GMT..GIF89a...................!.......,...........T..;..

GET /ajax/libs/jquery/1.7.1/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery49.com/widget/render/hash/68a1a1d0f6fba9cabe1c0ab89eeadccd

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT

Date: Wed, 26 Nov 2014 16:59:56 GMT

Expires: Thu, 26 Nov 2015 16:59:56 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33186

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 29527

Alternate-Protocol: 80:quic,p=0.02

.............~.F....?......!J......7.......Y...h....w.T*.".Y.Y...|.D.. (g..;.....b=q.8......?.....w.....>.......g{s.....2...........e. WK?VI.h....~.<n...fy6.....e.z...8.{.U......(.. .e.8....V...}.[..|../.......j-.~'...Q.....%Q.KV...Ec....q.{...x........*..^...^Vn........&_...~.....o.Z..~..^....{?.S..&.w.W.|A...r......t.../V.,.Dt.Pf...&yYLv.U......r.Q}.^']...*W.:H.........~_=.r..s.^..T..=l.]..)Vj.......^.ys...x...C_.h..&............`.^b<.^:_m1'Y....c.....e..1Oo....q...q.x......o...........?..q:..;.>.whu.....=.... . P..i...I..E.!..f.&v(.......m...r...w~.SW.......6p>...........,.........Lsj...L7..j.......y..'.F..h44..SY.V.......i.mw...4Yi.H{'.._..].9?...}..Jn................5Q%m.y.,v.5U.(.^..\-.R...?^m."...7e..vy...b...L..%....]..f...l5>...nw.rYx..|8..V.......0F..|4....<.q....d.(~...h....p.......q1.......y..ZF.p1..;.^..W.Y...(.....<x.F...iI.t..n..p.-......w.p:..I.\.:x\...H..T.j...../i..h....3....Y..w.......5...:..n.....U...]B..`.ZQ..nE}.....L..`..A..W....C.\'......e^./.j\[...6.v."..u...-..K.3Tb....24>,..hD.R..<.F..q5C..vR.iO)Z.(..&T..v.Z#.. .._ts..1.H..=....H1...6..@....9..v...=Q...RZ ..SIt.}.....J.me.....Yq`..5......5.....28L..~.-L.=...b)M'..Gd.....1..,.:H...f.....h..T. Q...~.|%#%....y....7....L......"QU.y0H...<.s....n....I'Z............A........K...k..2...P._..1Z...B..4~.&..h.o{.y..q.......Z..R...l......&.....>....P.......&.;W.3...L......@$...,....Q..U1..hC1.$ .;ByWj.M..... B=1....s_....:HP...&.7.&..>7.(=.....P.b8...Q..Nw,...E........t;.4..`..._ F.P.......t....hm..w...Q....

<<< skipped >>>

GET /offers/ui/css/start/jquery-ui-1.8.19.custom.css HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 27 Nov 2014 01:11:46 GMT

Content-Type: text/css

Content-Length: 20706

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Thu, 26 Apr 2012 17:23:56 GMT

ETag: "ca38195cd123cd1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 04 Dec 2014 01:11:46 GMT

X-Cache: HIT

Accept-Ranges: bytes

/*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/UI/Theming/API. */../* Layout helpers.----------------------------------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-accessible { position: absolute !important; clip: rect(1px 1px 1px 1px); clip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helper-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; position: absolute; opacity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.----------------------------------*/..ui-state-disabled { cursor: default !important; }.../* Icons.----------------------------------*/../* states and images */..ui-icon { display: block; text-indent: -99999px; overflow: hidden; background-repeat: no-repeat; }.../* Misc visuals.----------------------------------*/../* Overlays */..ui-widget-overlay { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }.../*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/

<<< skipped >>>

GET /offers/images/Theme8/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 27 Nov 2014 01:12:00 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<<< skipped >>>

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 27 Nov 2014 01:12:00 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<<< skipped >>>

GET /offers/images/Theme8/nextCase.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 27 Nov 2014 01:12:01 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<<< skipped >>>

GET /offers/images/Theme8/button.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 27 Nov 2014 01:12:02 GMT

Content-Type: image/png

Content-Length: 458

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT

ETag: "1b5642f092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 04 Dec 2014 01:12:02 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi........../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f...p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C.......$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`...

GET /Files//Setup_product_6416.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dl.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 27 Nov 2014 01:11:40 GMT

Content-Type: application/octet-stream

Content-Length: 287592

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Wed, 12 Feb 2014 12:24:01 GMT

ETag: "e895af4fed27cf1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 04 Dec 2014 01:11:40 GMT

X-Cache: MISS

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......->..i_..i_..i_...|..d_..i_..._...|..h_...|..q_...|..h_..Richi_..........PE..L...!.};............................^Z.......................................p.......p...............................................................>..h%...........................................................................................text............................... ..`.data...............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................L...V...r...~.......................................@...............^.......................................*...6...F...T...j...v...........................................:...L...`...|.......p...................................,...8...D...V...d...~...................................&...>...N...d...z...........................................,...>.......................b.......................................,...>...R...n...~...........................................6...D...T...........x....

<<< skipped >>>

GET /Installer/Flow?pubid=1184&distid=7623&productid=6416&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:3F:C9:30&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 27 Nov 2014 01:11:30 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 14953

Connection: keep-alive

..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"8 $.Fmkcsez_oajgRvjdo"8.)0.*.LdcKct.5.FH?X[LM>9GXK>=GENC.KJ?RT;QA\Zqa(ogbqRkfrrYm^ZYph)vg`ociz.v.DKCTWGHA>F^IAACAI>.PIEPW?M=WUkvms]rrn]\kaeMnbtu\j`UZjsrpapok`Zp`bgl|.w..AIBS^HOA<DZF?@BHJE.NGAMU>LDX\gnl\krpoqbSmalrZpbV[esr\jolso`gl|.w.CDCVYKKC?GWH:AECMA QJ>OP?O?[XiqoYmm//-RkfrrYm^ZYcrpapo)-,fmv.x .CC@R]IIB=L]H9>AGK?.OODOO<KCYV`]rr`edlQl`ssap`TWZ_ondiiqchw.z.BJAY]GG>:J\G@?HGI=.LMCNV=RCWT\pcpilahnNgamu^ldX\_r]nhkbbodpz.t..FH?X[LM>9GXK>=GENC.KJ?RT;QA\Zno`^r*j`ceQj^op_o_[Xsu`]o&n^addpz.t.AIBS^HOA<DZF?@BHJE.NGAMU>LDX\ojf`1Ql`ssap`TWjmk_7dpz.t..FH?X[LM>9GXK>=GENC.KJ?RT;QA\Zr]]lqb[q_hcnKj_rt[qa\Zr]]lqb[q_hcn`ku.y.GGEWZDJ<?IYL=CFDF@.QL@SSAP@TWhkfa`)pjpkNhdqq`neZWghbe^'ohuqchw.z..GGEWZDJ<?IYL=CFDF@.QL@SSAP@TWhkfa`)pjpkNhdqq`neZWghbe^'ohuqch.% O_fGew1,.3 EEDU_JJ;<E]J;BDIL@.NHDQQ@NEZWnd&tf_vOodoo\kcYVue-td]rany.{.HI@QZEM@;K[M?>@DGC.MNBTU<J@UZjsrpapok`Zp`bRkfrrYm^ZYgxot_mln^_o]gdpz.t..FH?X[LM>9GXK>=GENC.KJ?RT;QA\ZdkoZpqmtnfQj^op_o_[XiqoYmmqrledpz.t.AIBS^HOA<DZF?@BHJE.NGAMU>LDX\gnl\kr.,2Oodoo\kcYVhot_ml, 1ej{.|..@F>W\FN?AJZE<<FFHD.SMALR:PBV[]apo]hbqPiepw_m]WU_^lsamgn`ku.y.GGEWZDJ<?IYL=CFDF@.QL@SSAP@TWZubmniefkKj_rt[qa\Z\o`lmj_glhnw.w..EEDU_JJ;<E]J;BDIL@.NHDQQ@NEZWkr^cq'o]gcNgamu^ldX\qr]`m m[fahnw.w.FH?X[LM>9GXK>=GENC.KJ?RT;QA\Zlgi^6Piepw_m]WUolhd4hnw.w..EEDU_JJ;<E]J;BDIL@.NHDQQ@NEZWo`[qp_`ncf`kNhdqq`neZWo`[qp_`ncf`kciz.v.DKCTWGHA>F^IAACAI>.PIEPW?M=W

<<< skipped >>>

GET /Installer/Track?pubid=1184&distid=7623&productid=6416&subpubid=0&campaignid=0&networkid=1&reqid=167417161&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:3F:C9:30&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=6416&offerscreenid=&offerorder=7&downloadduration=8063&installduration=359 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 27 Nov 2014 01:11:39 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive

..OK..HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html; charset=utf-8..Date: Thu, 27 Nov 2014 01:11:39 GMT..Server: Microsoft-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Powered-By: ASP.NET..Content-Length: 8..Connection: keep-alive....OK......

GET /Installer/TrackFinish?reqid=167417161&x=y&clickid=8ce9fa275528afc182baf4b835fa668e HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 27 Nov 2014 01:11:41 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive

..OK..HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html; charset=utf-8..Date: Thu, 27 Nov 2014 01:11:41 GMT..Server: Microsoft-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Powered-By: ASP.NET..Content-Length: 8..Connection: keep-alive....OK....

GET /ajax/libs/jquery/1.5/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT

Date: Thu, 27 Nov 2014 01:00:18 GMT

Expires: Thu, 27 Nov 2014 02:00:18 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 29947

X-XSS-Protection: 1; mode=block

Age: 688

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Alternate-Protocol: 80:quic,p=0.02

...............F....>..R..1.d...j0!^Y....l..jW....@..w.Le.I............@0.....$..}9[.......O....f.O.......6......6...W.?..!.t............C...r....'.}.Y..J5.....?g.|...n.Ec...j.....Q.m..Y..w...m..?}...l.....3.o.>mp..t.g..w.tq;.v...o.-..l...q.lg:z..w..W....zM.....d.9[d.IOU....T#^....;..1..,..o.o.m.......g...}.m5.._u........*ES~.....5.....m......v..%_..w......Z..w.6Y.E.....l......gw.C....l...a..X.:F...o&...a...z.D#...Zq.{...x..V.wk.K..O^..(i.......f.SR/io...c..=.,.^x..*...~..4...:.{=n(J.z(..t(.q..i.p...Y.N.tD..J.=........vXn.K..e.-xH..i..F.1..f.....e.o?..\ew....>~...c2........z..............Gj.zB.;:....2..M.sF.s../..*8..o....x.;....>& n.... .....y......4Ui.@......b.m/.h...?U.....=T.EE.N.i..DMU.e.E....j..Q6...B-.J....>M....:.MZ-.4.Z..._..i.%..m..]..........o.........~.......3...HN..t.................E/[....-..vq..y....-....j......0.xO..U4W..&Jx.ktt.<..u.6oNK..x..h....p.Oh.......P...6...R.C..\.n..m..?..W....6..G.....hn..h.o......!.ep6...T..N..$.......5.)P...3.V......_.O...5..gl.5........c......6.m...^..b...c.y.r..$.....L..p...o.................(,uB..T.2_28....d..us.f1.L..=..&..bV..m<..=........3D..\.Y..r3....A_.Y.G.%.....7|.$t.Z.k..C..\.8?.h...q....naF.i-.......B..`6t.._..h12n....v..".pq..C.h.......x...N.L...p..............f`E@.ha.....m..zj.] h........v..(i....|mv....7.......t......j..j...c.K2...;.4.$;Ve...-o4.~.;..h.M...(*N....m0T.G]5.......K`#.&..Z.V...3......m2.Z.hJ;..F...`Q.QM.?.,..E........@......=.b.........._.Fi.h6........l....2.}$...>.=.N.M)....$eP..]..p%M....|.e......&jJ...x.u...:..

<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/css; charset=UTF-8

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Thu, 27 Nov 2014 00:47:58 GMT

Expires: Thu, 27 Nov 2014 01:47:58 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 6091

X-XSS-Protection: 1; mode=block

Age: 1428

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Alternate-Protocol: 80:quic,p=0.02

...........=k.....3...E...yl.=.=.....7@..6..~...e.#K.$.#A..=.!%J|iz...;@Z.:...y..}..........X.H~{G...O~......-.M^M....@o..c.....Og.s............!/.Ms.\\...'t.&qy..........hN.,fE..r*.V.f..O.>.."...G._.... s.WO8f....v...dJ>O...H ..o..>..! v.o~y...gg.....#.D.,?BwgQ...&.,B.h.%. .'.d.1...R...&.M...1..l.3.?.u..t.B.u...F....e....&q..7.bq.bv| ........... V..z;.j.A_.kr.I.J...e.z..A.yV0........0..5i.C.%,. .L..iY4Q.}...t......y..U.q.h.f..-K.....3.6...H..Y..|..u.....\d[T.........>......|...Y...T.*...<..X..F.S.:.4..G.<.r`k.&?........0.p.w gEcN..=.'8a...E......~...$OXJOy.s)...ud..\tQ.Z$$;..|.}g@G..m^...S2.gn.h......;V.yy.!...{4..U%D>x....{...2.SV....!Y<....3..e...cMTb.5.,f...r..$Or..%X...78.I.>..Y.99@.........U......4....5.......2.......UY.<.W EY.h.<.U.l2c.....V.J..T.^...owo.....(...|...Sh..~x..l..ovyY.7...M... ..v2.%.j....Np1_....4...M...9.~.,y.V..b.-...i.&i.q...W7......*1.QP.k:C..^.k6..T.\.u,..LW.(S<)5.............X...ZW...#.UC*.:nT;.....\<._.. J.YK.:9.H}3....U.B..$..W..f$l]^m....@..c..........0.h...l.q.,(."......l.%........:.A..y.'n.. ..j:.q2.]r..M...j.JSQ....i.8...J...".iZ.V.....5..'S:.*..C..V.Y.!S.k*.:FT.tv...1.P.A.e..r.h......-..uGZ6.(.....l..!5....z....2M!.?.G.........'....U>..-aH/ .E.D.T{J..C!...tK.!.a.v..~......$....5 ..xj.u...P...x.@ F{..S..R.O.<d#.E%PS.//......5fV.4...1..S.......mw..#..o Q. .....p_yI..ox.....UM.uP....b.v0GE.....A....X.!pX4.......Y-o..f9.....L.p$.........;..P...Q.b........mZe..$s..].8..t...M...o......X...S".>..1A*.....2h......D.j8Y..wL..^.| ....1...`C

<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=2&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0& HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: direct.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 27 Nov 2014 01:11:43 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8301

Connection: keep-alive

.<html>. <head>. . <style type="text/css">. .ui-progressbar-value { background-image: url(images/pbar-ani.gif); }. </style>. . <link type="text/css" href="hXXp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css" rel="stylesheet" />. <link href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css" rel="stylesheet" type="text/css" />. <script type="text/javascript" src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js"></script>. <script type="text/javascript" src="hXXp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js"></script>.. <title>2 - NonProduct (DirectX)</title><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]);.. _gaq.push(['_trackPageview']);.. (function() {.. var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.. ga.src = ('https:' == document.location.protocol ? 'hXXps://' : 'hXXp://') 'stats.g.doubleclick.net/dc.js';.. var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga

<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0& HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: direct.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 27 Nov 2014 01:11:53 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 7014

Connection: keep-alive

<html>. <head>. <title>4 - NonProduct (DirectX)</title><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]);.. _gaq.push(['_trackPageview']);.. (function() {.. var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.. ga.src = ('https:' == document.location.protocol ? 'hXXps://' : 'hXXp://') 'stats.g.doubleclick.net/dc.js';.. var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.. })();</script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px;} .divLeadpName { border-bottom-style:groove;border-bottom-width: thin; padding-left:61px; padding-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; width: 100%; background-color: #fff; ba} #divTop {display: none} #divMiddle {background-color: #efecec; height: 100%;} #middle {background-color: #fff;} .divOnNext { position:absolute; width:89p

<<< skipped >>>

GET /dc.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=7623&leadp=6416&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stats.g.doubleclick.net

Connection: Keep-Alive

Cookie: id=c21c6444d00007f||t=1360768149|et=730|cs=002213fd480b36e81315d0d96e

HTTP/1.1 200 OK

Date: Wed, 26 Nov 2014 23:17:36 GMT

Expires: Thu, 27 Nov 2014 01:17:36 GMT

Last-Modified: Thu, 13 Nov 2014 21:10:00 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15853

Cache-Control: public, max-age=7200

Age: 6864

Alternate-Protocol: 80:quic,p=0.02

X-Google-Cookies-Blocked: id=

...........={_.:...)....'.$..&.......-..Ms..e9..'...B.g.3#..........3z?F........z....n.h..@&b.....v.W.A"...<8H.^.....A*......3....~..X?8....<..t..)d.......Hf.Q...._. .,`.....a....>...?...v.Aq.G.........p.........a$y&.....sX7p........ ..M.d..l.K.....t...8..i6....C..XO.....@....!.....RG.l .}....b$c..B|8..C}!.8..=.e.K....{..K.9..a..nx......%..;..F...J...v..n!.L.....g.C@...~..|...=....q.9n_...P.....Tw.o...........k.....^:.....O!..b......=...B..,..j8......k.b./.Y..JE...({k.........(.L..@. ...b;...s.f...k../--..\..A.M..he.q..u.u.$..<.....$......eBf....,...r{.[.....h....Tup..$?F?2.... .qk...x..;.......}.Y.[)jL.........}.4.'..Z_...bms.._..I4.r=...f....U}...|......].FG..\.[9...hp......"..L..J...a..l.=.C..c.............i..2&.......{....T*w..%#ey....A..`.T..Q.w.....f2...,....J...y.qqA.........BTo....5.W..9]...]b$K%Z.V..b..x1t....]..&.P.Qo.A?..W.R..l.........'".. ..D. ..EA.......$US.t...w?.u*rn.:......?...a,.(..0....`.GL....Z...j[8.[.2k8N...4(.x..4j&..V..p.N)0.;k.......C..= .].;M.|..&..;........M'....Vy.6*..[J.7`n*...Q..O.%4T ...;.....'J.........xKK.&..^A...;...........a<.783[X......p...c...3j$.....Z....c.D.....BW................*.1]KQ].zb.... .?~....V>&."..Q$.....&.sS..Kq........).....{y.V....T...L.09.-.KK:..yH.....4./..Ni.oaM..X..X.R...l...[...n2.....6.v.Q.......v.C.0........55..z]__.a.j...fJh.....r.6a.6v3..!.}^0...,...I.w........i.......Q..q ..c;2.p2 .%..:0..14....z....b.*Z..*..>...v].....H...V...kVT.]....I ...._..}.f.....^U..a.V]..wd.N.....9....n1-0..`...B..Q.MB...7...%.!.L~.."H..xNV`?||.H.........

<<< skipped >>>

Map

The MemScan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_236:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|/":

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe /PID=1184 /SUBPID=0 /DISTID=7623 /NETWORKID=1 /CID=0 /PRODUCT_ID=6416 /SERVER_URL=hXXp://installer.apps-track.com /CLICKID=8ce9fa275528afc182baf4b835fa668e /D1=-1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=2

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp\Convert.dll

GetCPInfo

GetProcessHeap

Convert.dll

> >$>(>,>

2 2$2(2,2

1,2024282

? ?$?(?0?4?@?`?

operator

GetProcessWindowStation

portuguese-brazilian

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

9#gyI%S

.MGV1'

zDs.DhLA

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsMad.dat

instructionsMad.dat

INSTRU~1.DAT

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp

c:\%original file name%.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp

hXXp://installer.apps-track.com

/PID=1184 /SUBPID=0 /DISTID=7623 /NETWORKID=1 /CID=0 /PRODUCT_ID=6416 /SERVER_URL=hXXp://installer.apps-track.com /CLICKID=8ce9fa275528afc182baf4b835fa668e /D1=-1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=2

Nullsoft Install System v2.46

1.0.0.1

convert.dll

1.0.0.2

WUSER32.DLL

- floating point support not loaded

f.exe_1580:

.text

`.rdata

@.data

.rsrc

@.reloc

spKey

szKey

keyCur

hKey

cSubKeys

cmdline

urlStr

wurl

bstrLicKey

cchLicKey

nMsg

vurl

bstrURLOut

rtExecmd

rtExeurl

reportURL

zErrMsg

compiledSql

sqliteCookieFiles

htmlDecodedUrlValue

endParamKeys

dynamicProductKeys

wUrlQS

wUrl

sqliteHistoryFiles

readDownloadUrl

searchUrl

finishUrlForOuterInstaller

reportUrl

httpResponse

fullCmd

subkey

hostBrwCmd

tyUrl

baseKeys

cmdLineW

cmdW

exeUrlW

urlW

cmdLine

exeUrl

cbMaxSubKey

achKey

offersMainUrl

antivirusesRegKeys64Arr

antivirusesRegKeys32Arr

reg64Key

postExe

preExe

regKey

offerUrl

regKey64

cbSubKeys

zMsg

nCellKey

nMaxKey

nMinKey

nKey

zErrmsg

keyInfo

errMsg

t.hx3S

osCmd

finalExePath

urlComp

szURLPath

xSSSh

FTPjKS

FtPj;S

C.PjRV

RegDeleteKeyExW

RegDeleteKeyTransactedW

RegCreateKeyTransactedW

RegOpenKeyTransactedW

.vector too long

X:X:X:X:X:X

\Google\Chrome\Application\chrome.exe

%d/%d/%d %d:%d:%d

3.7.16.2

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

\obhhelper.txt

Error %u in WinHttpQueryDataAvailable.

Error %u in WinHttpReadData.

Error %d has occurred.

F%D,3

Run-Time Check Failure #%d - %s

%s%s%s%s

%s%s%p%s%ld%s%d%s

Visual C CRT: Not enough memory to complete call to strerror.

RegCloseKey

RegOpenKeyExW

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

operator

GetProcessWindowStation

WinHttpCloseHandle

WinHttpReadData

WinHttpQueryDataAvailable

WinHttpReceiveResponse

WinHttpSendRequest

WinHttpOpenRequest

WinHttpConnect

WinHttpCrackUrl

WinHttpSetTimeouts

WinHttpOpen

WinHttpQueryHeaders

WINHTTP.dll

PSAPI.DLL

GetProcessHeap

KERNEL32.dll

EnumChildWindows

CreateDialogIndirectParamW

USER32.dll

GDI32.dll

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegQueryInfoKeyW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

OLEAUT32.dll

URLDownloadToFileW

urlmon.dll

IPHLPAPI.DLL

GetCPInfo

.?AV?$CAtlExeModuleT@VCSmartInstallerModule@@@ATL@@

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

RowKey

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s-shm

%s\etilqs_

%s\%s

Recovered %d frames from WAL file %s

cannot limit WAL size: %s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

keyinfo(%d

%s(%d)

%s-mjXXXXXX9XXz

MJ delete: %s

MJ collide: %s

-mjX9X

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_parent

%s OR name=%Q

type='trigger' AND (%s)

sqlite_

table %s may not be altered

there is already another table or index with this name: %s

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_stat1

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

sqlite_detach

sqlite_attach

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

unable to identify the object to be reindexed

no such collation sequence: %s

table %s may not be modified

cannot modify %s because it is a view

sqlite_version

sqlite_source_id

sqlite_log

sqlite_compileoption_used

sqlite_compileoption_get

foreign key mismatch - "%w" referencing "%w"

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

constraint %s failed

PRIMARY KEY must be unique

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_keys

foreign_key_list

foreign_key_check

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s.%s

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

too many references to "%s": max 65535

%s.%s.%s

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s TABLE %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid>? AND rowid)

%s (rowid>?)

%s (rowid)

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

SQL logic error or missing database

unknown operation

large file support is disabled

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

.?AVCWebPage@@

zcÃ

{A0386B19-B7E7-4BE7-B567-ABF77CBB6E60} = s `ATLExeServer'

`ATLExeServer.EXE'

val AppID = s {A0386B19-B7E7-4BE7-B567-ABF77CBB6E60}

ForceRemove {FA20B59B-21AA-44FC-8A68-450979B7CC90} = s 'CBrowserExternals Class'

val ServerExecutable = s '%MODULE_RAW%'

TypeLib = s '{03771AEF-400D-4A13-B712-25878EC4A3F5}'

ForceRemove {622D38AD-B4A9-4170-8192-5B865C6A5DCE} = s 'CBrowserExternalImp Class'

ForceRemove {6D4506CE-F855-4657-AA38-DB6B1F733982} = s 'CBrowserExternal Class'

stdole2.tlbWWW

~cmdWd

OpenUrlW

urlWd

method OpenUrl

Created by MIDL version 7.00.0555 at Thu Mar 13 16:11:05 2014

Red

Green

Blue

3%3u3

=0>4>8>

9%9 9;9]9

6i6C6t9

7$8(8,808

5$8(8,80848

4"4&4*4.42464:4

5 5

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

WAdvapi32.dll

SERVER_URL

EXE_URL

EXE_CMDLINE

THANKYOU_URL

exeurl

execmdline

Exception opening/reading chrome cookies

Exception opening/reading opera cookies

a\Microsoft\Windows\Cookies

a\Mozilla\Firefox\Profiles

\Mozilla\Firefox\Profiles

sqlite

cookies.sqlite

Chrome_WidgetWin_1

a\Opera\Opera\

\..\Local\Google\Chrome\User Data\Default\

\..\Local Settings\Application Data\Google\Chrome\User Data\Default\

cookies4.dat

SELECT value,last_access_utc FROM cookies WHERE host_key LIKE '%

Found cookie in Chrome!

\..\..\Local Settings\Application Data\Opera\Opera\

Found cookie in Opera!

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

OLEACC.DLL

places.sqlite

SELECT url FROM moz_places WHERE url LIKE '%

Found history in Chrome!

SELECT urls.url FROM urls WHERE urls.url LIKE '%

\PreExe_ID_

\default.html

CHROMEVERSION

&chromev=

SOFTWARE\Microsoft\.NETFramework\policy

firefox

chrome

opera

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice

ChromeHTML

FirefoxHTML

IE.AssocFile.HTM

Opera.HTML

http\shell\open\command

Opera.exe

Safari.exe

\PostCheck.exe

SOFTWARE\Mozilla\Mozilla FireFox

Software\Mozilla\Mozilla FireFox

SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}

aSoftware\Mozilla\Mozilla Firefox

*.txt

@@exeurl

OfferURL

ExeURL

RegKey

ReportName

PreExe

PostExe

RegKey64

AntivirusesRegKeys

RegKey32

Mscoree.dll

OLEAUT32.DLL

{A33DE4AA-9646-4E33-9E44-E472C6312E2F}

888816666554443

6666554443

!6666554443

VirtualOfferCmd:

VirtualOfferCmd

/REPORTURL=

\obhhelper.txt

NMozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

user32.dll

mscoree.dll

SKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

MSPDB100.DLL

ADVAPI32.DLL

WUSER32.DLL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

4.0.0.3

setup.exe

4.0.0.1

6_Offer_7.exe_456:

.text

`.data

.rsrc

advapi32.dll

advpack.dll

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

setupapi.dll

setupx.dll

IXPd.TMP

TMP4351$.TMP

FINISHMSG

USRQCMD

ADMQCMD

msdownld.tmp

wextract.pdb

PSSSSSSh

t8SShs7

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

RegQueryInfoKeyA

ADVAPI32.dll

GetWindowsDirectoryA

KERNEL32.dll

GDI32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

COMCTL32.dll

VERSION.dll

rundll32.exe %s,InstallHinfSection %s 128 %s

SHELL32.DLL

Software\Microsoft\Windows\CurrentVersion\RunOnce

PendingFileRenameOperations

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

%s /D:%s

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

Command.com /c %s

DirectX 9.0 Web setup

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

33333330

3333333

33333333

PA"dxwsetup.exe" /windowsupdate

dsetup.dll

dsetup32.dll

dxwsetup.exe

dxwsetup.cif

dxwsetup.inf

.qF'I

w5U.zz

y\2(u%C

hÃšF4-

WV.Dmz

)s%S[

O]%D^

r=.bb

t.CTKV

.lDz{

Q:.eHno

ub.AZ

Q%%F|

8A.}%D

.sEn?

%ul'^

j.Ypf

'%xmD

KV.JR

"dxwsetup.exe"

P"dxwsetup.exe" /windowsupdate

Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.

CFailed to get disk space information from: %s.

System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?

8Unable to retrieve operating system version information.!Memory allocation request failed.

Filetable full.ÃŠn not change to destination folder.

Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.

(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.

Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install

Could not create folder '%s'

To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.

Error retrieving Windows folder

$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .

System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.

/C: -- Override Install Command defined by author.

eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?

Could not find the file: %s.

:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.

4.09.00.0904

DXWebSetup

dxwebsetup.exe

Microsoft(R) DirectX for Windows(R)

dxwsetup.exe_860:

.text

`.data

.rsrc

%s %s: %s: (null)

%s %s: %s: %s

%s%s%s

DirectX.log

DXSETUP_DPF(): GetWindowsDirectory() failed.

DXError.log

%s(): %s

DXSError(): FormatMessage() failed, error = %d.

(0x%x)

%s(): %s failed.

%s(): %s failed, error = %d.

%s(): %s failed, error = 0x%x.

module: %s(%s), file: %s, line: %d, function: %s

[%s %s]

Unable to load %s.

e:\dxsdk\wggt_aug07\private\multimedia\directx\setup\dsetup\inc\dsinline.h

Module: %s, Function: %s

advpack.dll

GetFileVersionInfoBlock(): %s does not have version information.

GetFileVersionInfoBlock(): Unable to get FileVersionInfoSize, file: %s, reason: %d.

ntdll.dll

e:\dxsdk\wggt_aug07\private\multimedia\directx\setup\dxwsetup\dxwsetup.cpp

DSetupCallback(): Phase = %d, Steps = %d

Unable to remove %s.

Unable to create path string, %s%s.

Unable to create path string, %s\*.*.

Unable to remove: %s which is locked, reason = %d.

DeleteFile("%s") return 0, reason = %d.

Unable to create path string, %s\%s.

e:\dxsdk\wggt_aug07\private\multimedia\directx\setup\dxwsetup\inline.h

RegOpenKeyEx()

Software\Microsoft\Windows\CurrentVersion\RunOnce

rundll32.exe %s\advpack.dll,DelNodeRunDLL32 "%s\"

GetFileAttributes() returned -1, reason = %d.

kernel32.dll

e:\dxsdk\wggt_aug07\private\multimedia\directx\setup\dxwsetup\dxwsetup.h

IsIA64(): Windows 2000 or Windows 9x

CDSetup(): try to load dsetup.dll from current dir.

\DirectX\WebSetup

\dsetup.dll

\ntkrnlpa.exe

This platform is not supported.

Unable to create path string, %s\dxupdate.cab.

DXRemoveFile() failed. Unable to remove dxupdate.cab. (Not fatal...)

\dxupdate.cab

%s will be removed at reboot.

Version in CIF: %d.%d.%d.%d

Install Section: [%s]

%s_%s

\system32\drivers\gm.dls

GetWindowsDirectory()

DXVersion: %d.d.d.d

dxwsetup.cif

SetBaseUrl()

hXXp://download.microsoft.com/download/8/0/D/80D7E79D-C0E4-415A-BCCA-E229EAFE2679

IsSupportedPlatform

end of DirectX WindowsUpdate

end of DirectX WindowsUpdate, need to reboot

CreatePropertySheet() returns %d.

dxwsetup.inf

comctl32.dll version: %d.d.d.d

\comctl32.dll

/windowsupdate

OnEngineStatusChange(): EngineStatus = 0x%X, SubStatus = 0x%X

OnStartInstall(): DLSize = %d, InstallSize = %d

OnStartComponent(): ID = %s, DLSize = %d, InstallSize = %d, str = %s

OnComponentProgress(): Phase = %d, Progress = %d

OnStopComponent(): ID = %s, hr = 0x%X, Phase = %d, str = %s, status = 0x%X

OnStopInstall(): hr = 0x%X, str = %s, status = 0x%X

OnEngineProblem(): problem = 0x%X

PlugIn size: %d

e:\dxsdk\wggt_aug07\private\multimedia\directx\setup\dxwsetup\psheets.cpp

Setup Version: %d.d.d.d.d

DirectX Version: %d.d.d.d.d

dxupdate.dll

wintrust.dll

setupapi.dll

RemoveDXUpdateCab(): %s is removed.

e:\dxsdk\wggt_aug07\private\multimedia\directx\setup\dxwsetup\dxupdate.cpp

Unable to remove %s, need to remove this file.

dxupdate.cab

%s is not trusted due to certificate problem. Please check valid certificate is installed and Cryptographic Services are enabled.

%s is not trusted. The file may be damaged. Please check valid certificate is installed and Cryptographic Services are enabled.

%s is not trusted. The file is not signed properly.

DXCheckTrust(): %s is trusted.

Unable to find dxupdate.dll.

GetCDXUpdate(): Loading %s in %s.

Unable to iterate through %s. The file may be damaged.

GetCDXUpdate(): Extracting %s from %s.

hXXp://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C

e:\dxsdk\wggt_aug07\private\multimedia\directx\setup\dxwsetup\utils.cpp

Currently %s is newer than the one being installed

Target file: '%s'

Target file is Version %d.%d.%d.%d

Source file is Version %d.%d.%d.%d

Unable to get Version on source file %s

Unable to get Version on target file %s

\user.exe

RegCloseKey()

StringToVersionInfo() failed, version = %s.

GetDXVersion(): This may be a older DirectX which does not have the directx key in the registry.

Unable to create path string, %s\directx.log.

\directx.log

SPFILENOTIFY_DELETEERROR: Unable to delete %s.

Deleted file %s.

Deleted file %s with DELAY_UNTIL_REBOOT.

SPFILENOTIFY_COPYERROR: Unable to copy %s.

Installed file %s

Unable to open %s.

Extracted file %s from cab

SPFILENOTIFY_FILEEXTRACTED: error = %d

Unable to proceed %s:[%s]. The file may be damaged.

Unable to copy %s to %s.

[Strings.eng]

Use string section : [Strings.%s]

[Strings.%s]

mscoree.dll

- CRT not initialized

Please contact the application's support team for more information.

GetProcessWindowStation

user32.dll

dxwsetup.pdb

SShp!

SSh %

SShH'

SShl-

P@SShk

9X(t&SShp

u.Sj0ha

SShL;

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

GetWindowsDirectoryA

KERNEL32.dll

GDI32.dll

USER32.dll

COMCTL32.dll

SHFileOperationA

SHELL32.dll

VERSION.dll

ole32.dll

GetProcessHeap

GetCPInfo

%WinDir%\DirectX.log

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\dxwsetup.exe

k2v_.mX0q[,hT9

|/oZ/nY-kV.mX0q[/oZ0r\2u_2v_5}e6

)`N*dQ,gS/nY/nY/oZ/oZ/nY0q[-jV-kV.mXO

?3&YH0q[0q[0q[/nY/nY.mX.mX.mX-jV-jV-kV-kV*dQI

s3xa.mX*cP)`N&YH$UE"O@

H:!N?#RB%VF&ZI(^L*dQ-jV.mX2u_7

l2v_.mX*dQ']K$UE!N?

i4{c1t^.mX eR)aN']K%WF#SC!N?

H:"O@$UE&YH)`N eR.mX1t^3yb7

H:"O@%VF']K*dQ.mX1t^4|d8

E8!N?%WF*cP.mX3xa5}e9

o1t^.mX*dQ(^L%WF$UE#RB"PA#RB"PA#RB#RB#RB#RB%VF']K*dQ-kV1t^7

k3xa0q[/nY.mX-kV-kV-kV-kV-kV-kV-kV-kV-kV-kV-kV.mX.mX/oZ2u_6

version="1.0.0.0"

name="Microsoft.DirectX.WebSetup"

DirectX Web Setup

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

The DirectX setup wizard guides you through installation of DirectX Runtime Components. Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement. You must accept the agreement to continue the setup.

o dos componentes de tempo de execu

Sla uw werk op en sluit alle toepassingen voordat u doorgaat.

mto operacn

Instalace byla ukoncena.dInstalacn

.QInstalacn

fen Sie die Netzwerkverbindung.DDie Datei konnte nicht gedownloadet werden, da sie nicht g

Komponenten werden installiertSDirectX-Laufzeitkomponenten werden gedownloadet. Dies kann einige Minuten dauern...jVer

Do you want to continue?ZDirectX is not completely installed on your computer. Are you sure you want to quit setup?7This package is not supported on this Operating System.

Setup is canceled.RSetup could not download the file. Please retry later or check network connection.OSetup could not download the file since the file to be downloaded is not valid.

Installing ComponentsFDownloading DirectX Runtime Components. This may take a few minutes...jSearching for updated DirectX Runtime Components and updating as necessary. This may take a few minutes...

n?9Este paquete no es compatible con este sistema operativo.&Se cancel

n.vEl programa de instalaci

n de red.QEl programa de instalaci

n sea necesario. Esta operaci

e.xLe programme d'installation n'a pas pu t

seau.VLe programme d'installation n'a pas pu t

cution DirectX. Ceci peut prendre quelques minutes...nRecherche des pilotes DirectX modifi

Continuare?FInstallazione di DirectX non completata. Interrompere l'installazione?6Pacchetto non supportato nel sistema operativo in uso.

Installazione annullata.iImpossibile scaricare il file. Riprovare in un secondo momento oppure controllare la connessione di rete.GImpossibile scaricare il file poich

StatoPAttendere. Il programma di installazione sta completando le seguenti operazioni.

in corso il download dei componenti DirectX. L'operazione potrebbe richiedere alcuni minuti...

in corso la ricerca dei componenti di run-time di DirectX. Se necessario, i componenti verranno aggiornati. L'operazione potrebbe richiedere alcuni minuti...

Setup is geannuleerd.dSetup kan het bestand niet downloaden. Probeer het later opnieuw of controleer de netwerkverbinding.DSetup kan het bestand niet downloaden omdat het bestand ongeldig is.

DirectX Setup.Het runtime-onderdeel voor DirectX installeren

VoortgangRSetup is bezig met het voltooien van de volgende handelingen. Een ogenblik geduld.'Bezig met het downloaden van onderdelen(Bezig met het installeren van onderdelenWBezig met het downloaden van DirectX-runtimeonderdelen. Dit kan enkele minuten duren...qBezig met zoeken naar ge

Czy chcesz kontynuowac?pProgram DirectX nie zostal calkowicie zainstalowany na tym komputerze. Czy na pewno chcesz zakonczyc instalacje?;Ten pakiet nie jest obslugiwany w tym systemie operacyjnym.

zniej lub sprawdz polaczenie sieciowe.NInstalator nie moze pobrac pliku, poniewaz pobierany plik nie jest prawidlowy.

o do DirectXWEste programa instala os componentes de tempo de execu

completamente instalado neste computador. Tem certeza de que deseja sair da instala

suporte a este pacote neste Sistema Operacional.

o foi cancelada.mA instala

o de rede.QA instala

o do DirectX4Instalar componentes de tempo de execu

Instalando componentesqFazendo o download de componentes de tempo de execu

Procurando por componentes de tempo de execu

r operativsystemet.

ts.YDet gick inte att h

gra minuter...hS

%s ...

: %d.%d MB

: %d KB

: d:d:d

hXXp://VVV.microsoft.com/directx

hXXp://Microsoft.com/DirectX

hXXp://VVV.betaplace.com

hXXp://VVV.BetaPlace.com

Windows(R)!

%s...

: %d kB2Odhadovan

DirectX z webov

nky hXXp://VVV.microsoft.com/directx. Instalaci ukonc

te na webov

m serveru hXXp://Microsoft.com/DirectX. Aktualizovanou predprodejn

m serveru hXXp://VVV.betaplace.com.DInstalacn

DirectX: %s

stup k webov

mu serveru hXXp://VVV.BetaPlace.com, budete muset syst

m Windows(R) znovu nainstalovat.GChcete pokracovat v instalaci t

Downloaden von %s...

e: %d.%d MB

e: %d KB4Gesch

tzte verbleibende Downloadzeit: d:d:d

Das DirectX-Laufzeitpaket ist nicht mit der installierten Version von Internet Explorer kompatibel. Downloaden und installieren Sie das wiederverteilbare DirectX-Paket von hXXp://VVV.microsoft.com/directx. Klicken Sie auf OK, um den Vorgang zu beenden.

Diese Vorabversion von DirectX ist bereits abgelaufen. Besuchen Sie hXXp://Microsoft.com/DirectX, um die neueste ver

ffentlichte DirectX-Version zu downloaden, oder besuchen Sie hXXp://VVV.betaplace.com, um die aktuelle Vorabversion zu downloaden.&DirectX-Setup - VORABVERSIONWARNUNG!!!.Diese Vorabversion von DirectX L

UFT am %s AB!

ssen Windows(R) erneut installieren, wenn Sie

gen, und auf die Website hXXp://VVV.BetaPlace.com zugreifen, wenn die Kennung abl

Downloading %s ...

Download size: %d.%d MB

Download size: %d KB/Estimated downloading time left: d:d:d

This DirectX runtime package is not compatible with the version of Internet Explorer currently installed. Please download and install DirectX Redistributable package from hXXp://VVV.microsoft.com/directx. Press OK to exit.

This pre-release version of DirectX has already expired. Please goto hXXp://Microsoft.com/DirectX to get the latest released version DirectX., or to hXXp://VVV.betaplace.com to get an updated pre-release version.&DirectX setup - pre-release WARNING!!!2This pre-release version of DirectX EXPIRES on %s!

You will need to re-install Windows(R) if you do not have a valid DirectX BetaID and access to hXXp://VVV.BetaPlace.com website when it expires!XWould you like to continue with the installation of this pre-release version of DirectX?

Descargando %s ...

o de descarga: %d.%d MB

o de descarga: %d KB4Tiempo de descarga restante estimado: d:d:d

n de Internet Explorer instalada actualmente. Descargue e instale el paquete redistribuible de DirectX desde hXXp://VVV.microsoft.com/directx. Presione Aceptar para salir.

n preliminar ya ha caducado. Vaya a hXXp://Microsoft.com/DirectX para obtener la versi

s reciente disponible de DirectX o a hXXp://VVV.betaplace.com para obtener una versi

n preliminar de DirectX CADUCA el %s.

que volver a instalar Windows(R) si no tiene un Id. v

n beta de DirectX y accede al sitio web hXXp://VVV.BetaPlace.com cuando el Id. haya caducadoJ

chargement de %s en cours...#Taille de t

: %d.%d Mo Taille de t

: %d Ko7Temps restant estim

chargez et installez le package DirectX redistribuable depuis le site hXXp://VVV.microsoft.com/directx. Appuyez sur OK pour quitter.

. Visitez le site hXXp://Microsoft.com/DirectX (site en anglais) pour obtenir la derni

e de DirectX, ou le site hXXp://VVV.betaplace.com (site en anglais) pour obtenir une version pr

jour.JAvertissement - Programme d'installation de DirectX version pr

commerciale de DirectX expirera le %s.

installer Windows(R) si vous ne disposez pas d'un identificateur valide de B

hXXp://VVV.BetaPlace.com [site en anglais] lorsque l'identificateur expirera.RVoulez-vous poursuivre l'installation de cette version pr

Download di %s in corso...

Dimensione download: %d.%d MB

Dimensione download: %d KB2Tempo restante di download stimato: d.d.d

compatibile con la versione di Internet Explorer attualmente installata. Scaricare e installare il pacchetto DirectX Redistributable da hXXp://VVV.microsoft.com/directx (informazioni in lingua inglese). Premere OK per uscire.

scaduta. Visitare il sito Web hXXp://Microsoft.com/DirectX per ottenere l'ultima versione completa di DirectX o la pagina hXXp://VVV.betaplace.com per ottenere una versione preliminare aggiornata.6Installazione di DirectX - Avviso versione preliminare3Questa versione preliminare di DirectX SCADE il %s.

necessario reinstallare Windows(R) se alla scadenza non si dispone di un BetaID valido per DirectX e di accesso al sito Web hXXp://VVV.BetaPlace.comEContinuare l'installazione di questa versione preliminare di DirectX?

hXXp://Microsoft.com/DirectX

hXXp://VVV.betaplace.com

hXXp://VVV.BetaPlace.com Web

Windows

. hXXp://VVV.microsoft.com/directx

. hXXp://Microsoft.com/DirectX

, hXXp://VVV.betaplace.com

Windows(R)

Dialoogvenster van MS Shell#Bezig met het downloaden van %s ...

Downloadgrootte: %d.%d MB

Downloadgrootte: %d kB1Geschatte resterende downloadtijd: d:d:d

nstalleerd. Download en installeer het DirectX Redistributable-pakket van hXXp://VVV.microsoft.com/directx. Klik op OK om de wizard af te sluiten.

Deze evaluatieversie is reeds verlopen. Ga naar hXXp://Microsoft.com/DirectX voor de meest recente releaseversie van DirectX of ga naar hXXp://VVV.betaplace.com voor een bijgewerkte evaluatieversie.-DirectX Setup. Waarschuwing: evaluatieversie.0Deze evaluatieversie van DirectX verloopt op %s!

U dient Windows(r) opnieuw te installeren als u geen geldige b

ta-id voor DirectX en toegang tot de website hXXp://VVV.betaplace.com hebt wanneer DirectX verloopt.HWilt u doorgaan met de installatie van deze evaluatieversie van DirectX?

Trwa pobieranie %s ...#Rozmiar pobieranego pliku: %d.%d MB Rozmiar pobieranego pliku: %d KB3Szacowany pozostaly czas pobierania: d:d:d

w wykonawczych programu DirectX nie jest zgodny z zainstalowana obecnie wersja programu Internet Explorer. Pobierz i zainstaluj pakiet redystrybucyjny programu DirectX z witryny hXXp://VVV.microsoft.com/directx. Nacisnij przycisk OK, aby zakonczyc.

Waznosc tej wersji wstepnej juz wygasla. Przejdz do witryny hXXp://Microsoft.com/DirectX, aby uzyskac najnowsza z wydanych wersji programu DirectX, lub do witryny hXXp://VVV.betaplace.com, aby uzyskac zaktualizowana wersje wstepna.

Po wygasnieciu waznosci tej wersji trzeba bedzie ponownie zainstalowac system Windows(R) w wypadku braku prawidlowego identyfikatora Beta programu DirectX i dostepu do witryny hXXp://VVV.BetaPlace.com w sieci web!ICzy chcesz kontynuowac instalowanie tej wersji wstepnej programu DirectX?

Fazendo o download de %s ...

Tamanho do download: %d.%d MB

Tamanho do download: %d KB3Tempo de download estimado restante: d:d:d

Este pacote de Tempo de Execu

vel em hXXp://VVV.microsoft.com/directx. Pressione OK para sair.

expirou. Visite hXXp://Microsoft.com/DirectX para obter a vers

o mais recente do DirectX, ou hXXp://VVV.betaplace.com para obter uma vers

amento do DirectX EXPIRA em %s!

de reinstalar o Windows(R) se n

lida e acessar hXXp://VVV.BetaPlace.com quando ela expirar!HDeseja continuar a instala

%s ...&

: %d.%d

hXXp://VVV.microsoft.com/directx.

hXXp://Microsoft.com/DirectX,

hXXp://VVV.betaplace.com,

Windows(R)

hXXp://VVV.BetaPlace.com.?

mtar %s...

mtningsstorlek: %d.%d MB

mtningsstorlek: %d kB,

mtning: d:d:d

n hXXp://VVV.microsoft.com/directx. Klicka p

till webbplatsen hXXp://Microsoft.com/DirectX f

mta den senaste officiella versionen av DirectX eller till hXXp://VVV.betaplace.com om du vill h

lla den %s.

ste installera om Windows(R) om du inte har ett giltigt DirectX BetaID och

tkomst till webbplatsen hXXp://VVV.BetaPlace.com n

%Optionale DirectX-LaufzeitkomponentennDie optionalen DirectX-Laufzeitkomponenten werden gesucht und gedownloadet. Dies kann einige Minuten dauern...rEine neuere oder gleichwertige Version von DirectX ist bereits installiert. Eine Installation ist nicht notwendig.

in corso la ricerca e il download dei componenti facoltativi DirectX Runtime. L'operazione potrebbe richiedere alcuni minuti...

...WDirectX

(Optionele onderdelen van DirectX Runtime^Optionele onderdelen van DirectX Runtime zoeken en downloaden. Dit kan enkele minuten duren...dEr is al een nieuwere of gelijkwaardige versie van DirectX ge

5Componentes Opcionais de Tempo de Execu

o do DirectXyProcurando e fazendo download de Componentes Opcionais de Tempo de Execu

Windows

mu WIndows.

pro instalaci..Zdrojov

..Zdrojov

ne %d MB. M

ch souboru.GInstalacn

r die Installation von DirectX neu starten. Klicken Sie auf "OK", um den Computer jetzt neu zu starten..DirectX-Setup wurde erfolgreich abgeschlossen.YDiese DirectX-Version ist mit der zurzeit installierten Windows-Version nicht kompatibel.GEine f

hr %d MB ben

EDirectX setup needs to restart your machine, press OK to restart now.)DirectX setup has completed successfully.ZThis version of DirectX is not compatible with the version of Windows currently installed.9DirectX could not find a file necessary for installation.!DirectX source file is incorrect.!DirectX source file is incorrect.%DirectX did not copy a required file.

DirectX needs approximately %dMB. You can increase available disk space by uninstalling applications or by deleting unneeded files.1DirectX setup could not find a required inf file.

correctamente.YEsta versi

n de Windows instalada actualmente.CDirectX no pudo encontrar un archivo necesario para la instalaci

DirectX necesita aproximadamente %dMB. Puede aumentar el espacio disponible en disco desinstalando aplicaciones o eliminando archivos innecesarios.@La instalaci

un archivo .inf necesario.

e.`Cette version de DirectX n'est pas compatible avec la version de Windows actuellement install

e.BDirectX n'a pas pu trouver un fichier n

%d Mo environ sont n

sinstallant des applications ou en supprimant des fichiers inutiles.ULe programme d'installation de DirectX n'a pas pu trouver un fichier .inf n

compatibile con la versione di Windows attualmente installata.;Impossibile trovare un file necessario per l'installazione.%File origine di DirectX non corretto.%File origine di DirectX non corretto.'Impossibile copiare un file necessario.

DirectX richiede circa %d MB. Per liberare spazio su disco, disinstallare alcune applicazioni o eliminare i file non necessari.'Impossibile trovare un file necessario.

nstalleerd nadat het systeem opnieuw is opgestart. Klik op OK om opnieuw op te starten.'De installatie van DirectX is voltooid.VDe huidige DirectX-versie is niet compatibel met de ge

nstalleerde versie van Windows.>DirectX kan een voor installatie benodigd bestand niet vinden."DirectX-bronbestand is niet juist."DirectX-bronbestand is niet juist.2DirectX heeft een vereist bestand niet gekopieerd.

DirectX vereist ongeveer %dMB vrije schijfruimte. U kunt schijfruimte vrijmaken door toepassingen of overbodige bestanden te verwijderen.6DirectX Setup kan een vereist INF-bestand niet vinden.

hInstalator programu DirectX musi zrestartowac komputer. Aby zrestartowac go teraz, nacisnij przycisk OK.8Instalacja programu DirectX zostala ukonczona pomyslnie.^Ta wersja programu DirectX nie jest zgodna z wersja aktualnie zainstalowanego systemu Windows.AProgram DirectX nie moze znalezc pliku potrzebnego do instalacji.'Plik zr

Interfejs DirectX wymaga okolo %d MB. Mozesz zwiekszyc dostepne miejsce na dysku odinstalowujac aplikacje lub usuwajac niepotrzebne pliki.BInstalator programu DirectX nie moze znalezc wymaganego pliku inf.

xito.aEsta vers

o do sistema operacional atualmente instalado.EO DirectX n

O DirectX precisa de aproximadamente %dMB. Voc

rios.QO Programa de Instala

Windows.8DirectX:

rdig.XDen h

r inte kompatibel med den Windows-version som

r installerad.DDet gick inte att hitta en n

r %d MB. Du kan

vs.JInstallationsprogrammet f

DXError.log

DirectX.log

(ManagedDX.CAB)

.NET Framework RC2

.NET Framework

to chybe naleznete v souborech DXError.log a DirectX.log ve slo

ce Windows.DRozhran

mu Windows NT podporov

operacn

tko Storno.HRozhran

mu Windows NT predinstalov

treba znovu instalovat.wAktu

mu.qTyp procesoru nen

DirectX (ManagedDX.CAB) v distribucn

.NET Framework verze RC2 nebo novej

.NET Framework a spustte instalaci rozhran

DirectX znovu.ZStahov

ba, a zda je certifik

Weitere Informationen zum Ermitteln des Problem finden Sie in den Dateien "dxerror.log" und "directx.log" im Ordner "Windows".7DirectX3D wird von dieser NT-Version nicht unterst

her.yDie Kabinettdatei f

r die Managed DirectX-Komponente (ManagedDX.CAB) ist im DirectX-Verzeichnis "redist" nicht vorhanden.

r die Managed DirectX-Komponente muss .NET Framework RC2 oder h

her installiert werden, bevor DirectX installiert wird. Installieren Sie das aktuelle .NET Framework, und f

hren Sie dann DirectX-Setup erneut aus.dFehler beim Downloaden einer f

Please refer to DXError.log and DirectX.log in your Windows folder to determine problem..This version on NT does not support DirectX3D.&An unknown operating system was found.

User hit the cancel key.3DirectX was not preinstalled on this version on NT.rDirectX setup has determined that a newer version of DirectX is already installed.

Please logon again as an Administrator or contact your PC Administrator.qProcessor type is unsupported by DirectX.

DirectX supports Pentium-compatible and K6 class processors or higher.dThe Managed DirectX component cab file (ManagedDX.CAB) is missing from the DirectX redist directory.

The Managed DirectX component requires the .NET Framework RC2 or newer version to be installed before DirectX. Please install the latest .NET Framework and then run DirectX setup again.MDownloading a file necessary for installation failed. Please run setup again.

A cabinet file necessary for installation cannot be trusted. Please verify the Cryptographic Services are enabled and the cabinet file certificate is valid.

n de DirectX no pudo encontrar un directorio necesario.fError interno.

Consulte DXError.log y DirectX.log en la carpeta Windows para identificar el problema.'Esta versi

un sistema operativo desconocido.&El usuario presion

DirectX es compatible con procesadores compatibles con Pentium y con procesadores de clase K6 o superior.|No se encuentra el archivo CAB de componentes Managed DirectX (ManagedDX.CAB) en el directorio de redistribuci

El componente Managed DirectX necesita .NET Framework RC2 o una versi

s reciente de .NET Framework y vuelva a ejecutar el programa de instalaci

n de DirectX.jError al descargar un archivo necesario para la instalaci

Un archivo .CAB necesario para la instalaci

lido el certificado del archivo .CAB.

Consultez les fichiers DXError.log et DirectX.log situ

s dans le dossier Windows pour d

DirectX prend en charge les processeurs compatibles Pentium et K6 ou plus.sLe fichier CAB des composants Managed DirectX (ManagedDX.CAB) est introuvable dans le r

cessite l'installation de .NET Framework RC2 ou une version plus r

re version de .NET Framework, puis r

cutez le programme d'installation de DirectX.jUn fichier n

s, et que le certificat du fichier CAB est valide.

Per individuare il problema, vedere i file DXError.log e DirectX.log nella cartella di Windows.1La versione su Windows NT non supporta DirectX3D.*Rilevato un sistema operativo sconosciuto.!Operazione annullata dall'utente.CDirectX non

stato preinstallato su questa versione di Windows NT.

Per individuare il problema, vedere i file DXError.log e DirectX.log nella cartella di Windows.cFile cab del componente DirectX gestito (ManagedDX.CAB) mancante dalla directory redist di DirectX.

Il componente gestito DirectX richiede .NET Framework RC2 o una versione pi

recente disponibile di .NET Framework e ripetere l'installazione di DirectX.pImpossibile scaricare un file necessario per l'installazione. Eseguire nuovamente il programma di installazione.

Un file CAB necessario per l'installazione risulta non attendibile. Verificare che i servizi di crittografia siano abilitati e che il certificato relativo al file CAB sia valido.

(ManagedDX.CAB)

DirectX.log

Windows NT

.GManaged DirectX

(ManagedDX.CAB)

.NET Framework

Raadpleeg DXError.log en DirectX.log in de map Windows om vast te stellen wat het probleem is..Deze versie van NT ondersteunt DirectX3D niet.2Er is een onbekend besturingssysteem aangetroffen.

nstalleerd op deze versie van NT.sDirectX Setup heeft ontdekt dat er al een nieuwere versie van DirectX is ge

DirectX ondersteunt Pentium-compatibele en klasse K6-processors of hoger.dHet cab-bestand voor het DirectX-beheeronderdeel (ManagedDX.CAB) ontbreekt in de DirectX redist-map.

.NET Framework RC2 of een latere versie moet zijn ge

nstalleerd voordat u het onderdeel Managed DirectX kunt installeren. Installeer de nieuwste versie van .NET Framework en voer vervolgens Setup voor DirectX opnieuw uit.fHet downloaden van een bestand dat voor de installatie vereist is, is mislukt. Voer Setup opnieuw uit.

n of meerdere bestanden door een toepassing zijn geopend. Sluit alle toepassingen af voordat u de installatie van DirectX opnieuw uitvoert.

Een CAB-bestand dat nodig is voor de installatie wordt niet vertrouwd. Controleer of de service Cryptographic Services ingeschakeld is en of het certificaat van het CAB-bestand geldig is.

FInstalator programu DirectX nie moze zlokalizowac wymaganego katalogu.tWystapil wewnetrzny blad systemu.

Sprawdz plik DXError.log i DirectX.log w folderze Windows, aby rozpoznac problem.-Ta wersja systemu NT nie obsluguje DirectX3D.&Znaleziono nieznany system operacyjny.$Uzytkownik nacisnal przycisk Anuluj.JProgram DirectX nie zostal wstepnie zainstalowany w tej wersji systemu NT.|Instalator programu DirectX wykryl, ze jest juz zainstalowana nowsza wersja programu DirectX.

Program DirectX obsluguje procesory zgodne z Pentium oraz procesory klasy K6 lub nowsze.\Brak pliku cab skladnika Managed DirectX (ManagedDX.CAB) w katalogu redist programu DirectX.

Skladnik Managed DirectX wymaga zainstalowania struktury .NET Framework RC2 lub nowszej przed programem DirectX. Zainstaluj najnowsza architekture .NET Framework, a nastepnie uruchom ponownie Instalatora programu DirectX.YPobieranie pliku wymaganego do instalacji nie powiodlo sie. Uruchom ponownie instalatora.

Nie mozna zaufac plikowi cabinet wymaganemu dla instalacji. Sprawdz, czy uslugi kryptograficzne sa wlaczone i czy certyfikat pliku cabinet jest prawidlowy.

ria.xErro interno de sistema.

Consulte os arquivos DXError.log e DirectX.log na pasta do Windows para determinar o problema..Esta vers

suporte ao DirectX3D.,Sistema operacional desconhecido encontrado.(Usu

o oferece suporte a este tipo de processador. O

DirectX oferece suporte a processadores compat

veis com Pentium ou da classe K6 ou superiores.nO arquivo de instala

o do componente Managed DirectX (ManagedDX.CAB) est

Para ser instalado antes do DirectX, o componente Managed DirectX requer o.NET Framework RC2 ou vers

o mais recente do .NET Framework e execute a instala

o do DirectX novamente.lFalha ao fazer o download de um arquivo necess

o. Execute o programa de instala

o em uso por um aplicativo. Feche todos os aplicativos antes de executar a instala

o habilitados e que o certificado do arquivo de gabinete

Windows.

.BDirectX:

ndig katalog.kEtt internt fel uppstod.

Information om felet finns i filen DXError.log och DirectX.log i Windows-mappen..Den h

nt operativsystem hittades.&Anv

r.jProcessortypen st

gre.ZCAB-filen med DirectX-komponenten f

r hanterad kod (ManagedDX.CAB) saknas i redist-mappen.

ver .NET Framework RC2 eller senare innan du installerar DirectX. Installera den senaste versionen av .NET Framework och f

r aktiverad och att kabinettfilens certifikat

Directx.log

4.9.0.0904

dxwsetup.exe

Microsoft(R) DirectX for Windows(R)

DirectX for Windows

r Windows

DirectX para Windows

DirectX pour Windows

DirectX per Windows

Microsoft(R) DirectX voor Windows(R)

DirectX dla systemu Windows

Windows

iexplore.exe_336:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512