not-a-virus:AdWare.Win32.OutBrowse.f (Kaspersky), MemScan:Adware.OutBrowse.A (AdAware), Trojan.NSIS.StartPage.FD, Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 6fb4d71212033e6f1980c09e8d68d829
SHA1: 5b24bbc56bb31104bc511cb676c404fc5ecedc8a
SHA256: 7f4f9138d49a10f32c8cb1aa0d54e946252d07da4ad96223ed4b54ab42ec88bd
SSDeep: 24576:igIkb7xH5w UbKzg11GrxKsJSSDNU95dexu:0Y7xZo2k1QnJc95d1
Size: 998568 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXPESX SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The MemScan creates the following process(es):
%original file name%.exe:1612
wmic.exe:1700
1_Offer_3.exe:580
The MemScan injects its code into the following process(es):
f.exe:1604
6_Offer_11.exe:1272
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1612 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\f.exe (148472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsAVG3rs.dat (27625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv7E.tmp\Convert.dll (3005 bytes)
The MemScan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsv7E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf7D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsAVG3rs.dat (0 bytes)
The process f.exe:1604 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\jquery.min[1].js (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6_Offer_11.exe (858796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\dc[1].js (1657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\jquery-ui-1.8.19.custom[1].css (5521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\DynamicOfferScreen[1].htm (1140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\AVChecker19-6[1].exe (11154 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\Setup_product_4031[1].exe (1365779 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\DynamicOfferScreen[1].htm (850 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1_Offer_3.exe (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\jquery-ui.min[1].js (10441 bytes)
The MemScan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (0 bytes)
The process wmic.exe:1700 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (238 bytes)
The MemScan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (0 bytes)
The process 1_Offer_3.exe:580 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\Registry.dll (25 bytes)
The MemScan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\NSISdl.dll (0 bytes)
C:\ping.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst7F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\Registry.dll (0 bytes)
Registry activity
The process %original file name%.exe:1612 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 7B 2E 8A 1C E5 CB 0A 17 EC A2 D9 B3 EB BF 30"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process f.exe:1604 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014111920141120]
"CacheLimit" = "8192"
"CacheOptions" = "11"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014111920141120]
"CachePrefix" = ":2014111920141120:"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014111920141120]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014111920141120\"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014111920141120]
"CacheRepair" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 81 46 B4 90 37 7E C0 08 03 21 5B E3 F0 BB 72"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"
The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The MemScan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013030120130302]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021120130218]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021820130225]
The MemScan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process wmic.exe:1700 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 4D BE 9D 1E 42 19 E3 EA 3F 04 13 FC 1F 89 E6"
The process 1_Offer_3.exe:580 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 49 74 0B 00 A0 18 75 F2 E1 D8 39 8C D7 C7 FE"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsj80.tmp\Registry.dll,"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process 6_Offer_11.exe:1272 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 B8 32 62 09 DC 26 F7 1D 1C 1F 65 62 A7 3C 19"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
Dropped PE files
MD5 | File path |
---|---|
155013141bd477982a280f7267e7df2d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\1_Offer_3.exe |
2b24006c425d7c1e98a05528ddde259f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\6_Offer_11.exe |
29fc2db119ebc19f9a57711a0eaa5efb | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\f.exe |
2b7007ed0262ca02ef69d8990815cbeb | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsj80.tmp\Registry.dll |
00321d477f76e401373c1fc71c7c4502 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv7E.tmp\Convert.dll |
155013141bd477982a280f7267e7df2d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\AVChecker19-6[1].exe |
2b24006c425d7c1e98a05528ddde259f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\Setup_product_4031[1].exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1612
wmic.exe:1700
1_Offer_3.exe:580 - Delete the original MemScan file.
- Delete or disinfect the following files created/modified by the MemScan:
%Documents and Settings%\%current user%\Local Settings\Temp\f.exe (148472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsAVG3rs.dat (27625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv7E.tmp\Convert.dll (3005 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\jquery.min[1].js (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6_Offer_11.exe (858796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\dc[1].js (1657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\jquery-ui-1.8.19.custom[1].css (5521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\DynamicOfferScreen[1].htm (1140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\AVChecker19-6[1].exe (11154 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\Setup_product_4031[1].exe (1365779 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\DynamicOfferScreen[1].htm (850 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1_Offer_3.exe (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\jquery-ui.min[1].js (10441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\Registry.dll (25 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: Free EPS Viewer
Product Version: 3.0
Legal Copyright: Free EPS Viewer
Legal Trademarks: Free EPS Viewer
Original Filename:
Internal Name:
File Version:
File Description: Free EPS Viewer
Comments: setup Installer
Language: English
Company Name: Product Name: Free EPS ViewerProduct Version: 3.0Legal Copyright: Free EPS ViewerLegal Trademarks: Free EPS ViewerOriginal Filename: Internal Name: File Version: File Description: Free EPS ViewerComments: setup InstallerLanguage: English
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 65536 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 258048 | 3240 | 3584 | 2.80163 | 8dcf099c23fddcf05859063ae7593d55 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 51
74456cb71d2eb9920578ebca2d37fcac
4dd77fdbabe4f48f715f082d7d78d398
f3d700837f49459fdf0e010cff2bf270
f12b3ccd1cfaf555f36b9775fc8b1c10
971baf15538d2332a9dde086bea3f43c
2571c15e7c714f080e569bf65c460295
d13af9456cb439115ed7b0dc722b4460
c6c6b85b4eb92d1d369667fe857157e9
f589650579070c81f3e2c5201e697d65
938ab6b8f75e486a42ac15b506e7b5e4
3dcd6f1c69fcf2c3f4cacf13e5d4bb06
1421856bb70a44eb4c9db014f32bb0cf
7b27cd0cb3bccfca345811b6d1f8b461
888c495c20e3366d3479d31a00e41315
79e6cd4e65e2b5ba7a9e0cd862744cec
777127e2b2ed1e867db21248de6f9bef
91a5ff02b550418e7529758f18bdc62f
fd5dd6efda8498847f7f224b2bb745d1
64ce102a347e4884ac9dbe87784acf1e
32a513a63570b079b3937a666ea23a14
988a4de244bf4fb45c88e60e0a9bee76
10c3829a4005b921348b6fb858edc94c
6aa1cfcefb224b400ed3cf351483eb8d
05fdc704e8d62a4c8868439c38a585f5
4b5673bcf415ec0c4dba4d6c0f21f17d
Network Activity
URLs
URL | IP |
---|---|
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1 | 50.17.229.113 |
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/Files//Setup_product_4031.exe | |
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0& | 50.17.229.113 |
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css | |
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css | |
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.5/jquery.min.js | |
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js | |
hxxp://64.233.171.154/dc.js | |
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bgImg.jpg | |
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bottomLine.jpg | |
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png | |
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png | |
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Track?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&reqid=164520114&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=4031&offerscreenid=&offerorder=11&downloadduration=6250&installduration=265 | 50.17.229.113 |
hxxp://smartinstaller.elasticbeanstalk.com/Installer/TrackFinish?reqid=164520114&x=y&clickid= | 50.17.229.113 |
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/Trackers/AVChecker19-6.exe | |
hxxp://smartinstaller.elasticbeanstalk.com/installer/GetTrackAVs?avs=0&reqid=164520114 | 50.17.229.113 |
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0& | 50.17.229.113 |
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topLine.jpg | |
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topComp.png | |
hxxp://smartinstaller.elasticbeanstalk.com/installer/thankyou?productid=4031&pubid=707&distid=4235&countryid=71&reqid=164520114&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0 | 50.17.229.113 |
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bodyImg.png | |
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/nextCase.jpg | |
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button_over.png | |
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button.png | |
hxxp://smartinstaller.elasticbeanstalk.com/installer/ThankYouInner?productid=4031&productname=Free EPS Viewer | 50.17.229.113 |
hxxp://n20.adshostnet.com/js/show_ads.js | 212.124.112.251 |
hxxp://n20.adshostnet.com/ads?v=1&key=6c2c19aff050b202bf7c7970cb59cde3&ch=&click=&tz=2&t=1416402832199&scrWidth=1024&scrHeight=768 | 212.124.112.251 |
hxxp://n20.adshostnet.com/impression.gif?b=22&p=11&ch=&ap=&cps=&c=21&l=CA&h=f9fbd1ed42595ac2ffa20c9cbb973f78&t=1416402832793&s=8c3775c9dd22ebc22c4d271ffd13b295 | 212.124.112.251 |
hxxp://installer.apps-track.com/Installer/TrackFinish?reqid=164520114&x=y&clickid= | 107.21.209.254 |
hxxp://static.revenyou.com/offers/images/Theme8/button.png | 198.232.124.224 |
hxxp://installer.apps-track.com/installer/thankyou?productid=4031&pubid=707&distid=4235&countryid=71&reqid=164520114&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0 | 107.21.209.254 |
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png | 64.233.171.95 |
hxxp://installer.apps-track.com/Installer/Flow?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1 | 107.21.209.254 |
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css | 64.233.171.95 |
hxxp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css | 198.232.124.224 |
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0& | 107.21.209.254 |
hxxp://installer.apps-track.com/installer/ThankYouInner?productid=4031&productname=Free EPS Viewer | 107.21.209.254 |
hxxp://stats.g.doubleclick.net/dc.js | |
hxxp://static.revenyou.com/offers/images/Theme8/button_over.png | 198.232.124.224 |
hxxp://dl.revenyou.com/Files//Setup_product_4031.exe | 198.232.124.224 |
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js | 64.233.171.95 |
hxxp://cdn.download4desktop.com/Trackers/AVChecker19-6.exe | 198.232.124.192 |
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0& | 107.21.209.254 |
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js | 64.233.171.95 |
hxxp://static.revenyou.com/offers/images/Theme8/bgImg.jpg | 198.232.124.224 |
hxxp://static.revenyou.com/offers/images/Theme8/topLine.jpg | 198.232.124.224 |
hxxp://static.revenyou.com/offers/images/Theme8/bottomLine.jpg | 198.232.124.224 |
hxxp://static.revenyou.com/offers/images/Theme8/bodyImg.png | 198.232.124.224 |
hxxp://static.revenyou.com/offers/images/Theme8/topComp.png | 198.232.124.224 |
hxxp://installer.apps-track.com/Installer/Track?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&reqid=164520114&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=4031&offerscreenid=&offerorder=11&downloadduration=6250&installduration=265 | 107.21.209.254 |
hxxp://static.revenyou.com/offers/images/Theme8/nextCase.jpg | 198.232.124.224 |
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png | 64.233.171.95 |
adservingsolutionsinc.adk2.co | 23.209.65.31 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /dc.js HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: stats.g.doubleclick.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 19 Nov 2014 17:15:10 GMT
Expires: Wed, 19 Nov 2014 19:15:10 GMT
Last-Modified: Thu, 13 Nov 2014 21:10:00 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15853
Age: 3921
Cache-Control: public, max-age=7200
Alternate-Protocol: 80:quic,p=0.01
...........={_.:...)....'.$..&.......-..Ms..e9..'...B.g.3#..........3z?F........z....n.h..@&b.....v.W.A"...<8H.^.....A*......3....~..X?8....<..t..)d.......Hf.Q...._. .,`.....a....>...?...v.Aq.G.........p.........a$y&.....sX7p........ ..M.d..l.K.....t...8..i6....C..XO.....@....!.....RG.l .}....b$c..B|8..C}!.8..=.e.K....{..K.9..a..nx......%..;..F...J...v..n!.L.....g.C@...~..|...=....q.9n_...P.....Tw.o...........k.....^:.....O!..b......=...B..,..j8......k.b./.Y..JE...({k.........(.L..@. ...b;...s.f...k../--..\..A.M..he.q..u.u.$..<.....$......eBf....,...r{.[.....h....Tup..$?F?2.... .qk...x..;.......}.Y.[)jL.........}.4.'..Z_...bms.._..I4.r=...f....U}...|......].FG..\.[9...hp......"..L..J...a..l.=.C..c.............i..2&.......{....T*w..%#ey....A..`.T..Q.w.....f2...,....J...y.qqA.........BTo....5.W..9]...]b$K%Z.V..b..x1t....]..&.P.Qo.A?..W.R..l.........'".. ..D. ..EA.......$US.t...w?.u*rn.:......?...a,.(..0....`.GL....Z...j[8.[.2k8N...4(.x..4j&..V..p.N)0.;k.......C..= .].;M.|..&..;........M'....Vy.6*..[J.7`n*...Q..O.%4T ...;.....'J.........xKK.&..^A...;...........a<.783[X......p...c...3j$.....Z....c.D.....BW................*.1]KQ].zb.... .?~....V>&."..Q$.....&.sS..Kq........).....{y.V....T...L.09.-.KK:..yH.....4./..Ni.oaM..X..X.R...l...[...n2.....6.v.Q.......v.C.0........55..z]__.a.j...fJh.....r.6a.6v3..!.}^0...,...I.w........i.......Q..q ..c;2.p2 .%..:0..14....z....b.*Z..*..>...v].....H...V...kVT.]....I ...._..}.f.....^U..a.V]..wd.N.....9....n1-0..`...B..Q.MB...7...%.!.L~.."H..xNV`?||.H.........
<<< skipped >>>
GET /dc.js HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Thu, 13 Nov 2014 21:10:00 GMT; length=40298
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: stats.g.doubleclick.net
Connection: Keep-Alive
HTTP/1.1 304 Not Modified
Date: Wed, 19 Nov 2014 17:15:10 GMT
Expires: Wed, 19 Nov 2014 19:15:10 GMT
Age: 3933
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.01
GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 19 Nov 2014 18:20:31 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>....
<<< skipped >>>
GET /Installer/Flow?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: installer.apps-track.com
Connection: Keep-Alive
GET /Installer/Flow?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: installer.apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 19 Nov 2014 18:20:25 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 19176
Connection: keep-alive
..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"8 $.Fmkcsez_oajgRvjdo"8.*(, ./!("P`_F^w.4!.HI@QZEM@;K[M?>@DGC.Mnbtu\j`UZJcbnoqj^oUZTcm`ounTW<soldjtT`jnbmkV[QngikoZjiV[Oe_m[cIplnd_tz.t.AIBS^HOA<DZF?@BHJE.NGAMU>LDX\Q`Ym\fMlnpeaot.u.EEDU_APJM>LQYTOEP.Kj_rt[qa\ZN]\kaeJqktc^l.% O_fGew1,.3 .BJAY]GG>:J\G@?HGI=.Lmcnv]rcWTHbaoirkfrWTRblaivo\Z>mmkcknUarqdgiUZRhhjsr\dgUZP_`ncfKjjmc`n{.|.CC@R]IIB=L]H9>AGK?.OODOO<KCYVRaap^`Kkmq_bp|.w.CDCVYBQRP@FOXSP?Q.SmalrZpbV[Oe_m[cIplnd_t '.M^nllsJak`.5.Qb[q_hNmgo^aqCL.Rcb.'.NoicqcrD<.30.-2., <drZwpIebep.2 % FmV]irAgmBlpn`hl 5)'.Cu_TNL 5.cmrm4. dj,&_hukmdnvcm )\mj)Hjsr\dg^p,Md]racHmhrb]sCel`jd\-P_`ncfKjjmc`n^-6/,&`qc.&!AxcPJG 7.gptn5'*]j.(ckwln]moco--_ok*Ailr^fkar-N]\kaeJqktc^lB^lblh_/Q`Ym\fMlnpeaoW,//.(dte '.>hkj[m`Lgi].3 .'b]rpd]mXrvjd9crd\.&a^lqeepZa_6AQ-2-95. .&ni[sboph5\ej.'rpapoh\`c:nqqe.(\`__rfsoe_m[c6rood.-jj[\e;bh,qs..'>MGA7BP31,12,1.&!Kfd`jPKJ.4!dtrk2*(bfld_t,o``&_mjr)tp\[f'alg. oda]ml-Asm]mg^Ga_coMbneci7j_dblh`=0- !ipl^t_tg_5-*10,%`iqoa_62/-4"lc\\k62--0"cmpfokwf^<31$nqn[gq72.&baZ8)$e\<1&gnYb`;- uarqdgi62 %axr`jiZj:*!("P\l`.8* .Ab_aobmk[k@ar\.5. ).@jtgqamnqbmQagI`qn.8.. .P_tgpm 7'0("Ca^`\rfpd.: ,$.IplgnpimiJ\mc.4,-, ?an\pbj`jcwMYo^ 7'0("Qg]`i?cndnIlnl\ej.41,0. $.Ogont]lMa^`kAlgl]nbGai^ 7hthl*.;\gPrh@oCf`[f[mu.9prs`$.KskCm=gem]nlgs_Hjsr\dg^p.4!-"*.JpgGkLdcuj\jDgqq[khep.2.* z&z.Pmnl@qc.4!., Kj`>vb.9."*
<<< skipped >>>
GET /Installer/Track?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&reqid=164520114&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=4031&offerscreenid=&offerorder=11&downloadduration=6250&installduration=265 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: installer.apps-track.com
Connection: Keep-Alive
GET /Installer/Track?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&reqid=164520114&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=4031&offerscreenid=&offerorder=11&downloadduration=6250&installduration=265 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: installer.apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 19 Nov 2014 18:20:44 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 8
Connection: keep-alive
..OK......
GET /Installer/TrackFinish?reqid=164520114&x=y&clickid= HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: installer.apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 19 Nov 2014 18:20:38 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 8
Connection: keep-alive
..OK..HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html; charset=utf-8..Date: Wed, 19 Nov 2014 18:20:38 GMT..Server: Microsoft-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Powered-By: ASP.NET..Content-Length: 8..Connection: keep-alive....OK....
GET /offers/images/Theme8/bgImg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 19 Nov 2014 18:20:31 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>....
<<< skipped >>>
GET /ajax/libs/jquery/1.5/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT
Date: Wed, 19 Nov 2014 17:20:54 GMT
Expires: Wed, 19 Nov 2014 18:20:54 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 29947
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 3572
Alternate-Protocol: 80:quic,p=0.01
...............F....>..R..1.d...j0!^Y....l..jW....@..w.Le.I............@0.....$..}9[.......O....f.O.......6......6...W.?..!.t............C...r....'.}.Y..J5.....?g.|...n.Ec...j.....Q.m..Y..w...m..?}...l.....3.o.>mp..t.g..w.tq;.v...o.-..l...q.lg:z..w..W....zM.....d.9[d.IOU....T#^....;..1..,..o.o.m.......g...}.m5.._u........*ES~.....5.....m......v..%_..w......Z..w.6Y.E.....l......gw.C....l...a..X.:F...o&...a...z.D#...Zq.{...x..V.wk.K..O^..(i.......f.SR/io...c..=.,.^x..*...~..4...:.{=n(J.z(..t(.q..i.p...Y.N.tD..J.=........vXn.K..e.-xH..i..F.1..f.....e.o?..\ew....>~...c2........z..............Gj.zB.;:....2..M.sF.s../..*8..o....x.;....>& n.... .....y......4Ui.@......b.m/.h...?U.....=T.EE.N.i..DMU.e.E....j..Q6...B-.J....>M....:.MZ-.4.Z..._..i.%..m..]..........o.........~.......3...HN..t.................E/[....-..vq..y....-....j......0.xO..U4W..&Jx.ktt.<..u.6oNK..x..h....p.Oh.......P...6...R.C..\.n..m..?..W....6..G.....hn..h.o......!.ep6...T..N..$.......5.)P...3.V......_.O...5..gl.5........c......6.m...^..b...c.y.r..$.....L..p...o.................(,uB..T.2_28....d..us.f1.L..=..&..bV..m<..=........3D..\.Y..r3....A_.Y.G.%.....7|.$t.Z.k..C..\.8?.h...q....naF.i-.......B..`6t.._..h12n....v..".pq..C.h.......x...N.L...p..............f`E@.ha.....m..zj.] h........v..(i....|mv....7.......t......j..j...c.K2...;.4.$;Ve...-o4.~.;..h.M...(*N....m0T.G]5.......K`#.&..Z.V...3......m2.Z.hJ;..F...`Q.QM.?.,..E........@......=.b.........._.Fi.h6........l....2.}$...>.=.N.M)....$eP..]..p%M....|.e......&jJ...x.u...:..
<<< skipped >>>
GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Wed, 19 Nov 2014 17:20:44 GMT
Expires: Wed, 19 Nov 2014 18:20:44 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 88
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 3587
Alternate-Protocol: 80:quic,p=0.01
.PNG........IHDR.......d.....G,Z`....IDAT..c.....&.....G0..ed.......w...........IEND.B`.....
GET /ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/css; charset=UTF-8
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Wed, 19 Nov 2014 17:48:32 GMT
Expires: Wed, 19 Nov 2014 18:48:32 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 6091
X-XSS-Protection: 1; mode=block
Age: 1914
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Alternate-Protocol: 80:quic,p=0.01
...........=k.....3...E...yl.=.=.....7@..6..~...e.#K.$.#A..=.!%J|iz...;@Z.:...y..}..........X.H~{G...O~......-.M^M....@o..c.....Og.s............!/.Ms.\\...'t.&qy..........hN.,fE..r*.V.f..O.>.."...G._.... s.WO8f....v...dJ>O...H ..o..>..! v.o~y...gg.....#.D.,?BwgQ...&.,B.h.%. .'.d.1...R...&.M...1..l.3.?.u..t.B.u...F....e....&q..7.bq.bv| ........... V..z;.j.A_.kr.I.J...e.z..A.yV0........0..5i.C.%,. .L..iY4Q.}...t......y..U.q.h.f..-K.....3.6...H..Y..|..u.....\d[T.........>......|...Y...T.*...<..X..F.S.:.4..G.<.r`k.&?........0.p.w gEcN..=.'8a...E......~...$OXJOy.s)...ud..\tQ.Z$$;..|.}g@G..m^...S2.gn.h......;V.yy.!...{4..U%D>x....{...2.SV....!Y<....3..e...cMTb.5.,f...r..$Or..%X...78.I.>..Y.99@.........U......4....5.......2.......UY.<.W EY.h.<.U.l2c.....V.J..T.^...owo.....(...|...Sh..~x..l..ovyY.7...M... ..v2.%.j....Np1_....4...M...9.~.,y.V..b.-...i.&i.q...W7......*1.QP.k:C..^.k6..T.\.u,..LW.(S<)5.............X...ZW...#.UC*.:nT;.....\<._.. J.YK.:9.H}3....U.B..$..W..f$l]^m....@..c..........0.h...l.q.,(."......l.%........:.A..y.'n.. ..j:.q2.]r..M...j.JSQ....i.8...J...".iZ.V.....5..'S:.*..C..V.Y.!S.k*.:FT.tv...1.P.A.e..r.h......-..uGZ6.(.....l..!5....z....2M!.?.G.........'....U>..-aH/ .E.D.T{J..C!...tK.!.a.v..~......$....5 ..xj.u...P...x.@ F{..S..R.O.<d#.E%PS.//......5fV.4...1..S.......mw..#..o Q. .....p_yI..ox.....UM.uP....b.v0GE.....A....X.!pX4.......Y-o..f9.....L.p$.........;..P...Q.b........mZe..$s..].8..t...M...o......X...S".>..1A*.....2h......D.j8Y..wL..^.| ....1...`C
<<< skipped >>>
GET /ajax/libs/jqueryui/1.8/jquery-ui.min.js HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Wed, 19 Nov 2014 18:19:35 GMT
Expires: Wed, 19 Nov 2014 19:19:35 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 51558
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 52
Alternate-Protocol: 80:quic,p=0.01
............iw...0....d...-.@......."...x{,y.<....n.M....ZB...w...AP...9.L,.k_n..n.{.......V..G..<........}......n.........l..Y....z3..................E1.-.uz..........ZXI..rZm....../X...4.......@..Z......yUlB..U#..L...1p.>...2...].....M(...J.....e..I......5...9...e.....&.........W..y...f./..j..}^....r...n.._7.j.o..v.i./a.7uq......r.%.,......j9..Y.s......@..$...... \...H...=....?....y...}W..b].G..|-....wG.N.O<.H.Q...'w......H.....*.....?..Uo..n..Z=..U...I...*..,....J.@.b.....l.[@E1.....jq<..V.d.=.n......,..o... .gY.G....N%$f..u..."J.....xvrR..$.q..i....l..m7....p...]./!.......JF0..^.. ...Q.....H..q...._wr"9..S].I/_.....~M...Z..U5..^q.z..U...k..........Q.........v...[.v..`:UJvIo^-...........n.;..{o....p.CliS-J..w27...F.....v .{...t..........g._._...~z......wz.......gP.K.....W....w/.ym......B.cH....?~..~/.~..../...._.........4..s........x..z|...^|.../.._..?.z..............?.......?=......N......_<...3.n..I/..../ e.Rd../U...|...O.....Pi.~.....=.5..%~z...oh..?.._~J.?.?.....0....g.. ....0....W...x....W.k|)....h....n...7Y....c..l.Y..._...3.D.f.,n..G?.'h...*.l...ZN...R...q..F.;.*/f6T.q-3........Z.n..y\&.].......*.C..p..I.U.Z/....`..W..k<.Pn]....OtJR...P...j.n...z]W''..z.o.b.....m...K...u.)..%.v{.8p9..T....4U......X..U.o'...T.....D...G.tc.3o....8./.a.NK^...........q?I.0.....)-..m.\..m...@.0......\..{.>........D..n..Gp..)R:...>.D ....d.nV.......C....pWe.?Xl.B.....6} .Q.4...j....^.6q..3..>5w\.....'.@....&6...?ok..$.;....[...!Vo........vx}{s.L.dA...6......8.r......bt.>"a........0...I~;....
<<< skipped >>>
GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Wed, 19 Nov 2014 17:39:09 GMT
Expires: Wed, 19 Nov 2014 18:39:09 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 3457
X-XSS-Protection: 1; mode=block
Age: 2484
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Alternate-Protocol: 80:quic,p=0.01
.PNG........IHDR.......d.....p..}...HIDATx...K..N................q..B....6...._.d.c.......*...V......|U.......w-...p..>Z..........`............`............`............`............`............`............`............`.......@.....:n.K>.u.....X..V..G........l.9......j6.x..xu..y...I... gZ.D.L...........4[OG.8.|d.....;.N[O..lz.M....{..ne.Z1..VlO...e..k.g.........k.6.r..........be'`t#..zu39.|[..6=9....4..H."...-Cd.D.z.3c.g...S.,..D7.h.H=O.F6.{7.....H6G...S.......U.9.%w....`C.....y.G^@......O..........0.l.....0.Z.4..H..[.k..Z..Z..zm].v.......J.$ZMZ..yK.....Z.4.Z.Z.Z.Gr..M..j.b..Z^.1c.E........,....6&.9....3)....[W.vH...a...k~....,.........1..k.R..........iWd....M.V..O)..?y.....W...._<....p.p....`............`..b.......:............:.............Xj)...w.....-?M.bE|[...I.eki......&.U.6.........l4.[..N.F.....|...qc.Zj.7.....;.f/..w..=......}L[...k.E.S/.x....3-...^.R....."Z.........[........:.;...n.Z..~.....;.....%w....P7...'R^....E[?.C...X.$.^Y.Yj...}...iS.O.....m........r%..4yy.r..I.....Io...'i..;..._....K.7.%.Q../.\......X....3;_........[...[..ti.........._.-..Z.l;j)e.L.lyf"Dm..^4...-.|G.E VdRD..M....S[.{.i6G...~/7V.h....M..;^.1~.}.;......=9.]S2....y.w|Y.#s(..X..;....:=....Y_#.\r......RkY.$.e.mk..n.E|..m|....kk...O.......'......-..n.z..XZ}m\H.._e.....V.x9........!.../.xs......f.......5.Zl .......x.....].?/..9r......h...]^}M....<....;..........p.p....`........}.....n..~....4............. ^=..kc...|j..4{u[.......H.2...Y1......R..|x.5M......j..4.%..x......!ij....bXcT..^[$=V.4<m^.=~..Yo.E..s..>....
<<< skipped >>>
GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 12 Oct 2012 18:27:19 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 304 Not Modified
Date: Wed, 19 Nov 2014 17:39:09 GMT
Expires: Wed, 19 Nov 2014 18:39:09 GMT
Age: 2484
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.01
GET /offers/images/Theme8/topLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 19 Nov 2014 18:20:44 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/bgImg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 19 Nov 2014 18:20:44 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/nextCase.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 19 Nov 2014 18:20:44 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/button.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 19 Nov 2014 18:20:44 GMT
Content-Type: image/png
Content-Length: 458
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT
ETag: "1b5642f092ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Wed, 26 Nov 2014 18:20:44 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi........../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f...p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C.......$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`...
GET /offers/ui/css/start/jquery-ui-1.8.19.custom.css HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 19 Nov 2014 18:20:26 GMT
Content-Type: text/css
Content-Length: 20706
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Thu, 26 Apr 2012 17:23:56 GMT
ETag: "ca38195cd123cd1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Wed, 26 Nov 2014 18:20:26 GMT
X-Cache: HIT
Accept-Ranges: bytes
/*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/UI/Theming/API. */../* Layout helpers.----------------------------------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-accessible { position: absolute !important; clip: rect(1px 1px 1px 1px); clip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helper-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; position: absolute; opacity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.----------------------------------*/..ui-state-disabled { cursor: default !important; }.../* Icons.----------------------------------*/../* states and images */..ui-icon { display: block; text-indent: -99999px; overflow: hidden; background-repeat: no-repeat; }.../* Misc visuals.----------------------------------*/../* Overlays */..ui-widget-overlay { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }.../*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/
<<< skipped >>>
GET /js/show_ads.js HTTP/1.1
Accept: */*
Referer: hXXp://installer.apps-track.com/installer/ThankYouInner?productid=4031&productname=Free EPS Viewer
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: n20.adshostnet.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"6947-1416167328000"
Last-Modified: Sun, 16 Nov 2014 19:48:48 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Wed, 19 Nov 2014 18:20:43 GMT
a..............200...Yms.6.. 2....M;w3.@...n2q...Qr.....$$.....m ...-^H........`..}..z.......=^GzP.sJ..~....2...!...:g.~..R..a%$.Y.<_.Cz$........n.9.a....s..q...@...p..@}SN0..<s?....u.q^...r....(.iE.I..p.!.@.W.M.rND\4.D.e..%...K.n..../..H.V\.........*@._.(Dc<F..j..1~.E.....V..>.q.".....,..|a.'*....d#k..XV.....".. .....4. .\2.W..73Le,.%{..<.8.c..z...hJ8..'..d..<.EN..Db..eO.!...r9.yNK....M$'t....0....<.w.......G.(..^.H...h|.N^..NF............g...l.*..bc."P?..c...........V....-a..G....9c...w.-/Y./&..|...B.-.yD.......C...;.s`.2.....200...hQ....t...q .....^.7V..M.>*5............@TP<.W...t.24...&.Y..x..L............#4.aX;..7v...%.`...]]...a.x.!..d\(0(p...2.r..q!.g.$..M.J..%. Ba..h....-.%.j.qk....H..0...Py(.7.KP...Q .....d.)9<4....&7..".0.1_z..3]...........' ........:.e..:.......(~.>!..Ba.1..JJM.... &.2......KR.......z..p.p....;s.-..#.k...$h.`k........"/pp...b...?...U.2O..........5..3.W.....:.0N...}]E.3V.'Za.."@v.5....k...v.F..Z.F.d..k.q...~.C.S....(..X."..>P...gc..P..._......(\b.:h....4..S......7.....n.p!5.C......(p-...X...H.da.ap...^9Q .[....200......%D.... .....n..r.....Le...........,PGt2_..nG!.A..g..8.HDcHuB.....R...D.[.....JU...&....K.x....v....v...PE..........Iu..s..-M..x.8.._P....9.N..U..H. ........g$...#.U:.V...uu.V..2...hh..F8.....n._?....*.t.ap ....$.5...}`.....,.jLkT.~...I...9..N....s..i. ....%v.....Z.....2.$wg.C.b.el.6;......?.).{....].3......uC.{B3....=&..u.....t.nH..}.6'.q......:....=T.p.63...Y.....S..........:L..L2.$....J..',..Rn.x..-........m..z...X/xo5...b. .....w$.
<<< skipped >>>
GET /ads?v=1&key=6c2c19aff050b202bf7c7970cb59cde3&ch=&click=&tz=2&t=1416402832199&scrWidth=1024&scrHeight=768 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://installer.apps-track.com/installer/ThankYouInner?productid=4031&productname=Free EPS Viewer
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: n20.adshostnet.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="CAO PSA OUR"
Set-Cookie: epomUUID=c6daedc0-7018-11e4-ac2e-002481e7ea6c; Domain=.adshostnet.com; Expires=Tue, 14-Nov-2034 18:20:44 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Content-Length: 756
Date: Wed, 19 Nov 2014 18:20:43 GMT
<html><head><!--22:11--></head><body leftmargin='0' topmargin='0' marginwidth='0' marginheight='0' style='background-color:transparent; width: 100%; text-align: center;'><center><script type='text/javascript'>..var adParams = {a: '52031169', size: '800x440',serverdomain: 'ads.adservingsolutionsinc.com' , secure:true ,context:'c51791155' };..</script>..<script type='text/javascript' src='hXXps://adservingsolutionsinc.adk2.co/adservingsolutionsinc/scripts/smart/smart.js'></script></center><script type="text/javascript">new Image().src = "hXXp://n20.adshostnet.com" "/im" "pressi" "on.gif?b=22" "&p=11&ch=&ap=&cps=&c" "=21&l=CA" "&h=f9fbd1ed42595ac2ffa20c9cbb973f78&t=" new Date().getTime() "&s=8c3775c9dd22ebc22c4d271ffd13b295";</script></body></html>....
GET /impression.gif?b=22&p=11&ch=&ap=&cps=&c=21&l=CA&h=f9fbd1ed42595ac2ffa20c9cbb973f78&t=1416402832793&s=8c3775c9dd22ebc22c4d271ffd13b295 HTTP/1.1
Accept: */*
Referer: hXXp://n20.adshostnet.com/ads?v=1&key=6c2c19aff050b202bf7c7970cb59cde3&ch=&click=&tz=2&t=1416402832199&scrWidth=1024&scrHeight=768
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: n20.adshostnet.com
Connection: Keep-Alive
Cookie: epomUUID=c6daedc0-7018-11e4-ac2e-002481e7ea6c
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="CAO PSA OUR"
Set-Cookie: ucv=21-CA-1416507645162--; Domain=.adshostnet.com; Expires=Thu, 19-Nov-2015 18:20:45 GMT; Path=/
Accept-Ranges: bytes
ETag: W/"49-1395933738000"
Last-Modified: Thu, 27 Mar 2014 15:22:18 GMT
Content-Type: image/gif
Content-Length: 49
Date: Wed, 19 Nov 2014 18:20:44 GMT
GIF89a...................!.......,...........T..;..
GET /Trackers/AVChecker19-6.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.download4desktop.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 19 Nov 2014 18:20:38 GMT
Content-Type: application/octet-stream
Content-Length: 72233
Connection: keep-alive
x-amz-id-2: axZh06IT8xyw4ahAw2GTBcTL7IIJq2IENhjZzz/vHmZO8qBPiYJ49xjHDpytx57N
x-amz-request-id: B848845CF2C5F743
Last-Modified: Thu, 19 Jun 2014 15:20:40 GMT
ETag: "155013141bd477982a280f7267e7df2d"
Server: NetDNA-cache/2.2
Content-Disposition: attachment
X-Cache: HIT
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t...........@...........................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc....@.......B...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>
GET /offers/images/Theme8/topComp.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 19 Nov 2014 18:20:44 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/bodyImg.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 19 Nov 2014 18:20:44 GMT
Content-Type: image/png
Content-Length: 1914
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 10:27:32 GMT
ETag: "36dd864c691ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Wed, 26 Nov 2014 18:20:44 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR.......:.....j.......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...0PLTE................................................{.......IDATx......:..`..p..J.4.ty.:......)v..\....,.fwv..U...!.....b.f.....Cy(..OW......w......]R..l..2My}<..]..8hn{*..X.).m..4w.U.J.....u..l.J...<...>uJ.....i.>o.%......I.\..S......U.D.}OK..J`......sJ`.}..M.9%..A....u.T.%........K....OQ..._..d.>..L....]I. U.].c.Je...|.W.U?..E.}...*.vZ...K...M....).W...^V..>).e(.].Z.}dg%@....S.*/...........Y.W.]}...|.SgO........rrj...4UY../..r.~.....Z.ep.wui.sP^..X.g%$(.......C........Ze....4yn}....U.({.V..{o..}O...w.G.Q.^..r..p....0y............8......6.v....zz~....-...F*..f.F]...R..*. -......e{mO.s.i.9.U....zz.6.f.T>.f.DQ%.. ...l.q\N."eA({_W7..Q.....d........>...Y.."e.\....s,.. .Li)%....R.o.....C.9wQ....8........KNY..t..)...k...v)P*.....I...4&../.{)..qe..R.'...2..*..d.z&.T;y..)Q*....)R..2..)Tj.B..)V..b..)W......QB!rj.B.J)..N)b*...R)q..<S...z%.LPr..%.LQ2.4e.....q&*c.De,..J.x& ig...g..b.(.g..p.)Qf..uf*1g..af .Y...... .;(.....s......r.v. ...s'...K.0wS.....sG%.......-.R..}......4S.....W.....=.9eN(..OS..Jt(...<...P.(..DJ;_)..Y. ..7.>.@.Bi....HS)eM.qi;...........$.z%.[..P...SJzT*E]......2zT.t..L%6.TJ..Y.a...}.V..J...,.....H... ....;..2_._/[.^/[.\.W.\.!..%oT*y.Z....#Q.Bw.FI.7...H..2Jt.*..../........2.F..X.....gqJ.q:.U.q.. V...B..s.(.J2.x..()#1@.'d4.Hh.h.J.I.i.G.#.;.J....*Q$Z..?.........sR..D.<...| ......2.1b.A3...v.....X.y{..R....{h..pzJ.I.).Y..Kn.z;%Jn..c.W...bL........t..!...A..(..*
<<< skipped >>>
GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 19 Nov 2014 18:20:44 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/button_over.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 19 Nov 2014 18:20:44 GMT
Content-Type: image/png
Content-Length: 921
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT
ETag: "f072da2a092ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Wed, 26 Nov 2014 18:20:44 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...;IDATx..Z;o.1..Y.D...W."$=D..*=BPR@..5..........DHi...M.i...e.r............;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.sh..e..z.A....G.p..IZ.z...?Ra8........Y......O.......[........sL..?@.o....y..-.....Lc.0......O..|z.O/...k.....e...n..!......G.p...9....3. .'?7 ..GD@..{.<....C$....N.........Q...<.,@...].;Q.'<.(.X.r.,.6.......QrB..h..d&r....6....G..Shr.... .....4r..= ..f.....B.qP..l.K........YB.Z....H....../:.l.(.S.D...nM7..P.%R........&_uR.H6A..(raP.H9...[\D. .(....d...`.8.A......r5Q..........:v.e....u.....-&.1.....&.........Z.|....).L...$....)K%a-....b..a*{<(W..P<..w7_Z.....h.%6.N........*\FB...A...#..f.N...C..(.p...........K.|..5d..3u-........(.k. 7..6..tsvP!.U0.q.......9z.e ..0.ALt..@l..2iR.2............. .>=...{WVim....f.c6.:...|.....0X.yk...../z..!.SHW.d......o.s........a..8..g.|zvg...o6......@..........n.^......IEND.B`...
GET /installer/thankyou?productid=4031&pubid=707&distid=4235&countryid=71&reqid=164520114&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 19 Nov 2014 18:20:49 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 1304
Connection: keep-alive
..<html>.. <head>.. <title>Thank you for installing Free EPS Viewer</title>.. <script type="text/javascript"> var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]);.. _gaq.push(['_trackPageview']);.. (function() {.. var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.. ga.src = ('https:' == document.location.protocol ? 'hXXps://' : 'hXXp://') 'stats.g.doubleclick.net/dc.js';.. var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.. })(); </script> .. </head>.. <body>.. <div style="position:relative;left:0px;top:0px;color:white; height: 1px; visibility: hidden;"></div>.. <iframe src="hXXp://installer.apps-track.com/installer/ThankYouInner?productid=4031&productname=Free EPS Viewer" width=100% height=100% frameborder=0 scrolling=no marginheight=0 marginwidth=0 > </iframe> .. .. </body>..</html>......
<<< skipped >>>
GET /installer/ThankYouInner?productid=4031&productname=Free EPS Viewer HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://installer.apps-track.com/installer/thankyou?productid=4031&pubid=707&distid=4235&countryid=71&reqid=164520114&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 19 Nov 2014 18:20:50 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 907
Connection: keep-alive
..<html>.. <head>.. <script type="text/javascript"> </script>.. .. </head>.. <body>.. .. .. <center>.. <!-- BEGIN TAG - DO NOT MODIFY -->.. <script type="text/javascript">.. //<![CDATA[.. epom_key = "6c2c19aff050b202bf7c7970cb59cde3";.. epom_channel = "";.. epom_code_format = "ads";.. epom_ads_host = "//n20.adshostnet.com";.. epom_click = "";.. epom_custom_params = {};.. epom_width = "1200";.. epom_height = "1400";.. document.write("<script type='text\/javascript' src='" (location.protocol == 'https:' ? 'https:' : 'http:') "//n20.adshostnet.com\/js/show_ads.js'><\/script>");.. //]]>.. </script>.. <!-- END TAG -->.. </center>.. </body>..</html>HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html; charset=utf-8..Date: Wed, 19 Nov 2014 18:20:50 GMT..Server: Microsoft-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Powered-By: ASP.NET..Content-Length: 907..Connection: keep-alive....<html>.. <head>.. <script type="text/javascript"> </script>.. .. </head>.. <body>.. .. .. <center>.. <!-- BEGIN TAG - DO NOT MODIFY -->.. <script type=
<<< skipped >>>
GET /installer/GetTrackAVs?avs=0&reqid=164520114 HTTP/1.0
Host: smartinstaller.elasticbeanstalk.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 500 Internal Server Error
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 19 Nov 2014 18:20:46 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 2618
Connection: Close
<!DOCTYPE html>..<html lang="en">.. <head>.. <meta charset="utf-8" />.. <title>Error - My ASP.NET MVC Application</title>.. <link href="/Content/Site.css" rel="stylesheet" type="text/css" />.. <link href="/Content/themes/base/jquery.ui.all.css" rel="stylesheet" type="text/css" />.. <script src="/Scripts/jquery-1.6.2.min.js" type="text/javascript"></script>.. <script src="/Scripts/jquery-ui-1.8.11.js" type="text/javascript"></script>.. <script src="/Scripts/modernizr-2.0.6-development-only.js" type="text/javascript"></script>.. <script src="/Scripts/AjaxLogin.js" type="text/javascript"></script>.. <meta name="viewport" content="width=device-width">.. </head>.. <body>.. <header>.. <div class="content-wrapper">.. <div class="float-left">.. <p class="site-title"><a href="/">your logo here.</a></p>.. </div>.. <div class="float-right">.. <section id="login">.. <ul>.. <li><a data-dialog-title="Registration" href="/Account/Register" id="registerLink">Register</a></li>.. <li><a data-dialog-title="Identification" href="/Account/LogOn" id="logonLink">Log on</a></li>.. </ul>..
<<< skipped >>>
GET //offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0& HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: direct.the-apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 19 Nov 2014 18:20:31 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 8317
Connection: keep-alive
.<html>. <head>. . <style type="text/css">. .ui-progressbar-value { background-image: url(images/pbar-ani.gif); }. </style>. . <link type="text/css" href="hXXp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css" rel="stylesheet" />. <link href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css" rel="stylesheet" type="text/css" />. <script type="text/javascript" src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js"></script>. <script type="text/javascript" src="hXXp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js"></script>.. <title>2 - NonProduct (Free EPS Viewer)</title><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]);.. _gaq.push(['_trackPageview']);.. (function() {.. var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.. ga.src = ('https:' == document.location.protocol ? 'hXXps://' : 'hXXp://') 'stats.g.doubleclick.net/dc.js';.. var s = document.getElementsByTagName('script')[0]; s.parentNode.insertB
<<< skipped >>>
GET //offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0& HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: direct.the-apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 19 Nov 2014 18:20:49 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 7038
Connection: keep-alive
<html>. <head>. <title>4 - NonProduct (Free EPS Viewer)</title><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]);.. _gaq.push(['_trackPageview']);.. (function() {.. var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.. ga.src = ('https:' == document.location.protocol ? 'hXXps://' : 'hXXp://') 'stats.g.doubleclick.net/dc.js';.. var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.. })();</script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px;} .divLeadpName { border-bottom-style:groove;border-bottom-width: thin; padding-left:61px; padding-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; width: 100%; background-color: #fff; ba} #divTop {display: none} #divMiddle {background-color: #efecec; height: 100%;} #middle {background-color: #fff;} .divOnNext { position:absolute; w
<<< skipped >>>
GET /Files//Setup_product_4031.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dl.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 19 Nov 2014 18:20:26 GMT
Content-Type: application/octet-stream
Content-Length: 11929876
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 30 Dec 2013 01:16:57 GMT
Accept-Ranges: bytes
ETag: "b45877d5fc4cf1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Wed, 26 Nov 2014 18:20:26 GMT
X-Cache: MISS
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C....{...{...{.......{...)n..{....i..{....n.S{....y..{...{...y....`..z...)~..{....{..{..Rich.{..........PE..L......P..........................................@.......................................@..................................0..,...................................................................H...@....................#.......................text............................... ..`.rdata...f.......h..................@..@.data...d....`...0...>..............@....rsrc................n..............@..@.reloc...U.......V..................@..B........................................................................................................................................................................................................................................................................................................................................................U...E.VW.u....u..M..u..~(........~(_^]...U........SV3.W..9u..........u/.O43.C._(;.t....P..w(......E..09w(................u ......3...L$..O4C._(.D$.;.t....T$.R.P..w(....Fu.3.C..._(......E.. ...(......u.3.CP..._(......M........u..O43.C._(;.t..u....P4..3._^[..]...j..<wL.......].3....E..{..u......s..K....E...s...,.M....C. C.P.C. C.P.s.V......6.3..4.M..M.....n......j..S.L.......}.W......E......E..G$LKN.3...< N..G$L N.._,.G0._4.G8.._<._@._D._H.E..._L._P._T.E...Od..Ol..wt.GX.._\.G`.._h.Gp.._q._r.=?...E
<<< skipped >>>
Map
The MemScan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1612:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe /PID=707 /SUBPID=0 /DISTID=4235 /NETWORKID=1 /CID=0 /PRODUCT_ID=4031 /SERVER_URL=hXXp://installer.apps-track.com /CLICKID= /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=5 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=2
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe /PID=707 /SUBPID=0 /DISTID=4235 /NETWORKID=1 /CID=0 /PRODUCT_ID=4031 /SERVER_URL=hXXp://installer.apps-track.com /CLICKID= /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=5 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=2
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv7E.tmp\Convert.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv7E.tmp\Convert.dll
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
Convert.dll
Convert.dll
> >$>(>,>
> >$>(>,>
2 2$2(2,2
2 2$2(2,2
1,2024282
1,2024282
? ?$?(?0?4?@?`?
? ?$?(?0?4?@?`?
operator
operator
GetProcessWindowStation
GetProcessWindowStation
portuguese-brazilian
portuguese-brazilian
Visual C CRT: Not enough memory to complete call to strerror.
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
9#gyI%S
9#gyI%S
.MGV1'
.MGV1'
zDs.DhLA
zDs.DhLA
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsAVG3rs.dat
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsAVG3rs.dat
instructionsAVG3rs.dat
instructionsAVG3rs.dat
INSTRU~1.DAT
INSTRU~1.DAT
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv7E.tmp
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv7E.tmp
c:\%original file name%.exe
c:\%original file name%.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
%original file name%.exe
%original file name%.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7D.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7D.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv7E.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv7E.tmp
hXXp://installer.apps-track.com
hXXp://installer.apps-track.com
/PID=707 /SUBPID=0 /DISTID=4235 /NETWORKID=1 /CID=0 /PRODUCT_ID=4031 /SERVER_URL=hXXp://installer.apps-track.com /CLICKID= /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=5 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=2
/PID=707 /SUBPID=0 /DISTID=4235 /NETWORKID=1 /CID=0 /PRODUCT_ID=4031 /SERVER_URL=hXXp://installer.apps-track.com /CLICKID= /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=5 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=2
Nullsoft Install System v2.46
Nullsoft Install System v2.46
1.0.0.1
1.0.0.1
convert.dll
convert.dll
1.0.0.2
1.0.0.2
WUSER32.DLL
WUSER32.DLL
- floating point support not loaded
- floating point support not loaded
f.exe_1604:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
spKey
spKey
szKey
szKey
keyCur
keyCur
hKey
hKey
cSubKeys
cSubKeys
cmdline
cmdline
urlStr
urlStr
wurl
wurl
bstrLicKey
bstrLicKey
cchLicKey
cchLicKey
nMsg
nMsg
vurl
vurl
bstrURLOut
bstrURLOut
rtExecmd
rtExecmd
rtExeurl
rtExeurl
reportURL
reportURL
zErrMsg
zErrMsg
compiledSql
compiledSql
sqliteCookieFiles
sqliteCookieFiles
htmlDecodedUrlValue
htmlDecodedUrlValue
endParamKeys
endParamKeys
dynamicProductKeys
dynamicProductKeys
wUrlQS
wUrlQS
wUrl
wUrl
sqliteHistoryFiles
sqliteHistoryFiles
readDownloadUrl
readDownloadUrl
searchUrl
searchUrl
finishUrlForOuterInstaller
finishUrlForOuterInstaller
reportUrl
reportUrl
httpResponse
httpResponse
fullCmd
fullCmd
subkey
subkey
hostBrwCmd
hostBrwCmd
tyUrl
tyUrl
baseKeys
baseKeys
cmdLineW
cmdLineW
cmdW
cmdW
exeUrlW
exeUrlW
urlW
urlW
cmdLine
cmdLine
exeUrl
exeUrl
cbMaxSubKey
cbMaxSubKey
achKey
achKey
offersMainUrl
offersMainUrl
antivirusesRegKeys64Arr
antivirusesRegKeys64Arr
antivirusesRegKeys32Arr
antivirusesRegKeys32Arr
reg64Key
reg64Key
postExe
postExe
preExe
preExe
regKey
regKey
offerUrl
offerUrl
regKey64
regKey64
cbSubKeys
cbSubKeys
zMsg
zMsg
nCellKey
nCellKey
nMaxKey
nMaxKey
nMinKey
nMinKey
nKey
nKey
zErrmsg
zErrmsg
keyInfo
keyInfo
errMsg
errMsg
t.hx3S
t.hx3S
osCmd
osCmd
finalExePath
finalExePath
urlComp
urlComp
szURLPath
szURLPath
xSSSh
xSSSh
FTPjKS
FTPjKS
FtPj;S
FtPj;S
C.PjRV
C.PjRV
RegDeleteKeyExW
RegDeleteKeyExW
RegDeleteKeyTransactedW
RegDeleteKeyTransactedW
RegCreateKeyTransactedW
RegCreateKeyTransactedW
RegOpenKeyTransactedW
RegOpenKeyTransactedW
.vector too long
.vector too long
X:X:X:X:X:X
X:X:X:X:X:X
\Google\Chrome\Application\chrome.exe
\Google\Chrome\Application\chrome.exe
%d/%d/%d %d:%d:%d
%d/%d/%d %d:%d:%d
3.7.16.2
3.7.16.2
SQLite format 3
SQLite format 3
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
CREATE TEMP TABLE sqlite_temp_master(
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
\obhhelper.txt
\obhhelper.txt
Error %u in WinHttpQueryDataAvailable.
Error %u in WinHttpQueryDataAvailable.
Error %u in WinHttpReadData.
Error %u in WinHttpReadData.
Error %d has occurred.
Error %d has occurred.
F%D,3
F%D,3
Run-Time Check Failure #%d - %s
Run-Time Check Failure #%d - %s
%s%s%s%s
%s%s%s%s
%s%s%p%s%ld%s%d%s
%s%s%p%s%ld%s%d%s
Visual C CRT: Not enough memory to complete call to strerror.
Visual C CRT: Not enough memory to complete call to strerror.
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
portuguese-brazilian
portuguese-brazilian
operator
operator
GetProcessWindowStation
GetProcessWindowStation
WinHttpCloseHandle
WinHttpCloseHandle
WinHttpReadData
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSendRequest
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpConnect
WinHttpCrackUrl
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpSetTimeouts
WinHttpOpen
WinHttpOpen
WinHttpQueryHeaders
WinHttpQueryHeaders
WINHTTP.dll
WINHTTP.dll
PSAPI.DLL
PSAPI.DLL
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
EnumChildWindows
EnumChildWindows
CreateDialogIndirectParamW
CreateDialogIndirectParamW
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegDeleteKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
URLDownloadToFileW
URLDownloadToFileW
urlmon.dll
urlmon.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
GetCPInfo
GetCPInfo
.?AV?$CAtlExeModuleT@VCSmartInstallerModule@@@ATL@@
.?AV?$CAtlExeModuleT@VCSmartInstallerModule@@@ATL@@
SQLITE_
SQLITE_
d-d-d d:d:d
d-d-d d:d:d
d:d:d
d:d:d
d-d-d
d-d-d
failed to allocate %u bytes of memory
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
failed memory resize %u to %u bytes
922337203685477580
922337203685477580
API call with %s database connection pointer
API call with %s database connection pointer
RowKey
RowKey
OsError 0x%x (%u)
OsError 0x%x (%u)
os_win.c:%d: (%d) %s(%s) - %s
os_win.c:%d: (%d) %s(%s) - %s
delayed %dms for lock/sharing conflict
delayed %dms for lock/sharing conflict
%s-shm
%s-shm
%s\etilqs_
%s\etilqs_
%s\%s
%s\%s
Recovered %d frames from WAL file %s
Recovered %d frames from WAL file %s
cannot limit WAL size: %s
cannot limit WAL size: %s
invalid page number %d
invalid page number %d
2nd reference to page %d
2nd reference to page %d
Failed to read ptrmap key=%d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
%d of %d pages missing from overflow list starting at %d
failed to get page %d
failed to get page %d
freelist leaf count too big on page %d
freelist leaf count too big on page %d
Page %d:
Page %d:
unable to get the page. error code=%d
unable to get the page. error code=%d
btreeInitPage() returns error code %d
btreeInitPage() returns error code %d
On tree page %d cell %d:
On tree page %d cell %d:
On page %d at right child:
On page %d at right child:
Corruption detected in cell %d on page %d
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Multiple uses for byte %d of page %d
Fragmentation of %d bytes reported as %d on page %d
Fragmentation of %d bytes reported as %d on page %d
Page %d is never used
Page %d is never used
Pointer map page %d is referenced
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
Outstanding page count goes from %d to %d during this analysis
unknown database %s
unknown database %s
keyinfo(%d
keyinfo(%d
%s(%d)
%s(%d)
%s-mjXXXXXX9XXz
%s-mjXXXXXX9XXz
MJ delete: %s
MJ delete: %s
MJ collide: %s
MJ collide: %s
-mjX9X
-mjX9X
foreign key constraint failed
foreign key constraint failed
unable to use function %s in the requested context
unable to use function %s in the requested context
bind on a busy prepared statement: [%s]
bind on a busy prepared statement: [%s]
zeroblob(%d)
zeroblob(%d)
abort at %d in [%s]: %s
abort at %d in [%s]: %s
constraint failed at %d in [%s]
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
no such savepoint: %s
no such savepoint: %s
cannot release savepoint - SQL statements in progress
cannot release savepoint - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_temp_master
sqlite_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
cannot change %s wal mode from within a transaction
database table is locked: %s
database table is locked: %s
statement aborts at %d: [%s] %s
statement aborts at %d: [%s] %s
cannot open value of type %s
cannot open value of type %s
cannot open virtual table: %s
cannot open virtual table: %s
cannot open view: %s
cannot open view: %s
no such column: "%s"
no such column: "%s"
foreign key
foreign key
indexed
indexed
cannot open %s column for writing
cannot open %s column for writing
misuse of aliased aggregate %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s.%s
%s: %s.%s
%s: %s.%s
%s: %s
%s: %s
not authorized to use function: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
too many SQL variables
too many SQL variables
too many columns in %s
too many columns in %s
EXECUTE %s%s SUBQUERY %d
EXECUTE %s%s SUBQUERY %d
misuse of aggregate: %s()
misuse of aggregate: %s()
%.*s"%w"%s
%.*s"%w"%s
%s%.*s"%w"
%s%.*s"%w"
sqlite_rename_table
sqlite_rename_table
sqlite_rename_trigger
sqlite_rename_trigger
sqlite_rename_parent
sqlite_rename_parent
%s OR name=%Q
%s OR name=%Q
type='trigger' AND (%s)
type='trigger' AND (%s)
sqlite_
sqlite_
table %s may not be altered
table %s may not be altered
there is already another table or index with this name: %s
there is already another table or index with this name: %s
view %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
sqlite_sequence
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_altertab_%s
sqlite_stat1
sqlite_stat1
CREATE TABLE %Q.%s(%s)
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE %s=%Q
DELETE FROM %Q.%s WHERE %s=%Q
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
invalid name: "%s"
invalid name: "%s"
too many attached databases - max %d
too many attached databases - max %d
database %s is already in use
database %s is already in use
unable to open database: %s
unable to open database: %s
no such database: %s
no such database: %s
cannot detach database %s
cannot detach database %s
database %s is locked
database %s is locked
sqlite_detach
sqlite_detach
sqlite_attach
sqlite_attach
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
object name reserved for internal use: %s
there is already an index named %s
there is already an index named %s
too many columns on %s
too many columns on %s
duplicate column name: %s
duplicate column name: %s
default value of column [%s] is not constant
default value of column [%s] is not constant
table "%s" has more than one primary key
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
CREATE %s %.*s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
sqlite_stat%d
sqlite_stat%d
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
sqlite_stat
sqlite_stat
table %s may not be dropped
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
indexed columns are not unique
indexed columns are not unique
table %s may not be indexed
table %s may not be indexed
views may not be indexed
views may not be indexed
virtual tables may not be indexed
virtual tables may not be indexed
there is already a table named %s
there is already a table named %s
index %s already exists
index %s already exists
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
table %s has no column named %s
table %s has no column named %s
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
a JOIN clause is required before %s
a JOIN clause is required before %s
unable to identify the object to be reindexed
unable to identify the object to be reindexed
no such collation sequence: %s
no such collation sequence: %s
table %s may not be modified
table %s may not be modified
cannot modify %s because it is a view
cannot modify %s because it is a view
sqlite_version
sqlite_version
sqlite_source_id
sqlite_source_id
sqlite_log
sqlite_log
sqlite_compileoption_used
sqlite_compileoption_used
sqlite_compileoption_get
sqlite_compileoption_get
foreign key mismatch - "%w" referencing "%w"
foreign key mismatch - "%w" referencing "%w"
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
%d values for %d columns
%d values for %d columns
table %S has no column named %s
table %S has no column named %s
%s.%s may not be NULL
%s.%s may not be NULL
constraint %s failed
constraint %s failed
PRIMARY KEY must be unique
PRIMARY KEY must be unique
sqlite3_extension_init
sqlite3_extension_init
unable to open shared library [%s]
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
error during initialization: %s
automatic extension loading failed: %s
automatic extension loading failed: %s
foreign_keys
foreign_keys
foreign_key_list
foreign_key_list
foreign_key_check
foreign_key_check
*** in database %s ***
*** in database %s ***
unsupported encoding: %s
unsupported encoding: %s
malformed database schema (%s)
malformed database schema (%s)
%s - %s
%s - %s
unsupported file format
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
database schema is locked: %s
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
USE TEMP B-TREE FOR %s
USE TEMP B-TREE FOR %s
COMPOUND SUBQUERIES %d AND %d %s(%s)
COMPOUND SUBQUERIES %d AND %d %s(%s)
%s.%s
%s.%s
%s:%d
%s:%d
ORDER BY clause should come after %s not before
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
no such index: %s
sqlite_subquery_%p_
sqlite_subquery_%p_
too many references to "%s": max 65535
too many references to "%s": max 65535
%s.%s.%s
%s.%s.%s
no such table: %s
no such table: %s
SCAN TABLE %s %s%s(~%d rows)
SCAN TABLE %s %s%s(~%d rows)
sqlite3_get_table() called with two or more incompatible queries
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such trigger: %S
-- TRIGGER %s
-- TRIGGER %s
no such column: %s
no such column: %s
cannot VACUUM - SQL statements in progress
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor failed: %s
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
no such module: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
%s SUBQUERY %d
%s SUBQUERY %d
%s TABLE %s
%s TABLE %s
%s AS %s
%s AS %s
%s USING %s%sINDEX%s%s%s
%s USING %s%sINDEX%s%s%s
%s USING INTEGER PRIMARY KEY
%s USING INTEGER PRIMARY KEY
%s (rowid=?)
%s (rowid=?)
%s (rowid>? AND rowid)
%s (rowid>? AND rowid)
%s (rowid>?)
%s (rowid>?)
%s (rowid)
%s (rowid)
%s VIRTUAL TABLE INDEX %d:%s
%s VIRTUAL TABLE INDEX %d:%s
%s (~%lld rows)
%s (~%lld rows)
at most %d tables in a join
at most %d tables in a join
cannot use index: %s
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
SQL logic error or missing database
SQL logic error or missing database
unknown operation
unknown operation
large file support is disabled
large file support is disabled
unknown database: %s
unknown database: %s
no such %s mode: %s
no such %s mode: %s
%s mode not allowed: %s
%s mode not allowed: %s
no such vfs: %s
no such vfs: %s
database corruption at line %d of [%.10s]
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
cannot open file at line %d of [%.10s]
.?AVCWebPage@@
.?AVCWebPage@@
zcÃ
zcÃ
{A0386B19-B7E7-4BE7-B567-ABF77CBB6E60} = s `ATLExeServer'
{A0386B19-B7E7-4BE7-B567-ABF77CBB6E60} = s `ATLExeServer'
`ATLExeServer.EXE'
`ATLExeServer.EXE'
val AppID = s {A0386B19-B7E7-4BE7-B567-ABF77CBB6E60}
val AppID = s {A0386B19-B7E7-4BE7-B567-ABF77CBB6E60}
ForceRemove {FA20B59B-21AA-44FC-8A68-450979B7CC90} = s 'CBrowserExternals Class'
ForceRemove {FA20B59B-21AA-44FC-8A68-450979B7CC90} = s 'CBrowserExternals Class'
val ServerExecutable = s '%MODULE_RAW%'
val ServerExecutable = s '%MODULE_RAW%'
TypeLib = s '{03771AEF-400D-4A13-B712-25878EC4A3F5}'
TypeLib = s '{03771AEF-400D-4A13-B712-25878EC4A3F5}'
ForceRemove {622D38AD-B4A9-4170-8192-5B865C6A5DCE} = s 'CBrowserExternalImp Class'
ForceRemove {622D38AD-B4A9-4170-8192-5B865C6A5DCE} = s 'CBrowserExternalImp Class'
ForceRemove {6D4506CE-F855-4657-AA38-DB6B1F733982} = s 'CBrowserExternal Class'
ForceRemove {6D4506CE-F855-4657-AA38-DB6B1F733982} = s 'CBrowserExternal Class'
stdole2.tlbWWW
stdole2.tlbWWW
~cmdWd
~cmdWd
OpenUrlW
OpenUrlW
urlWd
urlWd
method OpenUrl
method OpenUrl
Created by MIDL version 7.00.0555 at Thu Mar 13 16:11:05 2014
Created by MIDL version 7.00.0555 at Thu Mar 13 16:11:05 2014
Red
Red
Green
Green
Blue
Blue
3%3u3
3%3u3
=0>4>8>
=0>4>8>
9%9 9;9]9
9%9 9;9]9
6i6C6t9
6i6C6t9
7$8(8,808
7$8(8,808
5$8(8,80848
5$8(8,80848
4"4&4*4.42464:4
4"4&4*4.42464:4
:?
:?
5 5
5 5
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
WAdvapi32.dll
WAdvapi32.dll
SERVER_URL
SERVER_URL
EXE_URL
EXE_URL
EXE_CMDLINE
EXE_CMDLINE
THANKYOU_URL
THANKYOU_URL
exeurl
exeurl
execmdline
execmdline
Exception opening/reading chrome cookies
Exception opening/reading chrome cookies
Exception opening/reading opera cookies
Exception opening/reading opera cookies
a\Microsoft\Windows\Cookies
a\Microsoft\Windows\Cookies
a\Mozilla\Firefox\Profiles
a\Mozilla\Firefox\Profiles
\Mozilla\Firefox\Profiles
\Mozilla\Firefox\Profiles
sqlite
sqlite
cookies.sqlite
cookies.sqlite
Chrome_WidgetWin_1
Chrome_WidgetWin_1
a\Opera\Opera\
a\Opera\Opera\
\..\Local\Google\Chrome\User Data\Default\
\..\Local\Google\Chrome\User Data\Default\
\..\Local Settings\Application Data\Google\Chrome\User Data\Default\
\..\Local Settings\Application Data\Google\Chrome\User Data\Default\
cookies4.dat
cookies4.dat
SELECT value,last_access_utc FROM cookies WHERE host_key LIKE '%
SELECT value,last_access_utc FROM cookies WHERE host_key LIKE '%
Found cookie in Chrome!
Found cookie in Chrome!
\..\..\Local Settings\Application Data\Opera\Opera\
\..\..\Local Settings\Application Data\Opera\Opera\
Found cookie in Opera!
Found cookie in Opera!
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
OLEACC.DLL
OLEACC.DLL
places.sqlite
places.sqlite
SELECT url FROM moz_places WHERE url LIKE '%
SELECT url FROM moz_places WHERE url LIKE '%
Found history in Chrome!
Found history in Chrome!
SELECT urls.url FROM urls WHERE urls.url LIKE '%
SELECT urls.url FROM urls WHERE urls.url LIKE '%
\PreExe_ID_
\PreExe_ID_
\default.html
\default.html
CHROMEVERSION
CHROMEVERSION
&chromev=
&chromev=
SOFTWARE\Microsoft\.NETFramework\policy
SOFTWARE\Microsoft\.NETFramework\policy
firefox
firefox
chrome
chrome
opera
opera
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice
ChromeHTML
ChromeHTML
FirefoxHTML
FirefoxHTML
IE.AssocFile.HTM
IE.AssocFile.HTM
Opera.HTML
Opera.HTML
http\shell\open\command
http\shell\open\command
Opera.exe
Opera.exe
Safari.exe
Safari.exe
\PostCheck.exe
\PostCheck.exe
SOFTWARE\Mozilla\Mozilla FireFox
SOFTWARE\Mozilla\Mozilla FireFox
Software\Mozilla\Mozilla FireFox
Software\Mozilla\Mozilla FireFox
SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
aSoftware\Mozilla\Mozilla Firefox
aSoftware\Mozilla\Mozilla Firefox
*.txt
*.txt
@@exeurl
@@exeurl
OfferURL
OfferURL
ExeURL
ExeURL
RegKey
RegKey
ReportName
ReportName
PreExe
PreExe
PostExe
PostExe
RegKey64
RegKey64
AntivirusesRegKeys
AntivirusesRegKeys
RegKey32
RegKey32
Mscoree.dll
Mscoree.dll
OLEAUT32.DLL
OLEAUT32.DLL
{A33DE4AA-9646-4E33-9E44-E472C6312E2F}
{A33DE4AA-9646-4E33-9E44-E472C6312E2F}
888816666554443
888816666554443
6666554443
6666554443
!6666554443
!6666554443
VirtualOfferCmd:
VirtualOfferCmd:
VirtualOfferCmd
VirtualOfferCmd
/REPORTURL=
/REPORTURL=
\obhhelper.txt
\obhhelper.txt
NMozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
NMozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
user32.dll
user32.dll
mscoree.dll
mscoree.dll
SKERNEL32.DLL
SKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
MSPDB100.DLL
MSPDB100.DLL
ADVAPI32.DLL
ADVAPI32.DLL
WUSER32.DLL
WUSER32.DLL
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe
{8856F961-340A-11D0-A96B-00C04FD705A2}
{8856F961-340A-11D0-A96B-00C04FD705A2}
4.0.0.3
4.0.0.3
setup.exe
setup.exe
4.0.0.1
4.0.0.1
6_Offer_11.exe_1272:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
u}SSh
u}SSh
PSShG
PSShG
8%uPP3
8%uPP3
t%FVh
t%FVh
t.Shh
t.Shh
u!SSh
u!SSh
RSShd
RSShd
RSShp
RSShp
vSSSh
vSSSh
FTPjK
FTPjK
FtPj;
FtPj;
C.PjRV
C.PjRV
tGHt.Ht&
tGHt.Ht&
msi.dll
msi.dll
gdiplus.dll
gdiplus.dll
kernel32.dll
kernel32.dll
UxTheme.dll
UxTheme.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
portuguese-brazilian
portuguese-brazilian
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
WININET.dll
WININET.dll
dwmapi.dll
dwmapi.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
F%D,3
F%D,3
ATTRIB -r "%s"
ATTRIB -r "%s"
rd "%s"
rd "%s"
if exist "%s" goto try
if exist "%s" goto try
del "%s" | cls
del "%s" | cls
del "%s"
del "%s"
FLT_DENORMAL_OPERAND
FLT_DENORMAL_OPERAND
FLT_INVALID_OPERATION
FLT_INVALID_OPERATION
Dbghelp.dll
Dbghelp.dll
[SystemFolder]msi.dll
[SystemFolder]msi.dll
URL=%s
URL=%s
FtpCommandW
FtpCommandW
FtpGetFileSize
FtpGetFileSize
D:\BranchAI\win\Release\stubs\x86u\ExternalUi.pdb
D:\BranchAI\win\Release\stubs\x86u\ExternalUi.pdb
GdiplusShutdown
GdiplusShutdown
GdipSetImageAttributesColorKeys
GdipSetImageAttributesColorKeys
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpOpenFileW
FtpOpenFileW
FtpFindFirstFileW
FtpFindFirstFileW
InternetCrackUrlW
InternetCrackUrlW
KERNEL32.dll
KERNEL32.dll
GetAsyncKeyState
GetAsyncKeyState
GetKeyState
GetKeyState
USER32.dll
USER32.dll
SetViewportOrgEx
SetViewportOrgEx
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
dbghelp.dll
dbghelp.dll
SHLWAPI.dll
SHLWAPI.dll
COMCTL32.dll
COMCTL32.dll
MSIMG32.dll
MSIMG32.dll
VERSION.dll
VERSION.dll
NETAPI32.dll
NETAPI32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateNamedPipeW
CreateNamedPipeW
ConnectNamedPipe
ConnectNamedPipe
PeekNamedPipe
PeekNamedPipe
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
ExitWindowsEx
ExitWindowsEx
COMDLG32.dll
COMDLG32.dll
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyW
RegOpenKeyW
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyA
zcÃ
zcÃ
cz">%U
cz">%U
cRtV
cRtV
{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\lang1033\f0\fs20\par
{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\lang1033\f0\fs20\par
{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\f0\fs20 EULA\par
{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\f0\fs20 EULA\par
43333333333333333
43333333333333333
3334445558;;>>?
3334445558;;>>?
"999500>
"999500>
"999550-]
"999550-]
true
true
4#656[6`6
4#656[6`6
9%9S9X9h9
9%9S9X9h9
4I4F4c4
4I4F4c4
7!7)7/7:7
7!7)7/7:7
7%7S7w7
7%7S7w7
9$:(:,:0:
9$:(:,:0:
04080
04080
8 8$8(8,8084888
8 8$8(8,8084888
5$8(8,8084888
5$8(8,8084888
X:\:`:d:h:l:p:
X:\:`:d:h:l:p:
$0(0,000
$0(0,000
5 5$5(5,5054585
5 5$5(5,5054585
0 1$1(1,1
0 1$1(1,1
014181
014181
?(?0?\?
?(?0?\?
;$;,;4;@;
;$;,;4;@;
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
O\\?\
O\\?\
WindowsBuild
WindowsBuild
AUxTheme.dll
AUxTheme.dll
comctl32.dll
comctl32.dll
@cmdlinkarrow
@cmdlinkarrow
@uxtheme.dll
@uxtheme.dll
0123456789
0123456789
hXXp://
hXXp://
AppEvents\Schemes\Apps\Explorer\Navigating\.Current
AppEvents\Schemes\Apps\Explorer\Navigating\.Current
Caphyon.AI.ExtUI.IEClickSoundRemover
Caphyon.AI.ExtUI.IEClickSoundRemover
{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}
{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}
Windows
Windows
FOLDERID_Windows
FOLDERID_Windows
{F38BF404-1D43-42F2-9305-67DE0B28FC23}
{F38BF404-1D43-42F2-9305-67DE0B28FC23}
{18989B1D-99B5-455B-841C-AB7C74E4DDFC}
{18989B1D-99B5-455B-841C-AB7C74E4DDFC}
{A63293E8-664E-48DB-A079-DF759E0509F7}
{A63293E8-664E-48DB-A079-DF759E0509F7}
{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}
{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}
{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}
{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}
{B97D20BB-F46A-4C97-BA10-5E3608430854}
{B97D20BB-F46A-4C97-BA10-5E3608430854}
{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}
{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}
{8983036C-27C0-404B-8F08-102D10DCFD74}
{8983036C-27C0-404B-8F08-102D10DCFD74}
{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
{8AD10C31-2ADB-4296-A8F7-E4701232C972}
{8AD10C31-2ADB-4296-A8F7-E4701232C972}
{AE50C081-EBD2-438A-8655-8A092E34987A}
{AE50C081-EBD2-438A-8655-8A092E34987A}
{2400183A-6185-49FB-A2D8-4A392A602BA3}
{2400183A-6185-49FB-A2D8-4A392A602BA3}
{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}
{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}
{3214FAB5-9757-4298-BB61-92A9DEAA44FF}
{3214FAB5-9757-4298-BB61-92A9DEAA44FF}
{ED4824AF-DCE4-45A8-81E2-FC7965083634}
{ED4824AF-DCE4-45A8-81E2-FC7965083634}
{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}
{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}
{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}
{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}
{DE974D24-D9C6-4D3E-BF91-F4455120B917}
{DE974D24-D9C6-4D3E-BF91-F4455120B917}
{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}
{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}
{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}
{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}
{905e63b6-c1bf-494e-b29c-65b732d3d21a}
{905e63b6-c1bf-494e-b29c-65b732d3d21a}
{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}
{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}
{5E6C858F-0E22-4760-9AFE-EA3317B67173}
{5E6C858F-0E22-4760-9AFE-EA3317B67173}
{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}
{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}
{33E28130-4E1E-4676-835A-98395C3BC3BB}
{33E28130-4E1E-4676-835A-98395C3BC3BB}
{C5ABBF53-E17F-4121-8900-86626FC2C973}
{C5ABBF53-E17F-4121-8900-86626FC2C973}
{4BD8D571-6D19-48D3-BE97-422220080E43}
{4BD8D571-6D19-48D3-BE97-422220080E43}
{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}
{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}
{352481E8-33BE-4251-BA85-6007CAEDCF9D}
{352481E8-33BE-4251-BA85-6007CAEDCF9D}
{D9DC8A3B-B784-432E-A781-5A1130A75963}
{D9DC8A3B-B784-432E-A781-5A1130A75963}
{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}
{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}
{1777F761-68AD-4D8A-87BD-30B759FA33DD}
{1777F761-68AD-4D8A-87BD-30B759FA33DD}
{FDD39AD0-238F-46AF-ADB4-6C85480369C7}
{FDD39AD0-238F-46AF-ADB4-6C85480369C7}
{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
{2B0F765D-C0E9-4171-908E-08A611B84FF6}
{2B0F765D-C0E9-4171-908E-08A611B84FF6}
{B94237E7-57AC-4347-9151-B08C6C32D1F7}
{B94237E7-57AC-4347-9151-B08C6C32D1F7}
{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}
{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}
{A4115719-D62E-491D-AA7C-E74B8BE3B067}
{A4115719-D62E-491D-AA7C-E74B8BE3B067}
{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}
{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}
{D0384E7D-BAC3-4797-8F14-CBA229B392B5}
{D0384E7D-BAC3-4797-8F14-CBA229B392B5}
{9E52AB10-F80D-49DF-ACB8-4330F5687855}
{9E52AB10-F80D-49DF-ACB8-4330F5687855}
{724EF170-A42D-4FEF-9F26-B60E846FBA4F}
{724EF170-A42D-4FEF-9F26-B60E846FBA4F}
:"/\|?*
:"/\|?*
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
RICHED20.DLL
RICHED20.DLL
/passive
/passive
Unable to start installation error code: %u
Unable to start installation error code: %u
oAI_MORE_CMD_LINE
oAI_MORE_CMD_LINE
..\core\ExceptionPresenter.cpp
..\core\ExceptionPresenter.cpp
..\core\ExceptionHandling.cpp
..\core\ExceptionHandling.cpp
C:\FAKE_DIR\
C:\FAKE_DIR\
\/:*?"|
\/:*?"|
Failed to get Windows error message [win32 error 0x
Failed to get Windows error message [win32 error 0x
EXCEPTION_CMD
EXCEPTION_CMD
Send Error Report
Send Error Report
/cmdloc
/cmdloc
Return code of msiexec.exe:
Return code of msiexec.exe:
Launching msiexec.exe with command line:
Launching msiexec.exe with command line:
Detected Windows Installer version:
Detected Windows Installer version:
Code returned to Windows by setup:
Code returned to Windows by setup:
User name and password for proxy server were received from command line and used.
User name and password for proxy server were received from command line and used.
Command line to pass to MSI:
Command line to pass to MSI:
"%s" %s
"%s" %s
TRANSFORMS=":%d"
TRANSFORMS=":%d"
TRANSFORMS="%s;%s\%d"
TRANSFORMS="%s;%s\%d"
TRANSFORMS="%s\%d"
TRANSFORMS="%s\%d"
TRANSFORMS="%s"
TRANSFORMS="%s"
%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s"
%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s"
EXE_CMD_LINE="%s "
EXE_CMD_LINE="%s "
[SystemFolder]msiexec.exe
[SystemFolder]msiexec.exe
%s=%i
%s=%i
Windows installer is inluded in package.
Windows installer is inluded in package.
%d.dll
%d.dll
%sholder%d.aiph
%sholder%d.aiph
%d-%s
%d-%s
Windows 2000
Windows 2000
Shlwapi.dll
Shlwapi.dll
Shell32.dll
Shell32.dll
%d.%d.%d.%d
%d.%d.%d.%d
\StringFileInfo\xx\%s
\StringFileInfo\xx\%s
%d %s
%d %s
%d.0%d %s
%d.0%d %s
%d.%d %s
%d.%d %s
Windows 8 x64
Windows 8 x64
Windows 8 x86
Windows 8 x86
Windows Server 2012 x64
Windows Server 2012 x64
Windows 7 x64 Service Pack 1
Windows 7 x64 Service Pack 1
Windows 7 x64
Windows 7 x64
Windows 7 x86 Service Pack 1
Windows 7 x86 Service Pack 1
Windows 7 x86
Windows 7 x86
Windows Server 2008 R2 x64 Service Pack 1
Windows Server 2008 R2 x64 Service Pack 1
Windows Server 2008 R2 x64
Windows Server 2008 R2 x64
Windows Vista x64 Service Pack 2
Windows Vista x64 Service Pack 2
Windows Vista x64 Service Pack 1
Windows Vista x64 Service Pack 1
Windows Vista x64
Windows Vista x64
Windows Vista x86 Service Pack 2
Windows Vista x86 Service Pack 2
Windows Vista x86 Service Pack 1
Windows Vista x86 Service Pack 1
Windows Vista x86
Windows Vista x86
Windows Server 2008 x64
Windows Server 2008 x64
Windows Server 2008 x86
Windows Server 2008 x86
Windows XP x64 Service Pack 2
Windows XP x64 Service Pack 2
Windows XP x64 Service Pack 1
Windows XP x64 Service Pack 1
Windows XP x64
Windows XP x64
Windows Server 2003 x64 Service Pack 2
Windows Server 2003 x64 Service Pack 2
Windows Server 2003 x64 Service Pack 1
Windows Server 2003 x64 Service Pack 1
Windows Server 2003 x64
Windows Server 2003 x64
Windows Server 2003 x86 Service Pack 2
Windows Server 2003 x86 Service Pack 2
Windows Server 2003 x86 Service Pack 1
Windows Server 2003 x86 Service Pack 1
Windows Server 2003 x86
Windows Server 2003 x86
Windows XP x86
Windows XP x86
Windows XP x86 Service Pack 3
Windows XP x86 Service Pack 3
Windows XP x86 Service Pack 2
Windows XP x86 Service Pack 2
Windows XP x86 Service Pack 1
Windows XP x86 Service Pack 1
Windows 2000 Service Pack 4
Windows 2000 Service Pack 4
Windows 2000 Service Pack 3
Windows 2000 Service Pack 3
Windows 2000 Service Pack 2
Windows 2000 Service Pack 2
Windows 2000 Service Pack 1
Windows 2000 Service Pack 1
Windows NT 4.0
Windows NT 4.0
Windows NT 4.0 Service Pack 6
Windows NT 4.0 Service Pack 6
Windows NT 4.0 Service Pack 5
Windows NT 4.0 Service Pack 5
Windows NT 4.0 Service Pack 4
Windows NT 4.0 Service Pack 4
Windows NT 4.0 Service Pack 3
Windows NT 4.0 Service Pack 3
Windows NT 4.0 Service Pack 2
Windows NT 4.0 Service Pack 2
Windows NT 4.0 Service Pack 1
Windows NT 4.0 Service Pack 1
Windows 95 OSR
Windows 95 OSR
Windows 95 OSR2.5
Windows 95 OSR2.5
Windows 95
Windows 95
Windows 98 SE
Windows 98 SE
Windows 98
Windows 98
Windows Millennium
Windows Millennium
{374DE290-123F-4565-9164-39C4925E467B}
{374DE290-123F-4565-9164-39C4925E467B}
Newer version is at a local URL.
Newer version is at a local URL.
/exenoupdates
/exenoupdates
hXXp://VVV.example.com
hXXp://VVV.example.com
hXXp://VVV.yahoo.com
hXXp://VVV.yahoo.com
hXXp://VVV.google.com
hXXp://VVV.google.com
Detected SQL Compact:
Detected SQL Compact:
Detected SQL Express:
Detected SQL Express:
Detected .NET:
Detected .NET:
HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\15.0\SharePoint
HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\15.0\SharePoint
HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\14.0\SharePoint
HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\14.0\SharePoint
HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\12.0\SharePoint
HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\12.0\SharePoint
Windows SharePoint Services 3.0 or Microsoft Office SharePoint Server 2007
Windows SharePoint Services 3.0 or Microsoft Office SharePoint Server 2007
Windows Mobile Device Center 6.1
Windows Mobile Device Center 6.1
Windows Mobile Device Center 6.0
Windows Mobile Device Center 6.0
HKLM\SOFTWARE\Microsoft\Windows CE Services\MinorVersion
HKLM\SOFTWARE\Microsoft\Windows CE Services\MinorVersion
HKLM\SOFTWARE\Microsoft\Windows CE Services\MajorVersion
HKLM\SOFTWARE\Microsoft\Windows CE Services\MajorVersion
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CEAPPMGR.EXE\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CEAPPMGR.EXE\
HKLM\Software\Microsoft\VSTO Runtime Setup\v9.0.21022\Install
HKLM\Software\Microsoft\VSTO Runtime Setup\v9.0.21022\Install
HKLM\Software\Microsoft\vsto runtime Setup\v2.0.50727\Install
HKLM\Software\Microsoft\vsto runtime Setup\v2.0.50727\Install
{64E2917E-AA13-4CA4-BFFE-EA6EDA3AFCB4}
{64E2917E-AA13-4CA4-BFFE-EA6EDA3AFCB4}
{FAB10E66-B22C-4274-8647-7CA1BA5EF30F}
{FAB10E66-B22C-4274-8647-7CA1BA5EF30F}
{7102C98C-EF47-4F04-A227-FE33650BF954}
{7102C98C-EF47-4F04-A227-FE33650BF954}
{011B9112-EBB1-4A6C-86CB-C2FDC9EA7B0E}
{011B9112-EBB1-4A6C-86CB-C2FDC9EA7B0E}
{B2279272-3FD2-434D-B94E-E4E0F8561AC4}
{B2279272-3FD2-434D-B94E-E4E0F8561AC4}
{8B74A499-37F8-4DEA-B5A0-D72FC501CEFA}
{8B74A499-37F8-4DEA-B5A0-D72FC501CEFA}
{3EA123B5-6316-452E-9D51-A489E06E2347}
{3EA123B5-6316-452E-9D51-A489E06E2347}
{EECBA6B8-3A62-44AD-99EB-8666265466F9}
{EECBA6B8-3A62-44AD-99EB-8666265466F9}
{1D844339-3DAE-413E-BC13-62D6A52816B2}
{1D844339-3DAE-413E-BC13-62D6A52816B2}
{4153F732-D670-4E44-8AB7-500F2B576BDA}
{4153F732-D670-4E44-8AB7-500F2B576BDA}
{EA7564AC-C67D-4868-BE5C-26E4FC2223FF}
{EA7564AC-C67D-4868-BE5C-26E4FC2223FF}
{957A4EC0-E67B-4E86-A383-6AF7270B216A}
{957A4EC0-E67B-4E86-A383-6AF7270B216A}
{00B41853-4377-4AD8-AD44-8404E0D331EC}
{00B41853-4377-4AD8-AD44-8404E0D331EC}
{580CB155-841D-4D48-9F59-866A035C2241}
{580CB155-841D-4D48-9F59-866A035C2241}
{816D4DFD-FF7B-4C16-8943-EEB07DF989CB}
{816D4DFD-FF7B-4C16-8943-EEB07DF989CB}
{C1F1028F-D91A-43E8-A117-4F7CAFD7A041}
{C1F1028F-D91A-43E8-A117-4F7CAFD7A041}
{04E73476-518E-4B6A-8E10-021A00078847}
{04E73476-518E-4B6A-8E10-021A00078847}
{ED569DB3-58C4-4463-971F-4AAABB6440BD}
{ED569DB3-58C4-4463-971F-4AAABB6440BD}
{F1B5AE30-CB00-4DCF-978B-07D33B034ADB}
{F1B5AE30-CB00-4DCF-978B-07D33B034ADB}
{1ABEAF09-435F-47D6-9FEB-0AD05D4EF3EA}
{1ABEAF09-435F-47D6-9FEB-0AD05D4EF3EA}
{53C65973-D89D-4EA0-8567-8788C14E0A02}
{53C65973-D89D-4EA0-8567-8788C14E0A02}
{A58B51D1-89BF-4D88-939D-B6D0DB2EEB53}
{A58B51D1-89BF-4D88-939D-B6D0DB2EEB53}
{835AC3CE-E36B-4D65-B50F-2863A682ABEE}
{835AC3CE-E36B-4D65-B50F-2863A682ABEE}
{1C8772BD-6E6F-4C9D-8FF8-B5EA072F86EF}
{1C8772BD-6E6F-4C9D-8FF8-B5EA072F86EF}
{6F1AE751-4D8A-4B25-AC0A-C6CB912A9791}
{6F1AE751-4D8A-4B25-AC0A-C6CB912A9791}
{3F40FA9E-26CA-4CA2-93C9-603622349915}
{3F40FA9E-26CA-4CA2-93C9-603622349915}
{14D3E42A-A318-4D77-9895-A7EE585EFC3B}
{14D3E42A-A318-4D77-9895-A7EE585EFC3B}
{C1E59364-35F6-44B3-AF0F-FCA934C4B252}
{C1E59364-35F6-44B3-AF0F-FCA934C4B252}
{A1FE0698-609D-400F-BF10-F52238DD6475}
{A1FE0698-609D-400F-BF10-F52238DD6475}
6.01.7000.0000
6.01.7000.0000
6.00.6000.16386
6.00.6000.16386
4.09.00.0903
4.09.00.0903
4.09.00.0902
4.09.00.0902
4.09.00.0901
4.09.00.0901
4.09.00.0900
4.09.00.0900
4.08.02.0134
4.08.02.0134
4.08.01.0901
4.08.01.0901
4.08.01.0810
4.08.01.0810
4.08.00.0400
4.08.00.0400
4.07.01.3000
4.07.01.3000
4.07.00.0716
4.07.00.0716
4.07.00.0700
4.07.00.0700
SQL Server Compact 4.0
SQL Server Compact 4.0
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v4.0\ENU\DesktopRuntimeVersion
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v4.0\ENU\DesktopRuntimeVersion
SQL Server Compact 3.5 SP2
SQL Server Compact 3.5 SP2
SQL Server Compact 3.5 SP1
SQL Server Compact 3.5 SP1
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v3.5\ENU\DesktopRuntimeServicePackLevel
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v3.5\ENU\DesktopRuntimeServicePackLevel
SQL Server Compact 3.5
SQL Server Compact 3.5
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v3.5\ENU\DesktopRuntimeVersion
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v3.5\ENU\DesktopRuntimeVersion
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Native Client 11.0\CurrentVersion\Version
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Native Client 11.0\CurrentVersion\Version
SQL Server Express 2012
SQL Server Express 2012
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server 2012 Redist\SQLNCLI11\1033\CurrentVersion\Version
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server 2012 Redist\SQLNCLI11\1033\CurrentVersion\Version
SQL Server Express 2008 R2
SQL Server Express 2008 R2
SQL Server Express 2008 SP2
SQL Server Express 2008 SP2
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Native Client 10.0\CurrentVersion\Version
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Native Client 10.0\CurrentVersion\Version
SQL Server Express 2008 SP1
SQL Server Express 2008 SP1
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server 2008 Redist\SQLNCLI10\1033\CurrentVersion\Version
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server 2008 Redist\SQLNCLI10\1033\CurrentVersion\Version
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\SQLSERVER2008\MSSQLServer\CurrentVersion\CurrentVersion
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\SQLSERVER2008\MSSQLServer\CurrentVersion\CurrentVersion
SQL Server Express 2008
SQL Server Express 2008
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\SQLEXPRESS\MSSQLServer\CurrentVersion\CurrentVersion
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\SQLEXPRESS\MSSQLServer\CurrentVersion\CurrentVersion
9.00.5000
9.00.5000
SQL Server Express 2005 SP4
SQL Server Express 2005 SP4
9.00.4035
9.00.4035
SQL Server Express 2005 SP3
SQL Server Express 2005 SP3
9.00.3042
9.00.3042
SQL Server Express 2005 SP2
SQL Server Express 2005 SP2
9.00.2047
9.00.2047
SQL Server Express 2005 SP1
SQL Server Express 2005 SP1
SQL Server Express 2005
SQL Server Express 2005
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\90\Tools\ClientSetup\CurrentVersion\CurrentVersion
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\90\Tools\ClientSetup\CurrentVersion\CurrentVersion
HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727\Install
HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727\Install
HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322\Install
HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322\Install
3321-3705
3321-3705
HKLM\SOFTWARE\Microsoft\.NETFramework\policy\v1.0\3705
HKLM\SOFTWARE\Microsoft\.NETFramework\policy\v1.0\3705
Windows 9x/ME
Windows 9x/ME
Windows NT/2000/XP/Vista/Windows 7/Windows 8 x86
Windows NT/2000/XP/Vista/Windows 7/Windows 8 x86
Windows XP/Vista/Windows 7/Windows 8 x64
Windows XP/Vista/Windows 7/Windows 8 x64
[SystemFolder]wininet.dll
[SystemFolder]wininet.dll
[SystemFolder]inetsrv\inetinfo.exe
[SystemFolder]inetsrv\inetinfo.exe
[SystemFolder]inetsrv\w3wp.exe
[SystemFolder]inetsrv\w3wp.exe
[ProgramFilesFolder]Microsoft Office\Office14\vviewer.dll
[ProgramFilesFolder]Microsoft Office\Office14\vviewer.dll
[ProgramFiles64Folder]Microsoft Office\Office14\vviewer.dll
[ProgramFiles64Folder]Microsoft Office\Office14\vviewer.dll
[ProgramFilesFolder]Microsoft Office\Office15\vviewer.dll
[ProgramFilesFolder]Microsoft Office\Office15\vviewer.dll
[ProgramFiles64Folder]Microsoft Office\Office15\vviewer.dll
[ProgramFiles64Folder]Microsoft Office\Office15\vviewer.dll
[ProgramFilesFolder]Microsoft Office\Office15\lync.exe
[ProgramFilesFolder]Microsoft Office\Office15\lync.exe
[ProgramFiles64Folder]Microsoft Office\Office15\lync.exe
[ProgramFiles64Folder]Microsoft Office\Office15\lync.exe
EXE_CMD_LINE
EXE_CMD_LINE
SETUPEXEDIR
SETUPEXEDIR
AI_SETUPEXEPATH
AI_SETUPEXEPATH
/aespassword
/aespassword
/proxypassword
/proxypassword
/password
/password
/exelog
/exelog
/exelang
/exelang
/exefullui
/exefullui
/exebasicui
/exebasicui
/exenoui
/exenoui
%s %s
%s %s
d-d-d @d:d:d
d-d-d @d:d:d
MajorVersion: %u;
MajorVersion: %u;
MinorVersion: %u;
MinorVersion: %u;
BuildNumber: %u;
BuildNumber: %u;
PlatformId: %u;
PlatformId: %u;
CSDVersion: %s;
CSDVersion: %s;
ServicePackMajor: %u;
ServicePackMajor: %u;
ServicePackMinor: %u;
ServicePackMinor: %u;
SuiteMask: %u;
SuiteMask: %u;
ProductType: %u;
ProductType: %u;
WindowsFolder
WindowsFolder
WindowsVolume
WindowsVolume
shfolder.dll
shfolder.dll
AI_INTANCE_LOCATION="%s"
AI_INTANCE_LOCATION="%s"
/n %s
/n %s
TRANSFORMS=:%s.mst MSINEWINSTANCE=1
TRANSFORMS=:%s.mst MSINEWINSTANCE=1
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
MainAppCmdLine
MainAppCmdLine
UpdatesUrl
UpdatesUrl
MainAppURL
MainAppURL
SQLExpress
SQLExpress
SQLCompact
SQLCompact
Operator
Operator
SearchCmdLine
SearchCmdLine
DLaunching URL:
DLaunching URL:
G.part
G.part
wininet.dll
wininet.dll
FTP Server
FTP Server
HTTP/1.0
HTTP/1.0
Range: bytes=%u-
Range: bytes=%u-
REST %u
REST %u
SELECT `Value` FROM `Property` WHERE `Property` = '%s'
SELECT `Value` FROM `Property` WHERE `Property` = '%s'
A\\.\pipe\ToServer
A\\.\pipe\ToServer
G.aiu
G.aiu
0.0.0.0
0.0.0.0
*.pack
*.pack
--verbose --log-file="%s" --remove-pack-file "%s" "%s"
--verbose --log-file="%s" --remove-pack-file "%s" "%s"
unpack200.exe
unpack200.exe
mstask.exe
mstask.exe
[WindowsFolder]explorer.exe
[WindowsFolder]explorer.exe
A12\BIN\STSADM.EXE
A12\BIN\STSADM.EXE
14\BIN\STSADM.EXE
14\BIN\STSADM.EXE
15\BIN\STSADM.EXE
15\BIN\STSADM.EXE
Microsoft Shared\Web Server Extensions\
Microsoft Shared\Web Server Extensions\
BIN\STSADM.EXE
BIN\STSADM.EXE
SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\
SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\
Solutions.list
Solutions.list
SharePointLogNoUrl
SharePointLogNoUrl
SharePointLogInstall
SharePointLogInstall
`Key` = '
`Key` = '
AiMsgBox
AiMsgBox
AiProgressReport
AiProgressReport
ErrorMsgTitle
ErrorMsgTitle
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Software\Microsoft\Windows\CurrentVersion\Uninstall\
PTF://
PTF://
hXXps://
hXXps://
AI_MORE_CMD_LINE=1
AI_MORE_CMD_LINE=1
msiexec.exe
msiexec.exe
InstallExecuteAgain
InstallExecuteAgain
InstallExecute
InstallExecute
InstallExecuteSequence
InstallExecuteSequence
1500000
1500000
3000000
3000000
PIDKEY
PIDKEY
ARPURLUPDATEINFO
ARPURLUPDATEINFO
ARPURLINFOABOUT
ARPURLINFOABOUT
zzzzzzzzz.zzzzzzzzzzzzzzzzzzzzzz
zzzzzzzzz.zzzzzzzzzzzzzzzzzzzzzz
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\6_Offer_11.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\6_Offer_11.exe
Copy URL In Clipboard
Copy URL In Clipboard
You must locate, download and install the following prerequisites onto your computer. Double click on an URL to open it in your web browser.
You must locate, download and install the following prerequisites onto your computer. Double click on an URL to open it in your web browser.
Password:
Password:
Show password
Show password
This archive is corrupted.(This archive has an unsupported version.'Windows Installer could not be started.)An error occurred while reading the file.#An error occurred while extracting.
This archive is corrupted.(This archive has an unsupported version.'Windows Installer could not be started.)An error occurred while reading the file.#An error occurred while extracting.
Select the download folder.R%s can not be installed on systems with Windows Installer version smaller than %s.
Select the download folder.R%s can not be installed on systems with Windows Installer version smaller than %s.
ErrorkThis package requires Windows Installer version "%s". You have "%s".
ErrorkThis package requires Windows Installer version "%s". You have "%s".
Please upgrade your Windows Installer.
Please upgrade your Windows Installer.
%s Options(Extracting the main application files...
%s Options(Extracting the main application files...
%s [options]
%s [options]
/listlangs - list languages supported by this setup
/listlangs - list languages supported by this setup
/exenoui - launches the EXE setup without UI
/exenoui - launches the EXE setup without UI
/exebasicui - launches the EXE setup with basic UI
/exebasicui - launches the EXE setup with basic UI
/exelang - launches the EXE setup using the specified language
/exelang - launches the EXE setup using the specified language
/password - password used by the proxy
/password - password used by the proxy
/exelog - creates a log file at specified path
/exelog - creates a log file at specified path
/exenoupdates - does not check for a newer version
/exenoupdates - does not check for a newer version
- options for msiexec.exe on running the MSI package
- options for msiexec.exe on running the MSI package
Installing %s4Press the Next button to download the prerequisites.3Press the Next button to install the prerequisites.;Press the Next button to open the prerequisites' web sites.8Press the Finish button to install the main application.
Installing %s4Press the Next button to download the prerequisites.3Press the Next button to install the prerequisites.;Press the Next button to open the prerequisites' web sites.8Press the Finish button to install the main application.
%s Setup
%s Setup
Required: %s or lower.
Required: %s or lower.
Required: %s or higher.
Required: %s or higher.
Required: between %s and %s.
Required: between %s and %s.
Found: %s.
Found: %s.
NameCPress the Finish button when you are done and ready to install %s. 3Press the Next button to install the prerequisites.
NameCPress the Finish button when you are done and ready to install %s. 3Press the Next button to install the prerequisites.
Error: %s
Error: %s
Installing %s from: %sZSome prerequisites could not be installed. Press Back to return to the prerequisites list.{After launching all packages some required prerequisites are still missing. Press Back to return to the prerequisites list.aAll prerequisites have been installed successfully. Press Finish to install the main application.&Welcome to the %s Prerequisites Wizard
Installing %s from: %sZSome prerequisites could not be installed. Press Back to return to the prerequisites list.{After launching all packages some required prerequisites are still missing. Press Back to return to the prerequisites list.aAll prerequisites have been installed successfully. Press Finish to install the main application.&Welcome to the %s Prerequisites Wizard
%d.%d KB/slSome required prerequisites are still missing. You can try again or remove them from the prerequisites list.
%d.%d KB/slSome required prerequisites are still missing. You can try again or remove them from the prerequisites list.
%d hr %d min at %s/sec
%d hr %d min at %s/sec
%d min %d sec at %s/sec
%d min %d sec at %s/sec
%d sec at %s/sec
%d sec at %s/sec
Progress: %d%% (%s of %s) Downloading: %s %d%% (%s of %s)
Progress: %d%% (%s of %s) Downloading: %s %d%% (%s of %s)
Opening site of %s
Opening site of %s
Downloading %s Extracting files from archive...
Downloading %s Extracting files from archive...
Extracting file to %s0The %s file can't be unpacked. Error message: %saThe Java Runtime Environment version 1.5 or later must be installed in order to unpack JAR files.-Another instance of setup is already running.
Extracting file to %s0The %s file can't be unpacked. Error message: %saThe Java Runtime Environment version 1.5 or later must be installed in order to unpack JAR files.-Another instance of setup is already running.
%s cannot be installed on %s
%s cannot be installed on %s
Unpacking file:%syThere is not enough space in folder:%s
Unpacking file:%syThere is not enough space in folder:%s
Preparing...L%s can not be installed on systems with Adobe Reader version smaller than %s
Preparing...L%s can not be installed on systems with Adobe Reader version smaller than %s
%s Languages
%s Languages
B%s cannot be installed on systems with JRE version smaller than %sF%s cannot be installed on systems with DirectX version smaller than %sw%s requires an active Internet connection for installation. Please check your network configuration and proxy settings.
B%s cannot be installed on systems with JRE version smaller than %sF%s cannot be installed on systems with DirectX version smaller than %sw%s requires an active Internet connection for installation. Please check your network configuration and proxy settings.
QuestionOAn upgrade of the selected instance will be performed. Do you want to continue? Upgrade all installed instances.xThis package allows you to install multiple instances of %s. Please select the option you want and press OK to continue:L%s cannot be installed on systems with XNA Framework version smaller than %s
QuestionOAn upgrade of the selected instance will be performed. Do you want to continue? Upgrade all installed instances.xThis package allows you to install multiple instances of %s. Please select the option you want and press OK to continue:L%s cannot be installed on systems with XNA Framework version smaller than %s
Evaluating launch conditions...B%s cannot be installed on systems with JDK version smaller than %s-%s can not be installed on systems without %s6%s cannot be installed on systems without %s or higher,%s cannot be installed on systems without %sK%s cannot be installed on systems without %s 2003 Primary Interop Assembly.K%s cannot be installed on systems without %s 2007 Primary Interop Assembly.-%s cannot be installed on systems without %s.
Evaluating launch conditions...B%s cannot be installed on systems with JDK version smaller than %s-%s can not be installed on systems without %s6%s cannot be installed on systems without %s or higher,%s cannot be installed on systems without %sK%s cannot be installed on systems without %s 2003 Primary Interop Assembly.K%s cannot be installed on systems without %s 2007 Primary Interop Assembly.-%s cannot be installed on systems without %s.
Connect to %sNThe server %s at %s requires a username and password. Please enter them below.
Connect to %sNThe server %s at %s requires a username and password. Please enter them below.
Cannot acces URL: %sK%s cannot be installed on systems without %s 2010 Primary Interop Assembly.-%s cannot be installed on systems without %s.p%s cannot be installed because the current user does not have enough permissions to deploy SharePoint solutions.g%s cannot be installed because SharePoint Administration and SharePoint Timer services are not started.Y%s cannot be installed because the SharePoint solutions it contains are already deployed.
Cannot acces URL: %sK%s cannot be installed on systems without %s 2010 Primary Interop Assembly.-%s cannot be installed on systems without %s.p%s cannot be installed because the current user does not have enough permissions to deploy SharePoint solutions.g%s cannot be installed because SharePoint Administration and SharePoint Timer services are not started.Y%s cannot be installed because the SharePoint solutions it contains are already deployed.
Failed>%s cannot be installed on systems running on virtual machines.F%s cannot be installed on systems without %s Primary Interop Assembly.PThere is a newer version of %s (%s).
Failed>%s cannot be installed on systems running on virtual machines.F%s cannot be installed on systems without %s Primary Interop Assembly.PThere is a newer version of %s (%s).
Checking for a newer version...mFailed to download newer version (Error: %s). Would you like to retry or proceed and install current version?(Failed to read from file "%s". Error: %s'Failed to write in file "%s". Error: %s
Checking for a newer version...mFailed to download newer version (Error: %s). Would you like to retry or proceed and install current version?(Failed to read from file "%s". Error: %s'Failed to write in file "%s". Error: %s
Setup package was encrypted using AES 256 algorithm. To continue the setup process, you should provide the password needed to decrypt the package.?
Setup package was encrypted using AES 256 algorithm. To continue the setup process, you should provide the password needed to decrypt the package.?
Deleting extracted files...
Deleting extracted files...
Invalid command line"Unable to init windows application
Invalid command line"Unable to init windows application
Internal errorNThis application cannot be installed on systems earlier than Windows 2000 SP4._This installation package is not supported by this processor type. Contact your product vendor.
Internal errorNThis application cannot be installed on systems earlier than Windows 2000 SP4._This installation package is not supported by this processor type. Contact your product vendor.
Unexpected exception.XThe application ran into a problem that it couldn't handle.
Unexpected exception.XThe application ran into a problem that it couldn't handle.
Could not allocate memory.PParse error in file: "%1!ls!" at line: [%2!ld!] column: [%3!ld!] (code: %4!ls!).
Could not allocate memory.PParse error in file: "%1!ls!" at line: [%2!ld!] column: [%3!ld!] (code: %4!ls!).
Unsupported XML file encoding. File "%1!ls!" could not be read.
Unsupported XML file encoding. File "%1!ls!" could not be read.
1.0.0
1.0.0
setup.exe
setup.exe
iexplore.exe_1432:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512