Win32.Sality.3_45869a4bf5

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:464
Explorer.EXE:1140

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:464 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[1].txt (392 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA98FY3B.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (4534 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sd_101361_af128[1].jpg (19103 bytes)
C:\autorun.inf (245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fad58-b3118[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\itools-for-windows-06-100x100[1].png (12210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CABKDTRC.gif (35 bytes)
C:\rphkms.exe (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA5S0VDT.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sprite[1].png (2244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nr-412.min[1].js (8758 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cc92a7d66e[1].setToken (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fad58-b3118[2].css (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[2].txt (3789 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].txt (109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_100624_634cd[1].jpg (21742 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (1183 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winsopeag.exe (741 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CASJFFA8.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\blank[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gradientbg[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\container[1].html (1287 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\campaign-101361,100624[1] (2390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pubads_impl_49[2].js (2659 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sd_100624_634cd[1].jpg (27174 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\campaign-101361,100624[1].htm (2272 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAQV4PW9.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\container[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\81fe5-9d45e[1].js (6960 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[1].txt (11145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAXJVTKW.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pubads_impl_49[1].js (1704 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (18316 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (272 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAX5VB7F.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[2].txt (10187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA98FY3B.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAQV4PW9.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAXJVTKW.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pubads_impl_49[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CASJFFA8.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA5S0VDT.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAX5VB7F.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fad58-b3118[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winsopeag.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CABKDTRC.gif (0 bytes)

Registry activity

The process %original file name%.exe:464 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a3_694" = "697136351"
"a2_348" = "2494845384"
"a2_349" = "2502026204"
"a2_346" = "2480517760"
"a2_347" = "2487687856"
"a2_344" = "2466182472"
"a2_345" = "2473351194"
"a2_342" = "2451832941"
"a2_343" = "2459000924"
"a2_340" = "2437498302"
"a2_341" = "2444668146"
"a2_180" = "1290439173"
"a2_181" = "1297607950"
"a2_182" = "1304773038"
"a2_183" = "1311957408"
"a2_184" = "1319122695"
"a2_185" = "1326289323"
"a2_186" = "1333458197"
"a2_187" = "1340624155"
"a2_188" = "1347789019"
"a2_189" = "1354958374"
"a4_444" = "3183089724"
"a3_789" = "1344615644"
"a3_788" = "1371246781"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a2_749" = "1074705702"
"a2_742" = "1024517789"
"a2_743" = "1031684668"
"a2_740" = "1010184845"
"a2_741" = "1017352559"
"a2_746" = "1053202183"
"a2_747" = "1060357338"
"a2_744" = "1038853231"
"a2_745" = "1046021335"
"a1_503" = "2195156168"
"a1_502" = "1137882944"
"a1_501" = "3518417550"
"a1_500" = "2335189549"
"a1_507" = "1225678034"
"a1_506" = "1091732961"
"a1_505" = "2119166447"
"a1_504" = "85737544"
"a1_509" = "3489996164"
"a1_508" = "3727461202"
"a3_659" = "412749722"
"a3_658" = "405760891"
"a4_844" = "1755770828"
"a1_946" = "3047440315"
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "996126051"
"a1_434" = "1055572775"
"a1_433" = "946913087"
"a1_432" = "1904363753"
"a1_431" = "3615327522"
"a1_430" = "1725333800"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_784" = "1308623673"
"a3_783" = "1335193222"
"a3_782" = "1328269927"
"a3_781" = "1287147972"
"a1_636" = "440024871"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_971" = "2682835394"
"a1_729" = "496080740"
"a1_728" = "2769392320"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a4_818" = "1569373682"
"a4_819" = "1576542803"
"a4_810" = "1512020714"
"a4_811" = "1519189835"
"a4_812" = "1526358956"
"a4_813" = "1533528077"
"a4_814" = "1540697198"
"a4_815" = "1547866319"
"a4_816" = "1555035440"
"a4_817" = "1562204561"
"a1_670" = "494260107"
"a2_748" = "1067539563"
"a1_593" = "1875857167"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"
"a4_605" = "42350909"
"a4_604" = "35181788"
"a4_607" = "56689151"
"a4_606" = "49520030"
"a4_601" = "13674425"
"a4_600" = "6505304"
"a4_603" = "28012667"
"a4_602" = "20843546"
"a4_979" = "2723602163"
"a4_978" = "2716433042"
"a4_609" = "71027393"
"a4_608" = "63858272"
"a1_985" = "4072558187"
"a1_984" = "324893028"
"a1_983" = "4051926898"
"a1_982" = "3272505708"
"a1_981" = "52073230"
"a1_980" = "2232441064"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a1_855" = "635159899"
"a3_655" = "383827462"
"a1_857" = "307270135"
"a1_856" = "2741234181"
"a1_851" = "497954109"
"a1_850" = "69673855"
"a1_853" = "1923265093"
"a3_654" = "376767975"
"a1_859" = "2194593376"
"a3_657" = "431879896"
"a4_779" = "1289777963"
"a4_778" = "1282608842"
"a3_929" = "2381983272"
"a3_656" = "424825529"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a4_771" = "1232424995"
"a3_651" = "388835458"
"a4_773" = "1246763237"
"a4_772" = "1239594116"
"a4_775" = "1261101479"
"a4_774" = "1253932358"
"a4_777" = "1275439721"
"a3_650" = "348370019"
"a3_653" = "369779012"
"a3_652" = "395889957"
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "714862303"
"a1_184" = "1581439748"
"a1_183" = "348280841"
"a1_182" = "998098131"
"a1_181" = "866597102"
"a1_180" = "2495761243"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091820140919]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014091820140919\"

[HKCU\Software\Aas]
"a1_963" = "855703946"
"a4_559" = "4007538639"
"a4_558" = "4000369518"
"a4_555" = "3978862155"
"a4_554" = "3971693034"
"a4_557" = "3993200397"
"a4_556" = "3986031276"
"a4_551" = "3950185671"
"a4_550" = "3943016550"
"a4_553" = "3964523913"
"a4_552" = "3957354792"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091820140919]
"CacheLimit" = "8192"

[HKCU\Software\Aas]
"a1_753" = "3783866631"

"a4_824" = "1612388408"
"a4_393" = "2817464553"
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a4_865" = "1906322369"
"a4_864" = "1899153248"
"a4_867" = "1920660611"
"a1_932" = "1412352073"
"a4_866" = "1913491490"
"a1_933" = "1523690968"
"a4_861" = "1877645885"
"a3_758" = "1122262303"
"a4_860" = "1870476764"
"a1_931" = "1102232760"
"a4_863" = "1891984127"
"a1_936" = "3559740916"
"a4_862" = "1884815006"
"a1_937" = "2035362900"
"a2_405" = "2903497282"
"a2_404" = "2896328504"
"a2_407" = "2917839872"
"a2_406" = "2910662166"
"a2_401" = "2874809338"
"a2_400" = "2867645962"
"a2_403" = "2889160918"
"a2_402" = "2881980210"
"a1_935" = "8142581"
"a2_409" = "2932163202"
"a2_408" = "2924994611"
"a2_975" = "2694928207"
"a2_974" = "2687760921"
"a2_977" = "2709260348"
"a2_976" = "2702093800"
"a2_971" = "2666242180"
"a2_970" = "2659077909"
"a2_973" = "2680593658"
"a4_896" = "2128565120"
"a2_979" = "2723610276"
"a2_978" = "2716430009"
"a1_222" = "839151475"
"a1_223" = "3436105409"
"a1_220" = "3453992930"
"a1_221" = "622251744"
"a1_226" = "1455335708"
"a1_227" = "3319106225"
"a1_224" = "3242193246"
"a1_225" = "807173406"
"a1_228" = "886011925"
"a1_229" = "65353864"
"a2_579" = "4150925494"
"a2_578" = "4143743894"
"a2_571" = "4093573456"
"a2_570" = "4086390631"
"a2_573" = "4107907154"
"a2_572" = "4100739270"
"a2_575" = "4122242469"
"a2_574" = "4115072178"
"a2_577" = "4136577350"
"a2_576" = "4129407863"
"a2_351" = "2516354182"
"a2_350" = "2509185489"
"a2_353" = "2530703249"
"a2_352" = "2523538438"
"a2_355" = "2545033428"
"a2_354" = "2537871037"
"a2_357" = "2559372305"
"a2_356" = "2552201403"
"a2_359" = "2573723584"
"a2_358" = "2566538877"
"a3_906" = "2183550307"
"a3_622" = "147491207"
"a2_193" = "1383641844"
"a2_192" = "1376474092"
"a2_191" = "1369307824"
"a2_190" = "1362124633"
"a2_197" = "1412311608"
"a2_196" = "1405141765"
"a2_195" = "1397976212"
"a2_194" = "1390808380"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_624" = "195544665"
"a2_199" = "1426659748"
"a2_198" = "1419490309"
"a3_625" = "168917752"
"a2_759" = "1146403002"
"a3_626" = "175906587"
"a2_755" = "1117727300"
"a2_754" = "1110553232"
"a2_757" = "1132055786"
"a3_627" = "183481274"
"a2_751" = "1089036906"
"a2_750" = "1081872013"
"a2_753" = "1103386827"
"a2_752" = "1096204500"
"a1_536" = "435465171"
"a1_537" = "3743694950"
"a1_534" = "2014129179"
"a1_535" = "2490854155"
"a1_89" = "79693063"
"a1_88" = "2686538598"
"a1_530" = "3225476841"
"a1_531" = "2844325960"
"a1_85" = "2888113547"
"a1_84" = "1607899267"
"a1_87" = "2631660673"
"a1_86" = "3520528633"
"a1_81" = "1964718575"
"a1_80" = "3495470689"
"a1_83" = "1818810429"
"a1_82" = "906494582"
"a3_914" = "2274560123"
"a2_898" = "2142899193"
"a1_896" = "741708539"
"a1_890" = "2518716519"
"a2_899" = "2150080997"
"a1_67" = "3441112126"
"a1_66" = "59645269"
"a1_65" = "339403283"
"a3_133" = "970345548"
"a1_63" = "351693453"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "3669039245"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a3_684" = "625694981"
"a1_438" = "1624278888"
"a3_682" = "577634371"
"a3_683" = "584688866"
"a1_69" = "3655183967"
"a1_68" = "1771172120"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "2496039109"
"a1_409" = "3121863749"
"a1_402" = "2037520364"
"a1_403" = "2776940285"
"a1_400" = "3318616492"
"a1_401" = "940851367"
"a1_406" = "3484412933"
"a1_407" = "4135428236"
"a1_404" = "1734143432"
"a1_405" = "3731930921"
"a2_823" = "1605216728"
"a2_822" = "1598050866"
"a2_821" = "1590882892"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a2_827" = "1633900956"
"a1_628" = "2165196706"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a1_854" = "3865963722"
"a2_826" = "1626734245"
"a2_825" = "1619552182"
"a1_718" = "2076813073"
"a1_719" = "2454441782"
"a1_716" = "3307576341"
"a1_717" = "3597975267"
"a1_714" = "3275119414"
"a1_715" = "1115889488"
"a1_712" = "340826759"
"a1_713" = "1183728608"
"a1_710" = "3632658782"
"a1_711" = "4014082588"
"a4_809" = "1504851593"
"a4_808" = "1497682472"
"a4_803" = "1461836867"
"a1_629" = "3126554603"
"a4_801" = "1447498625"
"a4_800" = "1440329504"
"a4_807" = "1490513351"
"a4_806" = "1483344230"
"a4_805" = "1476175109"
"a4_804" = "1469005988"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_915" = "2281614490"
"a4_843" = "1748601707"
"a3_142" = "1034864615"
"a4_946" = "2487021170"
"a4_947" = "2494190291"
"a4_944" = "2472682928"
"a4_945" = "2479852049"
"a4_942" = "2458344686"
"a4_943" = "2465513807"
"a4_940" = "2444006444"
"a4_941" = "2451175565"
"a4_948" = "2501359412"

[HKCU\Software\Aas\695404737]
"28676484" = "35"

[HKCU\Software\Aas]
"a4_498" = "3570222258"
"a4_499" = "3577391379"
"a4_494" = "3541545774"
"a4_495" = "3548714895"
"a4_496" = "3555884016"
"a4_497" = "3563053137"
"a4_490" = "3512869290"
"a4_491" = "3520038411"
"a4_492" = "3527207532"
"a4_493" = "3534376653"
"a3_448" = "3194799081"
"a3_449" = "3202245640"
"a2_941" = "2451170671"
"a4_708" = "780770372"
"a4_709" = "787939493"
"a3_918" = "2303105535"
"a3_919" = "2310025758"
"a4_704" = "752093888"
"a4_705" = "759263009"
"a4_706" = "766432130"
"a4_707" = "773601251"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_701" = "730586525"
"a4_702" = "737755646"
"a4_703" = "744924767"
"a1_888" = "2894694921"
"a1_889" = "3731798669"
"a1_886" = "883234027"
"a1_887" = "1918158600"
"a1_884" = "3652341565"

"a1_882" = "1980946572"
"a1_883" = "360826413"
"a1_880" = "3579381359"
"a1_881" = "358266479"
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a2_593" = "4251292598"
"a3_444" = "3166269973"
"a3_445" = "3206813364"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Aas]
"a1_831" = "2959409763"
"a2_592" = "4244126309"
"a1_930" = "4033578043"
"a1_948" = "469553255"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "2862789173"
"a1_723" = "3972014139"
"a1_722" = "1071815623"
"a1_721" = "524055940"
"a1_720" = "3578138222"
"a1_768" = "4077126770"
"a1_727" = "864406540"
"a1_726" = "1128492892"
"a2_643" = "314784940"
"a2_790" = "1368644200"
"a1_725" = "728535532"
"a2_642" = "307601863"
"a1_724" = "3904907904"
"a2_641" = "300436409"
"a2_640" = "293266595"
"a2_647" = "343453681"
"a2_646" = "336287402"
"a1_158" = "2359588241"
"a1_159" = "3648183910"
"a2_645" = "329118207"
"a1_150" = "1492037784"
"a1_151" = "406693420"
"a1_152" = "1567874892"
"a1_153" = "2502066607"
"a1_154" = "576663524"
"a1_155" = "2997178100"
"a1_156" = "2944028746"
"a1_157" = "2045035727"
"a1_235" = "582689502"
"a1_234" = "594807312"
"a1_237" = "1021546141"
"a1_236" = "1791281745"
"a1_231" = "2484295638"
"a1_230" = "2682816776"
"a1_233" = "1515821369"
"a1_232" = "998271834"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Aas]
"a1_239" = "3239644353"
"a1_238" = "59781758"
"a2_210" = "1505511957"
"a2_211" = "1512678910"
"a2_212" = "1519846265"
"a2_213" = "1527031652"
"a2_214" = "1534195497"
"a2_215" = "1541362260"
"a2_216" = "1548526817"
"a2_217" = "1555707070"
"a2_218" = "1562860308"
"a2_219" = "1570030330"
"a1_966" = "1457960283"
"a2_508" = "3641912849"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Aas]
"a2_504" = "3613229638"
"a2_505" = "3620413201"
"a2_506" = "3627581277"
"a2_507" = "3634745407"
"a2_500" = "3584568731"
"a2_501" = "3591728844"
"a2_502" = "3598895982"
"a2_503" = "3606062864"
"a2_791" = "1375812084"
"a2_698" = "709076729"
"a2_699" = "716246402"
"a2_694" = "680395713"
"a2_695" = "687577416"
"a2_696" = "694746658"
"a2_697" = "701918615"
"a2_690" = "651734071"
"a2_691" = "658891961"
"a2_692" = "666061844"
"a2_693" = "673225140"
"a2_324" = "2322797246"
"a2_325" = "2329987394"
"a2_326" = "2337131738"
"a2_327" = "2344299316"
"a2_320" = "2294110487"
"a2_321" = "2301282055"
"a2_322" = "2308462542"
"a2_323" = "2315628951"
"a1_521" = "1154335024"
"a1_520" = "3507612439"
"a1_523" = "3671892317"
"a1_522" = "3717911967"
"a2_328" = "2351465967"
"a2_329" = "2358647204"
"a1_527" = "3118435691"
"a1_526" = "2513930783"
"a2_799" = "1433163289"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Aas]
"a2_798" = "1425996992"
"a4_962" = "2601727106"
"a1_98" = "1777270907"
"a1_99" = "2985056204"
"a1_92" = "2128883741"
"a1_93" = "632439936"
"a1_90" = "3215917994"
"a1_91" = "4125092150"
"a1_96" = "433466681"
"a1_97" = "183133086"
"a1_94" = "2909406510"
"a1_95" = "2576406188"
"a1_74" = "307561787"
"a1_75" = "3138035997"
"a1_76" = "740169493"
"a1_77" = "3437464056"
"a1_70" = "1272758748"
"a1_71" = "1658459554"
"a1_72" = "666720772"
"a1_73" = "3927532541"
"a3_699" = "733118194"
"a3_698" = "725670483"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "421401557"
"a1_79" = "3686998827"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "1704173941"
"a1_418" = "2389127483"
"a3_953" = "2520368944"
"a1_415" = "440282470"
"a1_414" = "3722851056"
"a1_417" = "2850012732"
"a1_416" = "3817591003"
"a1_411" = "2552934921"
"a1_410" = "3588092119"
"a1_413" = "1919856583"
"a1_412" = "2003195681"
"a3_939" = "2419869154"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a1_701" = "2502631918"
"a1_700" = "1732410247"
"a1_703" = "2177498466"
"a1_702" = "1305397384"
"a1_705" = "704376702"
"a1_704" = "42346877"
"a1_707" = "600509821"
"a1_706" = "1173126045"
"a1_709" = "690714097"
"a1_708" = "2424378397"
"a2_360" = "2580887348"
"a4_838" = "1712756102"
"a2_361" = "2588059907"
"a4_836" = "1698417860"
"a4_837" = "1705586981"
"a4_834" = "1684079618"
"a4_835" = "1691248739"
"a4_832" = "1669741376"
"a2_362" = "2595221254"
"a4_830" = "1655403134"
"a4_831" = "1662572255"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a4_951" = "2522866775"
"a2_364" = "2609551458"
"a4_953" = "2537205017"
"a4_952" = "2530035896"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a4_957" = "2565881501"
"a2_365" = "2616721472"
"a2_366" = "2623915536"
"a2_367" = "2631072272"
"a1_743" = "643243065"
"a2_168" = "1204419170"
"a2_169" = "1211588069"
"a4_847" = "1777278191"
"a4_489" = "3505700169"
"a4_488" = "3498531048"
"a4_487" = "3491361927"
"a4_486" = "3484192806"
"a4_485" = "3477023685"
"a4_484" = "3469854564"
"a4_483" = "3462685443"
"a4_482" = "3455516322"
"a4_481" = "3448347201"
"a4_480" = "3441178080"
"a2_160" = "1147051087"
"a4_973" = "2680587437"
"a2_161" = "1154234006"
"a4_977" = "2709263921"
"a4_972" = "2673418316"
"a4_971" = "2666249195"
"a3_901" = "2147558220"
"a3_900" = "2174193453"
"a3_903" = "2162063374"
"a3_902" = "2154612719"
"a3_905" = "2209657024"
"a3_904" = "2202606753"
"a4_719" = "859630703"
"a4_718" = "852461582"
"a4_717" = "845292461"
"a4_716" = "838123340"
"a4_715" = "830954219"
"a4_714" = "823785098"
"a4_713" = "816615977"
"a4_712" = "809446856"
"a4_711" = "802277735"
"a4_710" = "795108614"
"a1_891" = "536908977"
"a3_776" = "1251683361"
"a1_893" = "2738155635"
"a1_892" = "20365226"
"a1_895" = "3997015363"
"a1_894" = "887616211"
"a1_897" = "1523318367"
"a3_777" = "1292288064"
"a1_899" = "1486302495"
"a1_898" = "2320893694"
"a4_974" = "2687756558"
"a3_774" = "1270749039"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a3_772" = "1222762157"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a4_975" = "2694925679"
"a3_770" = "1208254955"
"a3_771" = "1215707658"
"a2_455" = "3261952654"
"a1_617" = "2230511318"

[HKCU\Software\Softonic\Universal Downloader]
"uuid" = "405E8CDB-A8BC-4F43-A4AC-636EF4818C4A"

[HKCU\Software\Aas]
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a1_615" = "3385264734"
"a2_459" = "3290620436"
"a3_678" = "548713167"
"a1_614" = "3365543190"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091820140919]
"CacheOptions" = "11"

[HKCU\Software\Aas]
"a1_820" = "2757191385"
"a1_821" = "495950153"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Aas]
"a1_822" = "2759401741"

"a1_149" = "3098789162"
"a1_148" = "2092159785"
"a1_143" = "2039925010"
"a1_142" = "1609889469"
"a1_141" = "3793223957"
"a1_140" = "3724921427"
"a1_147" = "2886173377"
"a1_146" = "141608840"
"a1_145" = "909642975"
"a1_144" = "1437267678"
"a1_826" = "3436258980"
"a1_827" = "4251602323"
"a2_203" = "1455327038"
"a2_202" = "1448159635"
"a2_201" = "1440992889"
"a2_200" = "1433815695"
"a2_207" = "1484009990"
"a2_206" = "1476846729"
"a2_205" = "1469675020"
"a2_204" = "1462495819"
"a2_209" = "1498345300"
"a2_208" = "1491177478"
"a2_519" = "3720779368"
"a2_518" = "3713613213"
"a2_517" = "3706432831"
"a2_516" = "3699262776"
"a2_515" = "3692098311"
"a2_514" = "3684930530"
"a2_513" = "3677763726"
"a2_512" = "3670597933"
"a2_511" = "3663414108"
"a2_510" = "3656247113"
"a2_689" = "644562555"
"a2_688" = "637394363"
"a2_687" = "630225836"
"a2_686" = "623040966"
"a2_685" = "615878018"
"a2_684" = "608707753"
"a2_683" = "601543676"
"a2_682" = "594374981"
"a2_681" = "587210542"
"a2_680" = "579996229"
"a2_337" = "2415998186"
"a2_336" = "2408816433"
"a2_335" = "2401648989"
"a2_334" = "2394484399"
"a2_333" = "2387313991"
"a2_332" = "2380149847"
"a2_331" = "2372984802"
"a2_330" = "2365816663"
"a1_554" = "2676766655"
"a1_555" = "1531490578"
"a1_556" = "557495281"
"a1_557" = "3558388145"
"a3_242" = "1718323611"
"a1_551" = "3394976155"
"a2_339" = "2430333239"
"a2_338" = "2423169013"
"a4_673" = "529851137"
"a1_918" = "3098104279"
"a1_919" = "3739037767"
"a3_243" = "1725243962"
"a1_852" = "4188198585"
"a1_914" = "156769540"
"a1_398" = "1474120213"
"a1_399" = "753611362"
"a4_679" = "572865863"
"a1_392" = "565635392"
"a1_393" = "188161623"
"a1_390" = "1400946706"
"a1_391" = "2323626901"
"a1_396" = "1868755805"
"a1_397" = "422001206"
"a1_394" = "3689934839"
"a1_395" = "3719968645"
"a1_858" = "4071879748"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "806369422"
"a1_48" = "3505404665"
"a3_554" = "3988280259"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "2319679515"
"a3_759" = "1163391422"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a3_592" = "4261104249"
"a3_593" = "4234604184"
"a3_590" = "4246617511"
"a3_591" = "4253667782"
"a3_596" = "4289649661"
"a3_597" = "4263017500"
"a3_594" = "4241589051"
"a3_595" = "4282591066"
"a3_598" = "4270526655"
"a3_599" = "4277581022"
"a4_848" = "1784447312"
"a3_578" = "4160735531"
"a3_579" = "4134104394"
"a4_770" = "1225255874"
"a3_570" = "4069660115"
"a3_571" = "4076703346"
"a3_572" = "4117701269"
"a3_573" = "4124755764"
"a3_574" = "4098128727"
"a3_575" = "4105641974"
"a3_576" = "4146245737"
"a3_577" = "4153169032"
"a1_774" = "3294300157"
"a1_775" = "3397774712"
"a1_776" = "201475938"
"a1_777" = "4095661606"
"a1_191" = "695819786"
"a1_771" = "573014762"
"a1_772" = "2400973302"
"a1_773" = "1560831667"
"a1_953" = "180520768"
"a3_927" = "2367492374"
"a1_778" = "1176332976"
"a1_779" = "1146295622"
"a3_926" = "2326953207"
"a2_17" = "121866502"
"a2_16" = "114711921"
"a2_15" = "107542642"
"a2_14" = "100360635"
"a2_13" = "93193634"
"a2_12" = "86027542"
"a2_11" = "78869985"
"a2_10" = "71694084"
"a4_829" = "1648234013"
"a4_828" = "1641064892"
"a4_776" = "1268270600"
"a1_592" = "2312830237"
"a2_19" = "136204614"
"a2_18" = "129052159"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a4_926" = "2343638750"
"a4_927" = "2350807871"
"a1_878" = "729038546"
"a4_921" = "2307793145"
"a4_922" = "2314962266"
"a1_595" = "2481402696"
"a1_596" = "222640269"
"a1_597" = "3279869262"
"a1_608" = "4151594259"
"a1_609" = "2211352955"
"a3_378" = "2693094675"
"a3_379" = "2700145074"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Aas]
"a4_846" = "1770109070"
"a3_372" = "2683746013"
"a3_373" = "2657102716"
"a3_370" = "2669182491"
"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a1_759" = "3629959462"
"a3_488" = "3515101889"
"a3_489" = "3522680672"
"a4_841" = "1734263465"
"a4_840" = "1727094344"
"a1_950" = "3078816906"
"a3_484" = "3486690637"
"a1_952" = "1470768110"
"a2_925" = "2336468940"
"a1_954" = "3917496750"
"a1_955" = "1169341681"
"a1_956" = "2895050019"
"a3_485" = "3460055532"
"a1_958" = "3243548227"
"a2_922" = "2314967524"
"a1_750" = "4219276946"
"a1_751" = "2074189374"
"a1_756" = "1404884001"
"a1_757" = "1866054536"
"a4_722" = "881138066"
"a4_723" = "888307187"
"a4_720" = "866799824"
"a1_661" = "1481052872"
"a4_726" = "909814550"
"a4_727" = "916983671"
"a4_724" = "895476308"
"a4_725" = "902645429"
"a4_728" = "924152792"
"a4_729" = "931321913"
"a3_978" = "2699694267"
"a3_979" = "2740303066"
"a3_127" = "927442486"
"a1_189" = "4273236771"
"a4_903" = "2178748967"
"a1_188" = "1786654997"
"a4_900" = "2157241604"
"a1_187" = "199726764"
"a4_901" = "2164410725"
"a1_186" = "3854710487"
"a2_929" = "2365153268"
"a4_905" = "2193087209"
"a4_586" = "4201104906"
"a4_587" = "4208274027"
"a4_584" = "4186766664"
"a4_585" = "4193935785"
"a4_582" = "4172428422"
"a4_583" = "4179597543"
"a4_580" = "4158090180"
"a4_581" = "4165259301"
"a3_800" = "1423623433"
"a3_801" = "1464105384"
"a3_802" = "1471618507"
"a3_803" = "1445115498"
"a3_804" = "1452026509"
"a3_805" = "1459605292"
"a4_588" = "4215443148"
"a4_589" = "4222612269"
"a3_645" = "312377932"
"a4_909" = "2221763693"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Aas]
"a4_966" = "2630403590"
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a1_843" = "97788894"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_605" = "1865397560"
"a1_558" = "2989708383"
"a1_559" = "1314684831"
"a1_606" = "3559172904"
"a3_925" = "2319505492"
"a1_178" = "1622212396"
"a1_179" = "2185118120"
"a1_176" = "669544685"
"a1_177" = "1412472109"
"a1_174" = "1472723605"
"a1_175" = "818981651"
"a1_172" = "1087601052"
"a1_173" = "634216159"
"a1_170" = "136266460"
"a1_171" = "1514112146"
"a1_550" = "759465800"
"a2_236" = "1691916835"
"a2_237" = "1699073566"
"a2_234" = "1677582496"
"a2_235" = "1684749467"
"a2_232" = "1663227695"
"a2_233" = "1670398366"
"a2_230" = "1648898440"
"a2_231" = "1656062992"
"a1_553" = "2709105586"
"a2_238" = "1706250181"
"a2_239" = "1713411848"
"a2_522" = "3742282832"
"a2_523" = "3749448827"
"a2_520" = "3727935193"
"a2_521" = "3735114703"
"a2_526" = "3770950754"
"a2_527" = "3778133982"
"a2_524" = "3756610374"
"a2_525" = "3763783381"
"a2_838" = "1712764265"
"a2_839" = "1719918860"
"a2_528" = "3785299191"
"a2_529" = "3792467014"
"a3_688" = "620670617"
"a1_626" = "2103693447"
"a1_541" = "1584229166"
"a1_627" = "1980731084"
"a1_624" = "1615700335"
"a1_549" = "4065911132"
"a1_548" = "1011732589"
"a1_547" = "827661328"
"a1_546" = "3349394349"
"a1_545" = "4065317846"
"a1_544" = "1994576986"
"a1_543" = "1300951962"
"a1_542" = "1758029936"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a1_540" = "1935409687"
"a2_658" = "422321799"
"a2_659" = "429486772"
"a2_308" = "2208095283"
"a2_309" = "2215260329"
"a2_302" = "2165076994"
"a2_303" = "2172244112"
"a2_300" = "2150728321"
"a2_301" = "2157908168"
"a2_306" = "2193747324"
"a2_307" = "2200926904"
"a2_304" = "2179410015"
"a2_305" = "2186579054"
"a2_786" = "1339959605"
"a2_787" = "1347128120"
"a2_784" = "1325628538"
"a2_785" = "1332801116"
"a2_782" = "1311292193"
"a2_783" = "1318461376"
"a2_780" = "1296943729"
"a2_781" = "1304109318"
"a2_788" = "1354293684"
"a2_789" = "1361464223"
"a1_389" = "3302642860"
"a1_388" = "1951210806"
"a1_385" = "2854453357"
"a1_384" = "3000186683"
"a1_387" = "1139779053"
"a1_386" = "3610186738"
"a1_381" = "962177247"
"a1_380" = "528263569"
"a1_383" = "2237433455"
"a1_382" = "1101377168"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Aas]
"a1_58" = "2632694928"
"a1_59" = "4098267635"
"a1_56" = "2148413409"
"a1_57" = "527514838"
"a1_54" = "3202191815"
"a1_55" = "3557191274"
"a1_52" = "1163868559"
"a1_53" = "630568616"
"a1_50" = "1400307645"
"a1_51" = "440114973"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a1_616" = "1049212478"
"a3_748" = "1050812741"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_585" = "4177070976"
"a3_584" = "4170159969"
"a3_587" = "4225122370"
"a3_586" = "4217678883"
"a3_581" = "4182227468"
"a3_580" = "4141089261"
"a3_583" = "4162646734"
"a3_582" = "4189150895"
"a3_589" = "4205615364"
"a3_588" = "4198622437"
"a2_916" = "2271949715"
"a3_893" = "2090093684"
"a3_569" = "4062671280"
"a3_568" = "4088782097"
"a3_563" = "4052790138"
"a3_562" = "4045747931"
"a3_561" = "4005270200"
"a3_560" = "3997761049"
"a3_567" = "4081727742"
"a3_566" = "4040721503"
"a3_565" = "4033732668"
"a3_564" = "4026683293"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a1_765" = "435479663"
"a1_764" = "2272807880"
"a1_763" = "3775393120"
"a1_762" = "563633803"
"a1_761" = "840010877"
"a3_724" = "878479485"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a4_854" = "1827462038"
"a4_855" = "1834631159"
"a4_856" = "1841800280"
"a3_726" = "926531903"
"a4_850" = "1798785554"
"a4_851" = "1805954675"
"a4_852" = "1813123796"
"a4_853" = "1820292917"
"a3_721" = "890560280"
"a2_914" = "2257615967"
"a4_858" = "1856138522"
"a1_586" = "1049623620"
"a1_789" = "812865002"
"a3_720" = "849951481"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a3_898" = "2126083691"
"a3_723" = "904992730"
"a4_939" = "2436837323"
"a4_938" = "2429668202"
"a4_937" = "2422499081"
"a4_936" = "2415329960"
"a4_935" = "2408160839"
"a3_722" = "898003899"
"a4_933" = "2393822597"
"a4_932" = "2386653476"
"a4_931" = "2379484355"
"a4_930" = "2372315234"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091820140919]
"CacheRepair" = "0"

[HKCU\Software\Aas]
"a3_955" = "2568364018"
"a1_788" = "2357287673"
"a1_619" = "4288268996"
"a1_618" = "325961331"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"
"a3_363" = "2585673634"
"a3_362" = "2611780355"
"a4_520" = "3727942920"
"a4_521" = "3735112041"
"a1_584" = "829322263"
"a4_522" = "3742281162"
"a2_62" = "444493309"
"a4_523" = "3749450283"
"a2_63" = "451652517"
"a4_524" = "3756619404"
"a1_971" = "471725748"
"a2_60" = "430161819"
"a4_525" = "3763788525"
"a1_943" = "3027456788"
"a1_942" = "4281604661"
"a1_941" = "2495522615"
"a2_61" = "437308154"
"a1_947" = "4284571606"
"a4_526" = "3770957646"
"a1_945" = "3463507007"
"a1_944" = "2516642574"
"a2_66" = "473154760"
"a1_949" = "2732413144"
"a4_527" = "3778126767"
"a2_67" = "480337861"
"a2_64" = "458818005"
"a2_65" = "465986041"
"a4_735" = "974336639"
"a4_734" = "967167518"
"a4_737" = "988674881"
"a4_736" = "981505760"
"a4_731" = "945660155"
"a4_730" = "938491034"
"a4_733" = "959998397"
"a4_732" = "952829276"
"a4_739" = "1003013123"
"a4_738" = "995844002"
"a3_969" = "2668861696"
"a3_968" = "2627790049"
"a4_599" = "4294303479"
"a4_598" = "4287134358"
"a1_782" = "2162455794"
"a4_591" = "4236950511"
"a4_590" = "4229781390"
"a4_593" = "4251288753"
"a4_592" = "4244119632"
"a4_595" = "4265626995"
"a4_594" = "4258457874"
"a4_597" = "4279965237"
"a4_596" = "4272796116"
"a1_786" = "3855363467"
"a1_41" = "560428088"
"a1_40" = "4158297853"
"a1_43" = "52335856"
"a3_819" = "1559971962"
"a1_42" = "3292885398"
"a3_813" = "1516544548"
"a1_45" = "540810328"
"a3_811" = "1536136546"
"a3_810" = "1528623299"
"a3_817" = "1545483192"
"a3_816" = "1571594009"
"a3_815" = "1564605158"
"a1_44" = "1189918353"
"a1_47" = "3400456437"
"a1_46" = "4038496676"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a4_823" = "1605219287"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a4_924" = "2329300508"
"a4_565" = "4050553365"
"a3_750" = "1098874375"
"a3_751" = "1105859238"
"a3_752" = "1079359193"
"a3_753" = "1086794616"
"a4_566" = "4057722486"
"a3_921" = "2290961104"
"a3_754" = "1127403419"
"a4_879" = "2006690063"
"a3_725" = "885927068"
"a3_755" = "1134321722"
"a3_756" = "1108280413"
"a1_783" = "2724930321"
"a3_757" = "1115339004"
"a1_959" = "1040695566"
"a2_907" = "2207418215"
"a1_161" = "1720166109"
"a1_160" = "492097276"
"a1_163" = "2803220890"
"a1_162" = "2007524023"
"a1_165" = "1591714111"
"a1_164" = "905407728"
"a1_167" = "1384269366"
"a1_166" = "2543198461"
"a1_169" = "4007398228"
"a1_168" = "695319151"
"a3_727" = "933979486"
"a2_535" = "3835483101"
"a2_534" = "3828317601"
"a2_537" = "3849819907"
"a2_536" = "3842650424"
"a2_531" = "3806800139"
"a2_530" = "3799633012"
"a2_533" = "3821134894"
"a2_532" = "3813967007"
"a2_829" = "1648236002"
"a2_828" = "1641056552"
"a2_539" = "3864164730"
"a2_538" = "3856985103"
"a4_447" = "3204597087"
"a1_572" = "1215199940"
"a1_573" = "473353290"
"a1_570" = "3167299767"
"a1_571" = "3766460391"
"a1_576" = "3493377300"
"a1_577" = "591397951"
"a1_574" = "2559694892"
"a1_575" = "2162567781"
"a1_578" = "1777044509"
"a1_579" = "327737002"
"a2_649" = "357773888"
"a2_648" = "350620153"
"a2_319" = "2286947192"
"a2_318" = "2279773103"
"a2_315" = "2258279691"
"a2_314" = "2251098446"
"a2_317" = "2272613933"
"a2_316" = "2265444976"
"a2_311" = "2229594171"
"a2_310" = "2222429719"
"a2_313" = "2243929128"
"a2_312" = "2236760945"
"a2_229" = "1641730911"
"a2_228" = "1634562407"
"a2_221" = "1584380598"
"a2_220" = "1577212614"
"a2_223" = "1598706152"
"a2_222" = "1591547581"
"a2_225" = "1613045979"
"a2_224" = "1605880066"
"a2_227" = "1627396972"
"a2_226" = "1620213823"
"a1_370" = "2564067822"
"a1_371" = "998703310"
"a1_372" = "1763833735"
"a1_373" = "900724792"
"a1_374" = "4171072708"
"a1_375" = "751105189"
"a1_376" = "263602535"
"a1_377" = "85971629"
"a1_378" = "492573539"
"a1_379" = "606049668"
"a2_793" = "1390143833"
"a2_792" = "1382977596"
"a2_795" = "1404480593"
"a2_794" = "1397323095"
"a2_797" = "1418828362"
"a2_796" = "1411645685"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "2925765451"
"a1_28" = "2035322062"
"a1_590" = "1239187415"
"a1_23" = "1125180779"
"a1_22" = "1282051855"
"a1_21" = "3618145157"
"a1_20" = "199397982"
"a1_27" = "4160987887"
"a1_26" = "2633813864"
"a1_25" = "1393384114"
"a1_24" = "3306861093"
"a1_284" = "3260514092"
"a1_285" = "67978433"
"a1_286" = "686977004"
"a1_287" = "2439902852"
"a1_280" = "1284477014"
"a1_281" = "444295113"
"a1_282" = "3038672823"
"a1_283" = "4222340850"
"a3_31" = "205278614"
"a1_288" = "3150847597"
"a1_289" = "1230191613"
"a3_778" = "1299211491"
"a3_779" = "1306728706"
"a2_903" = "2178745616"
"a1_591" = "1498373459"
"a3_32" = "212854281"
"a2_972" = "2673425524"
"a3_558" = "4017332551"
"a3_559" = "4024255974"
"a3_556" = "3969214597"
"a3_557" = "4009757988"
"a1_552" = "2303830549"
"a3_555" = "3962303586"
"a3_552" = "3940752129"
"a3_553" = "3981361056"
"a3_550" = "3926311503"
"a3_551" = "3933234926"
"a1_598" = "3347532728"
"a1_599" = "524132939"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222244967"
"a2_30" = "215078988"
"a2_33" = "236578722"
"a2_32" = "229419498"
"a2_35" = "250916516"
"a2_34" = "243748335"
"a2_37" = "265263715"
"a2_36" = "258096371"
"a2_39" = "279598553"
"a2_38" = "272429249"
"a3_486" = "3467639311"
"a3_487" = "3508182702"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a3_482" = "3438646411"
"a3_483" = "3479636266"
"a4_902" = "2171579846"
"a2_584" = "4186761807"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_906" = "2200256330"
"a4_907" = "2207425451"
"a4_904" = "2185918088"
"a2_585" = "4193942929"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_642" = "324456811"
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"
"a1_529" = "3993640194"
"a1_625" = "3117113996"
"a1_622" = "1240920497"
"a1_623" = "2616178906"
"a1_620" = "2434753225"
"a1_621" = "840349065"
"a3_643" = "331380106"

[HKCU\Software\Aas\695404737]
"7169121" = "222"

[HKCU\Software\Aas]
"a3_958" = "2556348631"
"a3_959" = "2563272054"
"a1_528" = "55288750"
"a2_588" = "4215445651"
"a3_950" = "2498827743"
"a3_951" = "2539425406"
"a3_956" = "2575413269"
"a3_957" = "2582860980"
"a3_954" = "2527820627"
"a2_589" = "4222609986"
"a1_976" = "752075661"
"a1_977" = "3421288690"
"a1_974" = "3061757786"
"a1_975" = "603536434"
"a1_972" = "796428602"
"a1_973" = "4228598006"
"a1_970" = "3073586385"
"a3_827" = "1616916338"
"a1_770" = "900864638"
"a1_978" = "3519140324"
"a1_979" = "4025738051"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Aas]
"a4_199" = "1426655079"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Aas]
"a3_504" = "3596547281"
"a2_363" = "2602398192"
"a3_507" = "3651577394"
"a3_506" = "3644525971"
"a3_501" = "3608550396"
"a3_500" = "3568002909"
"a3_503" = "3623047358"
"a3_502" = "3615603743"
"a4_821" = "1590881045"
"a4_698" = "709079162"
"a4_699" = "716248283"
"a4_820" = "1583711924"
"a4_692" = "666064436"
"a4_693" = "673233557"
"a4_690" = "651726194"
"a4_691" = "658895315"
"a4_696" = "694740920"
"a4_697" = "701910041"
"a4_694" = "680402678"
"a4_695" = "687571799"
"a4_822" = "1598050166"
"a3_828" = "1624490901"
"a3_829" = "1664967732"
"a3_826" = "1643547347"
"a4_825" = "1619557529"
"a3_824" = "1628992017"
"a3_825" = "1636505264"
"a3_822" = "1581458783"
"a3_823" = "1588517374"
"a3_820" = "1600580765"
"a3_821" = "1607565628"
"a2_900" = "2157245162"
"a1_746" = "2371827191"
"a4_827" = "1633895771"
"a2_901" = "2164413858"
"a3_644" = "305393197"
"a4_826" = "1626726650"
"a2_902" = "2171583385"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a2_904" = "2185916178"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a2_905" = "2193081558"
"a2_906" = "2200249763"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "574186143"
"a1_115" = "1854831549"
"a1_116" = "1910281827"
"a1_117" = "370055280"
"a1_110" = "2702851575"
"a1_111" = "3178519667"
"a1_112" = "694702244"
"a1_113" = "661340271"
"a1_824" = "3063638391"
"a1_118" = "4139426314"
"a1_119" = "832350019"
"a4_576" = "4129413696"
"a4_920" = "2300624024"
"a3_732" = "969437045"
"a2_498" = "3570228520"
"a2_499" = "3577394176"
"a2_492" = "3527210354"
"a2_493" = "3534384412"
"a2_490" = "3512875251"
"a2_491" = "3520043630"
"a2_496" = "3555879971"
"a2_497" = "3563058651"
"a2_494" = "3541544554"
"a2_495" = "3548709140"
"a2_816" = "1555030324"
"a2_817" = "1562198642"
"a2_814" = "1540699657"
"a2_815" = "1547864831"
"a2_812" = "1526350657"
"a3_740" = "1026900557"
"a2_810" = "1512017309"
"a2_811" = "1519184512"
"a3_733" = "943391636"
"a4_570" = "4086398970"
"a2_818" = "1569367173"
"a2_819" = "1576548964"
"a1_565" = "831635879"
"a1_564" = "1400225800"
"a1_567" = "1251951619"
"a1_566" = "165082829"
"a1_561" = "1110299848"
"a1_560" = "2840566343"
"a1_563" = "3965612301"
"a1_562" = "2145596831"
"a1_569" = "219429927"
"a1_568" = "4052833265"
"a1_525" = "1569613750"
"a2_678" = "565694427"
"a2_679" = "572860408"
"a2_676" = "551356649"
"a2_677" = "558523918"
"a2_674" = "537025370"
"a2_675" = "544191950"
"a2_672" = "522674820"
"a2_673" = "529857873"
"a2_670" = "508338865"
"a2_671" = "515508020"
"a3_982" = "2728158783"
"a2_258" = "1849638056"
"a2_259" = "1856804441"
"a2_254" = "1820951259"
"a2_255" = "1828119619"
"a2_256" = "1835333143"
"a2_257" = "1842472549"
"a2_250" = "1792285387"
"a2_251" = "1799452176"
"a2_252" = "1806619120"
"a2_253" = "1813785179"
"a1_363" = "2439143483"
"a1_362" = "3166679423"
"a1_361" = "1804483717"
"a1_360" = "2951085370"
"a1_367" = "1876498865"
"a1_366" = "3742690270"
"a1_365" = "4031353549"
"a1_364" = "1461381979"
"a1_369" = "2368409486"
"a1_368" = "2602240037"
"a3_977" = "2692709400"
"a3_924" = "2346001461"
"a1_38" = "1449044140"
"a1_39" = "3550613625"
"a1_30" = "1959421067"
"a1_31" = "2680137849"
"a1_32" = "381779699"
"a1_33" = "3963423165"
"a1_34" = "1308790751"
"a1_35" = "3678254584"
"a1_36" = "2025806354"
"a1_37" = "2438953785"
"a1_297" = "379002679"
"a1_296" = "1123950135"
"a1_295" = "1948867731"
"a1_294" = "3559931098"
"a1_293" = "4167437867"
"a1_292" = "1148012185"
"a1_291" = "2271679475"
"a1_290" = "3838287915"
"a1_299" = "312338431"
"a1_298" = "364025013"
"a3_769" = "1234824520"
"a1_600" = "2730689893"
"a2_668" = "494006454"
"a1_601" = "4186034925"
"a3_761" = "1143737968"
"a3_760" = "1170380241"
"a3_763" = "1191790386"
"a4_286" = "2050368606"
"a3_765" = "1206362100"
"a1_602" = "1208647494"
"a3_767" = "1186780342"
"a3_766" = "1179725847"
"a2_108" = "774262663"
"a2_109" = "781426854"
"a4_878" = "1999520942"
"a1_603" = "2108045771"
"a2_100" = "716904036"
"a2_101" = "724075964"
"a2_102" = "731243233"
"a2_103" = "738443654"
"a2_104" = "745591298"
"a2_105" = "752759529"
"a2_106" = "759935993"
"a2_107" = "767093980"
"a3_541" = "3861793492"
"a3_540" = "3887912629"
"a3_543" = "3909387158"
"a3_542" = "3868847991"
"a3_545" = "3923892392"
"a3_544" = "3916833801"
"a3_547" = "3904770410"
"a3_546" = "3897785547"
"a3_549" = "3952815660"
"a3_548" = "3945379213"
"a1_607" = "655219394"
"a1_589" = "3689657440"
"a1_588" = "3533049712"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a1_749" = "2735525507"
"a1_748" = "1352729905"
"a2_28" = "200731843"
"a2_29" = "207896929"
"a2_26" = "186395827"
"a2_27" = "193564646"
"a2_24" = "172060902"
"a2_25" = "179230257"
"a2_22" = "157727287"
"a2_23" = "164894856"
"a2_20" = "143389765"
"a2_21" = "150543935"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_917" = "2279116661"
"a4_916" = "2271947540"
"a4_911" = "2236101935"
"a4_910" = "2228932814"
"a4_913" = "2250440177"
"a4_912" = "2243271056"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a4_833" = "1676910497"
"a4_959" = "2580219743"
"a2_758" = "1139223957"
"a2_7" = "50176432"
"a2_6" = "43009046"
"a2_5" = "35843325"
"a2_4" = "28675174"
"a2_3" = "21509232"
"a2_2" = "14347247"
"a2_1" = "7160235"
"a2_0" = "6126"
"a1_639" = "978231601"
"a1_638" = "4163261122"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64526596"
"a2_8" = "57360034"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"
"a2_756" = "1124879983"
"a3_949" = "2491838908"
"a3_948" = "2484395293"
"a3_945" = "2462900280"
"a3_944" = "2455850905"
"a3_947" = "2510895354"
"a3_946" = "2503967835"
"a3_941" = "2467992228"
"a3_940" = "2427452933"
"a3_943" = "2482482022"
"a3_942" = "2474915527"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Aas]
"a3_875" = "1961196962"
"a1_532" = "3860851401"
"a1_533" = "466785955"
"a4_845" = "1762939949"
"a2_853" = "1820283928"
"a3_708" = "797636205"
"a4_923" = "2322131387"
"a3_970" = "2675785123"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 B0 24 FA E5 12 30 18 33 81 52 1E 81 84 5E D3"

[HKCU\Software\Aas]
"a1_968" = "3739883382"
"a4_689" = "644557073"
"a4_688" = "637387952"
"a1_951" = "4107508993"
"a4_685" = "615880589"
"a4_684" = "608711468"
"a4_687" = "630218831"
"a4_686" = "623049710"
"a4_681" = "587204105"
"a4_680" = "580034984"
"a4_683" = "601542347"
"a4_682" = "594373226"
"a3_831" = "1645985014"
"a3_830" = "1671960663"
"a3_833" = "1659958664"
"a3_832" = "1652904297"
"a3_835" = "1707934282"
"a1_538" = "1412736663"
"a3_837" = "1688886028"
"a3_836" = "1681434349"
"a3_839" = "1736479694"
"a3_838" = "1729494959"
"a1_539" = "289437714"
"a2_911" = "2236097000"
"a1_957" = "2331002560"
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"

[HKCU\Software\Aas\695404737]
"43014726" = "0700687474703A2F2F747863697265626F6E2E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F67656E6A692D73637265656E70726F746563746F722E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F796F75746265722E6869746F77792E706C2F6C6F676F2E67696600687474703A2F2F7A737A726970627964676F737A637A2E7A612E706C2F6C6F676F2E67696600687474703A2F2F7A6C6F746F2E6672696B6F2E706C2F6C6F676F2E67696600687474703A2F2F616E6A6F6D616E2E756173742D6D616C617965722E61632E69722F696D6167652F6C6F676F2E67696600687474703A2F2F6368676B2E67652F6C6F676F2E676966"

[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_897" = "2135734241"
"a4_898" = "2142903362"
"a4_899" = "2150072483"
"a2_560" = "4014706455"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a1_840" = "3720349719"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"

"a3_130" = "915379051"
"a1_923" = "2225120745"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a2_880" = "2013860427"
"a1_107" = "1588828912"
"a1_106" = "2112363356"
"a1_105" = "2601105552"
"a1_104" = "1800727740"
"a1_103" = "1491597530"
"a1_102" = "2157529087"
"a1_101" = "3641843191"
"a1_100" = "3098821164"
"a3_134" = "943841519"
"a1_109" = "2647664"
"a1_62" = "3408129811"
"a1_61" = "1357943664"
"a3_137" = "998890944"
"a2_883" = "2035360963"
"a3_686" = "606179783"
"a2_489" = "3505694246"
"a2_488" = "3498528527"
"a3_687" = "613616230"
"a2_485" = "3477025561"
"a2_484" = "3469860730"
"a2_487" = "3491360683"
"a2_486" = "3484191484"
"a2_481" = "3448356747"
"a2_480" = "3441168426"
"a2_483" = "3462691896"
"a2_482" = "3455509853"
"a3_974" = "2704311079"
"a3_685" = "632749476"
"a3_975" = "2711758662"
"a2_882" = "2028206012"
"a3_976" = "2685262841"
"a2_809" = "1504848089"
"a2_808" = "1497680991"
"a4_721" = "873968945"
"a3_680" = "596757377"
"a2_801" = "1447495022"
"a2_800" = "1440321524"
"a2_803" = "1461830293"
"a3_681" = "570649632"
"a2_805" = "1476181456"
"a2_804" = "1469014901"
"a2_807" = "1490515102"
"a2_806" = "1483349777"
"a3_145" = "1022800088"
"a3_972" = "2656717413"
"a3_144" = "1015749817"
"a2_885" = "2049710197"
"a3_973" = "2663771780"
"a3_147" = "1070844314"
"a2_661" = "443822606"
"a2_660" = "436654459"
"a2_663" = "458156937"
"a3_146" = "1063277947"
"a2_665" = "472492286"
"a2_664" = "465336777"
"a2_667" = "486838788"
"a2_666" = "479673792"
"a2_669" = "501172454"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a2_881" = "2021026674"
"a3_143" = "1008236550"
"a2_249" = "1785102862"
"a2_248" = "1777934968"
"a2_247" = "1770781120"
"a2_246" = "1763602209"
"a2_245" = "1756432338"
"a2_244" = "1749267106"
"a2_243" = "1742099629"
"a2_242" = "1734933997"
"a2_241" = "1727752423"
"a2_240" = "1720583122"
"a1_356" = "3434781868"
"a1_357" = "443360150"
"a1_354" = "3048084487"
"a1_355" = "3063616830"
"a1_352" = "1775711028"
"a1_353" = "856831918"
"a1_350" = "2568310467"
"a1_351" = "1484158789"
"a2_855" = "1834624514"
"a3_639" = "269411382"
"a1_358" = "3707113244"
"a1_359" = "1317386812"
"a3_638" = "295912343"
"a2_887" = "2064046476"
"a2_886" = "2056876764"
"a3_795" = "1387647762"
"a3_718" = "869065255"
"a3_719" = "843023942"
"a3_714" = "807050403"
"a3_715" = "813969602"
"a3_716" = "821548389"
"a3_717" = "862013828"
"a3_710" = "778506031"
"a3_711" = "785556302"
"a3_712" = "826034145"
"a3_713" = "833615872"
"a2_820" = "1583719833"
"a2_119" = "853117498"
"a2_118" = "845961824"
"a4_869" = "1934998853"
"a4_868" = "1927829732"
"a2_113" = "810111599"
"a2_112" = "802946272"
"a2_111" = "795775344"
"a2_110" = "788610791"
"a2_117" = "838794042"
"a2_116" = "831612193"
"a2_115" = "824446958"
"a2_114" = "817277230"
"a3_534" = "3844868223"
"a3_535" = "3852446878"
"a3_536" = "3825811761"
"a3_537" = "3832866128"
"a3_530" = "3816471291"
"a3_531" = "3823394586"
"a3_532" = "3797414845"
"a3_533" = "3804403676"
"a3_538" = "3840383475"
"a3_539" = "3880858130"
"a2_813" = "1533530415"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_628" = "223959005"
"a3_629" = "231000188"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422983548"
"a2_58" = "415804181"
"a2_53" = "379966178"
"a2_52" = "372799837"
"a2_51" = "365617796"
"a2_50" = "358449861"
"a2_57" = "408637276"
"a2_56" = "401461581"
"a2_55" = "394310568"
"a2_54" = "387135381"
"a4_842" = "1741432586"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Aas]
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"
"a1_644" = "498262197"
"a1_645" = "2080422184"
"a1_646" = "1304403860"
"a1_647" = "2990181146"
"a1_640" = "2820285756"
"a1_641" = "1678007294"
"a1_642" = "2560733667"
"a1_643" = "2636017406"
"a1_648" = "184480214"
"a1_649" = "428669013"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_953" = "2537208400"
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a4_784" = "1325623568"
"a4_785" = "1332792689"
"a4_786" = "1339961810"
"a4_787" = "1347130931"
"a4_780" = "1296947084"
"a4_781" = "1304116205"
"a4_782" = "1311285326"
"a4_783" = "1318454447"
"a1_828" = "3446482016"
"a1_829" = "3794060195"
"a4_788" = "1354300052"
"a3_451" = "3249847498"
"a4_670" = "508343774"
"a4_671" = "515512895"
"a4_672" = "522682016"
"a3_450" = "3242793131"
"a4_674" = "537020258"
"a4_675" = "544189379"
"a4_676" = "551358500"
"a4_677" = "558527621"
"a4_678" = "565696742"
"a1_604" = "4142660229"
"a1_916" = "2315650637"
"a1_917" = "3231622406"
"a1_910" = "2849351041"
"a1_911" = "806278576"
"a1_912" = "2687286985"
"a1_913" = "2235529662"
"a3_844" = "1772455397"
"a3_845" = "1746353668"
"a3_846" = "1753404071"
"a3_847" = "1760327366"
"a3_840" = "1743926369"
"a3_841" = "1717414016"
"a3_842" = "1724861731"
"a3_843" = "1765466434"
"a3_848" = "1801448313"
"a3_849" = "1808437144"
"a3_702" = "721038295"
"a4_874" = "1970844458"
"a1_654" = "1198596208"
"a4_961" = "2594557985"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a3_806" = "1500078927"
"a3_807" = "1507067886"
"a1_138" = "3628546548"
"a1_139" = "1313151717"
"a3_907" = "2190592386"
"a1_132" = "2391637834"
"a1_133" = "719773744"
"a1_130" = "3232875318"
"a1_131" = "2116582609"
"a1_136" = "3434356140"
"a1_137" = "843583109"
"a1_134" = "1625641467"
"a1_135" = "1015348629"
"a3_768" = "1227770153"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_528" = "3785295888"
"a4_529" = "3792465009"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a3_909" = "2238580292"
"a2_470" = "3369489085"
"a2_471" = "3376658040"
"a2_472" = "3383823974"
"a2_473" = "3390991958"
"a2_474" = "3398156871"
"a2_475" = "3405325804"
"a2_476" = "3412507631"
"a2_477" = "3419673862"
"a2_478" = "3426831935"
"a2_479" = "3434017362"
"a4_880" = "2013859184"
"a3_908" = "2231591461"
"a1_797" = "417592225"
"a2_878" = "1999527629"
"a2_879" = "2006681812"
"a2_874" = "1970840941"
"a2_875" = "1978008236"
"a2_876" = "1985178883"
"a2_877" = "1992357914"
"a2_870" = "1942174833"
"a2_871" = "1949343519"
"a2_872" = "1956509479"
"a2_873" = "1963683834"
"a1_349" = "2541034893"
"a1_348" = "1766534281"
"a2_586" = "4201111440"
"a2_587" = "4208275510"
"a2_580" = "4158094371"
"a2_581" = "4165257993"
"a2_582" = "4172425694"
"a2_583" = "4179595224"
"a1_341" = "2528344142"
"a1_340" = "521911802"
"a1_343" = "906247842"
"a1_342" = "3215763912"
"a1_345" = "1120186319"
"a1_344" = "3494279805"
"a1_347" = "3273990434"
"a1_346" = "568854182"
"a2_614" = "106878490"
"a2_615" = "114045632"
"a2_616" = "121213597"
"a2_617" = "128381468"
"a2_610" = "78192017"
"a2_611" = "85364443"
"a2_612" = "92532603"
"a2_613" = "99698212"
"a2_618" = "135547737"
"a2_619" = "142716749"
"a2_272" = "1950006857"
"a2_273" = "1957171230"
"a2_270" = "1935657085"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a2_276" = "1978672369"
"a2_277" = "1985839781"
"a2_274" = "1964330239"
"a2_275" = "1971503759"
"a2_908" = "2214598107"
"a2_909" = "2221766237"
"a2_278" = "1993021073"
"a2_279" = "2000187646"
"a1_842" = "57353654"
"a2_298" = "2136395136"
"a2_299" = "2143558954"
"a1_841" = "935614710"
"a2_290" = "2079037397"
"a2_291" = "2086222020"
"a2_292" = "2093377342"
"a2_293" = "2100559658"
"a2_294" = "2107724104"
"a2_295" = "2114892560"
"a2_296" = "2122058711"
"a2_297" = "2129224786"
"a2_728" = "924151086"
"a2_729" = "931318778"
"a2_720" = "866797555"
"a2_721" = "873960784"
"a2_722" = "881131573"
"a2_723" = "888301184"
"a2_724" = "895481911"
"a2_725" = "902651562"
"a2_726" = "909815866"
"a2_727" = "916984225"
"a1_594" = "2489987655"
"a4_450" = "3226104450"
"a3_791" = "1392659870"
"a3_709" = "804547212"
"a4_451" = "3233273571"
"a3_707" = "790584778"
"a3_706" = "749582763"
"a3_705" = "742524168"
"a3_704" = "769089769"
"a3_703" = "761646198"
"a4_452" = "3240442692"
"a3_701" = "713602996"
"a3_700" = "706548501"
"a4_890" = "2085550394"
"a4_891" = "2092719515"
"a4_892" = "2099888636"
"a4_453" = "3247611813"
"a4_894" = "2114226878"
"a4_895" = "2121395999"
"a2_128" = "917647056"
"a2_129" = "924812119"
"a2_126" = "903314321"
"a2_127" = "910481687"
"a2_124" = "888963235"
"a2_125" = "896144865"
"a2_122" = "874640573"
"a2_123" = "881797995"
"a2_120" = "860295488"
"a2_121" = "867455922"
"a3_35" = "267899754"
"a3_526" = "3787937127"
"a3_525" = "3780489412"
"a3_524" = "3739884709"
"a3_523" = "3732895746"
"a4_456" = "3269119176"
"a3_521" = "3751945024"
"a3_520" = "3744501537"
"a2_824" = "1612383107"
"a4_457" = "3276288297"
"a3_529" = "3809412696"
"a3_528" = "3768345145"
"a1_12" = "2922934524"
"a1_13" = "4169367219"
"a1_10" = "3281493680"
"a1_11" = "3915843160"
"a1_16" = "1857383759"
"a1_17" = "517682222"
"a1_14" = "1205768603"
"a1_15" = "1427402599"
"a1_18" = "2596947055"
"a1_19" = "2598710265"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_896" = "2128561206"
"a2_48" = "344125872"
"a2_49" = "351284090"
"a1_846" = "1936467449"
"a2_40" = "286766801"
"a2_41" = "293931398"
"a2_42" = "301100729"
"a2_43" = "308265441"
"a2_44" = "315449226"
"a2_45" = "322616471"
"a2_46" = "329782465"
"a2_47" = "336950628"
"a2_897" = "2135730824"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a1_657" = "3746051246"
"a1_656" = "1611199179"
"a1_655" = "3934775109"
"a1_632" = "39152957"
"a1_653" = "3328646066"
"a1_652" = "3643235410"
"a1_651" = "767564385"
"a1_650" = "2969239569"
"a3_796" = "1428649909"
"a1_659" = "2361482105"
"a1_658" = "862737811"
"a3_797" = "1435691988"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a4_886" = "2056873910"
"a3_793" = "1406704208"
"a3_809" = "1488018592"
"a3_798" = "1442679927"
"a3_799" = "1416568982"
"a3_248" = "1761236945"
"a2_172" = "1233086072"
"a4_797" = "1418822141"
"a4_796" = "1411653020"
"a4_795" = "1404483899"
"a4_794" = "1397314778"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Aas]
"a4_792" = "1382976536"
"a4_791" = "1375807415"
"a4_790" = "1368638294"
"a1_839" = "2738914651"
"a1_838" = "1071437366"
"a4_799" = "1433160383"
"a4_798" = "1425991262"
"a4_663" = "458159927"
"a4_662" = "450990806"
"a4_661" = "443821685"
"a4_660" = "436652564"
"a4_667" = "486836411"
"a4_666" = "479667290"
"a4_665" = "472498169"
"a4_664" = "465329048"
"a1_907" = "1040133653"
"a1_906" = "62095860"
"a4_669" = "501174653"
"a4_668" = "494005532"
"a1_903" = "251521953"
"a1_902" = "2028393104"
"a1_901" = "1073146170"
"a1_900" = "983500947"
"a3_857" = "1865835152"
"a3_856" = "1824837233"
"a3_855" = "1817794014"
"a3_854" = "1844425151"
"a3_853" = "1836850460"
"a3_852" = "1829861629"
"a3_851" = "1789379674"
"a3_850" = "1781801019"
"a1_635" = "2824480303"
"a4_949" = "2508528533"
"a3_859" = "1846328146"
"a3_858" = "1872824115"
"a1_734" = "617146732"
"a2_644" = "321952340"
"a4_976" = "2702094800"
"a4_454" = "3254780934"
"a1_524" = "444734114"
"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a1_825" = "1923241805"
"a1_879" = "822598087"
"a3_640" = "276404393"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a3_641" = "283851976"
"a3_646" = "352855791"
"a3_647" = "360438542"
"a4_789" = "1361469173"
"a1_129" = "4064494287"
"a1_128" = "1470891838"
"a1_125" = "1380254675"
"a1_124" = "1380202629"
"a1_127" = "2942271826"
"a1_126" = "2400866992"
"a1_121" = "2448620759"
"a1_120" = "299592718"
"a1_123" = "472552534"
"a1_122" = "3120403076"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a1_833" = "119627226"
"a4_539" = "3864156219"
"a4_538" = "3856987098"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a1_832" = "4067355900"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"
"a1_830" = "1520977440"
"a4_793" = "1390145657"
"a1_836" = "2241640329"
"a1_835" = "1399807821"
"a1_754" = "447206300"
"a1_834" = "265234786"
"a1_634" = "1495093520"
"a2_463" = "3319304460"
"a2_462" = "3312139545"
"a2_461" = "3304969458"
"a2_460" = "3297790445"
"a2_467" = "3347972173"
"a2_466" = "3340804109"
"a2_465" = "3333649776"
"a2_464" = "3326475369"
"a2_469" = "3362324267"
"a2_468" = "3355155731"
"a1_934" = "493024612"
"a4_802" = "1454667746"
"a4_872" = "1956506216"
"a2_869" = "1934991936"
"a2_868" = "1927839022"
"a2_867" = "1920656288"
"a2_866" = "1913491188"
"a2_865" = "1906313393"
"a2_864" = "1899156072"
"a2_863" = "1891976956"
"a1_791" = "1290741219"
"a2_861" = "1877640240"
"a2_860" = "1870475199"
"a2_597" = "4279962042"
"a2_596" = "4272794291"
"a2_595" = "4265635212"
"a2_594" = "4258460529"
"a1_338" = "3970221133"
"a1_339" = "2742084470"
"a2_591" = "4236947060"
"a2_590" = "4229788767"
"a1_334" = "357076661"
"a1_335" = "3800052884"
"a1_336" = "3656111854"
"a1_337" = "3287223933"
"a1_330" = "3205776824"
"a1_331" = "2845115821"
"a1_332" = "4015324830"
"a1_333" = "4008466835"
"a2_607" = "56696532"
"a2_606" = "49515150"
"a3_30" = "231909751"
"a2_604" = "35179148"
"a1_64" = "1106168820"
"a2_602" = "20852001"
"a2_601" = "13665956"
"a2_600" = "6509845"
"a4_875" = "1978013579"
"a2_609" = "71029905"
"a2_608" = "63861545"
"a2_265" = "1899820538"
"a2_264" = "1892653177"
"a2_267" = "1914153048"
"a2_266" = "1906987609"
"a2_261" = "1871137850"
"a2_260" = "1863968223"
"a2_263" = "1885471224"
"a2_262" = "1878302937"
"a2_919" = "2293449499"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a2_269" = "1928486274"
"a2_268" = "1921321323"
"a1_905" = "1414047679"
"a2_884" = "2042543765"
"a1_482" = "1868468876"
"a1_483" = "2114769757"
"a2_289" = "2071873626"
"a2_288" = "2064708657"
"a1_486" = "419472504"
"a1_487" = "2942793646"
"a1_484" = "2185598163"
"a1_485" = "2889024730"
"a2_283" = "2028859382"
"a2_282" = "2021690293"
"a2_281" = "2014525741"
"a2_280" = "2007356135"
"a2_287" = "2057539992"
"a2_286" = "2050373905"
"a2_285" = "2043193567"
"a2_284" = "2036026768"
"a2_739" = "1003016459"
"a2_738" = "995836209"
"a3_522" = "3725445091"
"a2_733" = "960001130"
"a2_732" = "952832151"
"a2_731" = "945666401"
"a2_730" = "938485605"
"a2_737" = "988668790"
"a2_736" = "981503381"
"a2_735" = "974334969"
"a2_734" = "967175631"
"a4_446" = "3197427966"
"a1_637" = "1592519172"
"a3_912" = "2226582457"
"a1_240" = "2402590877"
"a1_241" = "2515444844"
"a1_242" = "780525705"
"a1_243" = "3143972392"
"a1_244" = "659327533"
"a1_245" = "2571327880"
"a1_246" = "271899257"
"a1_247" = "1859579337"
"a1_248" = "2677961286"
"a1_249" = "519140608"
"a3_738" = "978859403"
"a3_739" = "986426922"
"a4_445" = "3190258845"
"a2_131" = "939147549"
"a2_130" = "931982347"
"a2_133" = "953484839"
"a2_132" = "946332099"
"a2_135" = "967831850"
"a2_134" = "960669975"
"a2_137" = "982166619"
"a2_136" = "974998045"
"a2_139" = "996514156"
"a2_138" = "989332959"
"a4_889" = "2078381273"
"a4_888" = "2071212152"
"a2_79" = "566354167"
"a2_78" = "559188161"
"a3_916" = "2254979389"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_917" = "2262558044"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_606" = "66123703"
"a3_607" = "40004566"
"a3_604" = "52150005"
"a3_605" = "59069204"
"a3_602" = "4023859"
"a3_603" = "11016786"
"a3_600" = "23079281"
"a3_601" = "30657936"
"a4_700" = "723417404"
"a3_608" = "46992457"
"a3_609" = "87597288"
"a1_796" = "284985384"
"a1_583" = "663312796"
"a1_794" = "2695650322"
"a1_795" = "236213310"
"a1_792" = "1212737358"
"a1_793" = "3289619247"
"a1_790" = "1274385681"
"a1_582" = "4282966213"
"a3_635" = "240424626"
"a3_911" = "2219532038"
"a1_581" = "93383000"
"a1_798" = "1709025263"
"a1_799" = "3826203106"
"a1_580" = "2059542906"
"a3_198" = "1436076335"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a2_981" = "2737931650"
"a1_585" = "2623839217"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "2154099464"
"a1_469" = "1711307647"
"a3_518" = "3696916079"
"a3_519" = "3703958158"
"a1_460" = "1785030930"
"a1_461" = "984813556"
"a1_462" = "2443451792"
"a1_463" = "661783094"
"a1_464" = "4167501572"
"a1_465" = "3461088105"
"a1_466" = "1024764743"
"a1_467" = "4205205924"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a1_668" = "1908983109"
"a1_669" = "1507008207"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a2_830" = "1655400843"
"a1_885" = "948492009"
"a3_499" = "3560555322"
"a2_831" = "1662569448"
"a3_498" = "3587059355"
"a2_832" = "1669736446"
"a3_497" = "3579611768"
"a2_833" = "1676902950"
"a3_496" = "3539014105"
"a2_834" = "1684086373"
"a3_495" = "3532029350"
"a2_835" = "1691254628"
"a4_955" = "2551543259"
"a3_494" = "3524581639"
"a2_836" = "1698425102"
"a3_493" = "3551077604"
"a2_837" = "1705585261"
"a3_492" = "3544154181"
"a3_491" = "3503090722"
"a1_837" = "389276474"
"a3_527" = "3761424774"
"a3_490" = "3496037251"
"a3_775" = "1244236686"
"a4_915" = "2264778419"
"a3_868" = "1944793805"
"a3_869" = "1918293868"
"a4_914" = "2257609298"
"a3_862" = "1901368503"
"a3_863" = "1908803798"
"a3_860" = "1853775861"
"a3_861" = "1860825108"
"a3_866" = "1930361355"
"a3_867" = "1937350314"
"a3_864" = "1882303817"
"a3_865" = "1889747432"
"a1_806" = "334592860"
"a1_807" = "734699922"
"a1_804" = "3628874738"
"a1_805" = "2679934556"
"a1_802" = "3635153807"
"a1_803" = "2088081934"
"a1_800" = "938948878"
"a1_801" = "2145103415"
"a1_808" = "2882130227"
"a1_809" = "1071613911"
"a4_656" = "407976080"
"a4_657" = "415145201"
"a4_654" = "393637838"
"a4_655" = "400806959"
"a4_652" = "379299596"
"a4_653" = "386468717"
"a4_650" = "364961354"
"a4_651" = "372130475"
"a1_938" = "1956342596"
"a1_939" = "2787624850"
"a4_658" = "422314322"
"a4_659" = "429483443"
"a3_773" = "1263760076"
"a4_849" = "1791616433"
"a4_919" = "2293454903"
"a4_918" = "2286285782"
"a2_656" = "407971181"
"a1_875" = "2897240534"
"a4_925" = "2336469629"
"a3_762" = "1151312531"
"a1_684" = "3071282662"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a1_874" = "4165321335"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a3_928" = "2374546825"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a3_764" = "1198848853"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a4_508" = "3641913468"
"a4_509" = "3649082589"
"a4_506" = "3627575226"
"a4_507" = "3634744347"
"a4_504" = "3613236984"
"a4_505" = "3620406105"
"a4_502" = "3598898742"
"a4_503" = "3606067863"
"a4_500" = "3584560500"
"a4_501" = "3591729621"
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a4_882" = "2028197426"
"a3_381" = "2748124788"
"a2_456" = "3269101969"
"a2_457" = "3276286196"
"a2_454" = "3254784877"
"a3_380" = "2741212629"
"a2_452" = "3240439771"
"a2_453" = "3247604995"
"a2_450" = "3226102069"
"a2_451" = "3233268053"
"a3_387" = "2757612682"
"a3_633" = "259938800"
"a2_458" = "3283452553"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a4_881" = "2021028305"
"a3_384" = "2769681321"
"a1_735" = "2094877367"
"a2_852" = "1813122956"
"a1_730" = "578532176"
"a2_850" = "1798789047"
"a2_851" = "1805945785"
"a2_856" = "1841806423"
"a2_857" = "1848979110"
"a2_854" = "1827455369"
"a1_731" = "1197060402"
"a3_632" = "252486993"
"a2_858" = "1856139281"
"a2_859" = "1863316657"
"a1_732" = "2894520296"
"a2_714" = "823779485"
"a1_733" = "1152441351"
"a1_329" = "1452088536"
"a1_328" = "3445622782"
"a1_327" = "1437288870"
"a1_326" = "293794356"
"a1_325" = "468161404"
"a1_324" = "326653310"
"a1_323" = "826160504"
"a1_322" = "2246764464"
"a1_321" = "3209379859"
"a1_320" = "2818056046"
"a2_650" = "364954592"
"a1_436" = "4198956867"
"a1_736" = "2695282617"
"a3_631" = "211878206"
"a1_737" = "3482205439"
"a2_652" = "379291067"
"a3_923" = "2339079058"
"a2_926" = "2343635857"
"a2_927" = "2350802484"
"a2_924" = "2329301848"
"a2_653" = "386477735"
"a4_887" = "2064043031"
"a2_923" = "2322133978"
"a2_920" = "2300617796"
"a2_921" = "2307784717"
"a2_654" = "393638444"
"a2_928" = "2357969938"
"a2_655" = "400804996"
"a1_908" = "620878789"
"a3_630" = "204893343"
"a2_657" = "415139305"
"a3_922" = "2298015603"
"a1_495" = "3504908241"
"a1_494" = "2940970647"
"a1_497" = "1553128143"
"a1_496" = "1837160101"
"a1_491" = "1026090719"
"a1_490" = "1049391335"
"a1_493" = "2910033560"
"a1_492" = "1162610739"
"a1_499" = "355111773"
"a1_498" = "2002361066"
"a3_637" = "288468852"
"a2_708" = "780765867"
"a2_709" = "787946117"
"a2_706" = "766431060"
"a2_707" = "773598915"
"a2_704" = "752101399"
"a2_705" = "759263766"
"a2_702" = "737762605"
"a2_703" = "744929606"
"a2_700" = "723410166"
"a2_701" = "730579975"
"a4_885" = "2049704789"
"a2_638" = "278933603"
"a2_639" = "286104722"
"a3_808" = "1481095169"
"a2_632" = "235918729"
"a2_633" = "243084681"
"a2_630" = "221585261"
"a2_631" = "228752927"
"a2_636" = "264599910"
"a2_637" = "271769479"
"a2_634" = "250249724"
"a2_635" = "257416476"
"a1_253" = "3017088099"
"a1_252" = "1058883106"
"a1_251" = "1540802473"
"a1_250" = "2447139708"
"a1_257" = "722717369"
"a1_256" = "1794735986"
"a1_255" = "2846896612"
"a1_254" = "3705911056"
"a3_920" = "2284050097"
"a1_259" = "637498807"
"a1_258" = "1410811372"
"a3_729" = "914469392"
"a3_728" = "907418097"
"a4_884" = "2042535668"
"a2_144" = "1032350631"
"a2_145" = "1039515918"
"a2_146" = "1046682751"
"a2_147" = "1053867296"
"a2_140" = "1003683429"
"a2_141" = "1010847979"
"a2_142" = "1018016821"
"a2_143" = "1025182160"
"a1_781" = "2268024918"
"a1_780" = "2013856089"
"a2_68" = "487492622"
"a2_69" = "494671976"
"a2_148" = "1061032939"
"a2_149" = "1068200318"
"a1_787" = "1260972142"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a1_904" = "2234285561"
"a3_634" = "266990099"
"a3_619" = "159571106"
"a3_618" = "152516611"
"a3_611" = "68549034"
"a3_610" = "95044875"
"a3_613" = "82982508"
"a3_612" = "75537869"
"a3_615" = "131026734"
"a3_614" = "123579023"

"a3_616" = "104522561"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "3195246281"
"a1_478" = "1810152007"
"a3_509" = "3632529140"
"a3_508" = "3624950357"
"a1_473" = "3184598409"
"a1_472" = "1293367937"
"a1_471" = "1455846226"
"a1_470" = "3869535311"
"a1_477" = "1099233537"
"a1_476" = "1292006549"
"a1_475" = "1674466955"
"a1_474" = "1723920773"
"a4_533" = "3821141493"
"a1_679" = "2164749066"
"a1_678" = "1331045978"
"a4_532" = "3813972372"
"a1_675" = "803457933"
"a1_674" = "2860090840"
"a1_677" = "930363198"
"a1_676" = "290470523"
"a1_671" = "1564561506"
"a4_531" = "3806803251"
"a1_673" = "2015453115"
"a1_672" = "376065169"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_530" = "3799634130"
"a4_537" = "3849817977"
"a4_536" = "3842648856"
"a1_868" = "582790584"
"a4_535" = "3835479735"
"a3_981" = "2721238428"
"a3_980" = "2747738493"
"a3_983" = "2769230430"
"a4_534" = "3828310614"
"a3_985" = "2783204112"
"a3_984" = "2776284913"
"a2_151" = "1082534864"
"a2_150" = "1075365553"
"a1_869" = "132554347"
"a2_271" = "1942839280"
"a3_879" = "1989722918"
"a3_878" = "1982672519"
"a1_823" = "3572064860"
"a3_874" = "1954273539"
"a3_877" = "2009303652"
"a3_876" = "2001736133"
"a3_871" = "1966337070"
"a3_870" = "1925204879"
"a3_873" = "1946690784"
"a3_872" = "1973321793"
"a2_159" = "1139884414"
"a4_758" = "1139226422"
"a2_158" = "1132716894"
"a1_925" = "3230026761"
"a1_924" = "2181322918"
"a1_927" = "3290890602"
"a1_926" = "3302059515"
"a1_921" = "330089843"
"a1_920" = "463290918"
"a3_787" = "1363737626"
"a1_922" = "2207428099"
"a3_80" = "590099577"
"a1_929" = "933507676"
"a1_928" = "3993530908"
"a4_649" = "357792233"
"a4_648" = "350623112"
"a4_641" = "300439265"
"a4_640" = "293270144"
"a4_643" = "314777507"
"a4_642" = "307608386"
"a4_645" = "329115749"
"a4_644" = "321946628"
"a4_647" = "343453991"
"a4_646" = "336284870"
"a3_786" = "1323129851"
"a1_819" = "345461801"
"a1_818" = "2001629516"
"a3_785" = "1316202328"
"a3_746" = "1069934723"
"a1_811" = "1176359954"
"a1_810" = "3415878494"
"a1_813" = "1839074685"
"a1_812" = "1526795906"
"a1_815" = "1727383186"
"a1_814" = "2205711139"
"a1_817" = "3124704345"
"a1_816" = "227867533"
"a4_963" = "2608896227"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"
"a3_743" = "1014841262"
"a3_745" = "1062892640"
"a3_742" = "1007917839"
"a4_967" = "2637572711"
"a3_741" = "1033955052"
"a2_802" = "1454664595"
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a3_747" = "1043369250"
"a4_359" = "2573714439"
"a4_358" = "2566545318"
"a4_511" = "3663420831"
"a4_510" = "3656251710"
"a4_513" = "3677759073"
"a4_512" = "3670589952"
"a4_515" = "3692097315"
"a4_514" = "3684928194"
"a4_517" = "3706435557"
"a4_516" = "3699266436"
"a4_519" = "3720773799"
"a4_518" = "3713604678"
"a3_744" = "1021891521"
"a3_749" = "1091421668"

[HKCU\Software\Aas\695404737]
"50183847" = "31A3F08575516963CF600FD24D1E42B121C858023A008E530EE8AE0357CA2B963062D64AC958C1A70F7D89BC940B96490928D04696263F96215C45832789E7B48C22A5AA92DC925D8B9BC1B7D8C632DADB5A9D1DA001C0EE092508B3F990883DC81C8743B0D6A7305D37F80F86B73F87308A47CBC84E060F3AE159AB9FDB306F"

[HKCU\Software\Aas]
"a2_845" = "1762938690"
"a2_844" = "1755761107"
"a2_847" = "1777273221"
"a2_846" = "1770104107"
"a2_841" = "1734269473"
"a2_840" = "1727088663"
"a2_843" = "1748603211"
"a2_842" = "1741437990"
"a3_780" = "1280228773"
"a4_928" = "2357976992"
"a2_849" = "1791623166"
"a2_848" = "1784452723"
"a1_312" = "1735265158"
"a1_313" = "1872752687"
"a1_310" = "2446011663"
"a1_311" = "841345544"
"a1_316" = "2058401140"
"a1_317" = "2811065431"
"a1_314" = "1734368563"
"a1_315" = "837382688"
"a3_620" = "166490309"
"a1_318" = "3193167278"
"a1_319" = "1971685316"
"a4_929" = "2365146113"
"a4_982" = "2745109526"
"a2_449" = "3218936308"
"a2_448" = "3211767898"
"a3_621" = "140449124"
"a2_441" = "3161574222"
"a2_440" = "3154416499"
"a2_443" = "3175917233"
"a2_442" = "3168753637"
"a2_445" = "3190253245"
"a2_444" = "3183084489"
"a2_447" = "3204602045"
"a2_446" = "3197433745"
"a2_939" = "2436839516"
"a2_938" = "2429670741"
"a4_893" = "2107057757"
"a2_931" = "2379485924"
"a2_930" = "2372307377"
"a2_933" = "2393819168"
"a2_932" = "2386650265"
"a2_935" = "2408154910"
"a2_934" = "2400986753"
"a2_937" = "2422505107"
"a2_936" = "2415334591"
"a3_818" = "1552537563"
"a2_711" = "802279612"
"a2_710" = "795100417"
"a2_713" = "816614521"
"a2_712" = "809449127"
"a2_715" = "830961712"
"a1_510" = "1109574560"
"a2_717" = "845299006"
"a2_716" = "838116460"
"a2_719" = "859632696"
"a2_718" = "852469769"
"a1_587" = "3123766229"
"a3_623" = "187965990"
"a2_629" = "214417335"
"a2_628" = "207236683"
"a2_625" = "185731223"
"a2_624" = "178565594"
"a2_627" = "200068612"
"a2_626" = "192900068"
"a2_621" = "157051192"
"a2_620" = "149882757"
"a2_623" = "171403328"
"a2_622" = "164230187"
"a1_266" = "2509974244"
"a1_267" = "3213400946"
"a1_264" = "3867568564"
"a1_265" = "455578662"
"a1_262" = "373600635"
"a1_263" = "935374327"
"a1_260" = "887817558"
"a1_261" = "3512641369"
"a1_268" = "3447181021"
"a1_269" = "2817014480"
"a2_157" = "1125559306"
"a2_156" = "1118385143"
"a2_155" = "1111188716"
"a2_154" = "1104050372"
"a2_153" = "1096867716"
"a2_152" = "1089702949"
"a2_99" = "709751540"
"a2_98" = "702578285"
"a2_97" = "695406838"
"a2_96" = "688240867"
"a2_95" = "681057490"
"a2_94" = "673891493"
"a2_93" = "666722495"
"a2_92" = "659558199"
"a2_91" = "652391007"
"a2_90" = "645222892"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a1_915" = "1447251713"
"a1_847" = "3445607462"
"a3_404" = "2913010493"
"a1_844" = "3645458801"
"a3_405" = "2886510428"
"a1_845" = "985234527"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_862" = "1884808183"
"a4_983" = "2752278647"
"a1_961" = "1206476946"
"a3_668" = "477267765"
"a3_669" = "484195156"
"a1_960" = "729736013"
"a3_664" = "448737713"
"a3_665" = "489346512"
"a3_666" = "496258675"
"a3_667" = "470278802"
"a3_660" = "453353533"
"a3_661" = "460801116"
"a3_662" = "467859711"
"a3_663" = "441294110"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a1_965" = "126659355"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a1_964" = "1643074948"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a1_448" = "3528813700"
"a1_449" = "1706744477"
"a1_446" = "1058962508"
"a3_408" = "2941554865"
"a1_444" = "3034635906"
"a1_445" = "3225444640"
"a1_442" = "3895212590"
"a1_443" = "1211122279"
"a1_440" = "2479749093"
"a3_409" = "2949002448"
"a1_680" = "2442907533"
"a1_681" = "2754162141"
"a1_682" = "550249839"
"a1_683" = "1500075413"
"a2_561" = "4021871346"
"a1_685" = "3203792864"
"a1_686" = "1078656828"
"a1_687" = "4218618136"
"a1_688" = "3993014018"
"a1_689" = "4090094255"

"a3_834" = "1700949547"
"a1_767" = "421376037"
"a1_766" = "1257019493"
"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a2_599" = "4294298096"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_933" = "2410528684"
"a3_934" = "2384417743"
"a1_760" = "1917122885"
"a2_605" = "42344672"
"a3_935" = "2391471214"
"a3_476" = "3395669621"
"a1_447" = "2893618149"
"a2_603" = "28011416"
"a3_880" = "2030724953"
"a3_881" = "2037718008"
"a3_882" = "2044771355"
"a3_883" = "2018660538"
"a3_884" = "2025714909"
"a3_885" = "2066704764"
"a3_886" = "2073693599"
"a1_745" = "2395007223"
"a3_888" = "2054642257"
"a3_889" = "2061696752"
"a1_769" = "441113462"
"a1_441" = "1191363392"
"a4_964" = "2616065348"
"a1_744" = "2715468469"
"a4_857" = "1848969401"
"a4_638" = "278931902"
"a4_639" = "286101023"
"a4_634" = "250255418"
"a4_635" = "257424539"
"a4_636" = "264593660"
"a4_637" = "271762781"
"a4_630" = "221578934"
"a4_631" = "228748055"
"a4_632" = "235917176"
"a4_633" = "243086297"
"a2_913" = "2250434461"
"a1_747" = "2231109958"
"a2_912" = "2243279231"

"a2_651" = "372135355"
"a2_910" = "2228931323"
"a3_794" = "1380597491"

[HKCU\Software\Aas\695404737]
"35845605" = "264"

[HKCU\Software\Aas]
"a2_917" = "2279118776"
"a4_883" = "2035366547"
"a2_509" = "3649077687"
"a4_740" = "1010182244"
"a4_741" = "1017351365"
"a4_742" = "1024520486"
"a4_743" = "1031689607"
"a4_744" = "1038858728"
"a4_745" = "1046027849"
"a4_746" = "1053196970"
"a4_747" = "1060366091"
"a4_748" = "1067535212"
"a4_749" = "1074704333"
"a1_866" = "3300664445"
"a1_867" = "2332335682"
"a1_860" = "194310935"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Aas]
"a1_862" = "4174153764"
"a4_859" = "1863307643"
"a4_182" = "1304780022"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a1_741" = "3426664367"
"a2_918" = "2286283505"
"a4_168" = "1204412328"
"a1_194" = "2544617022"
"a1_195" = "949401949"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a3_952" = "2546868881"
"a4_568" = "4072060728"
"a4_569" = "4079229849"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a2_598" = "4287131074"
"a1_192" = "127246774"
"a1_193" = "2897595004"
"a1_969" = "3304979766"
"a4_934" = "2400991718"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_790" = "1351657855"
"a4_958" = "2573050622"
"a1_742" = "1294064370"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a3_505" = "3603458416"
"a1_305" = "3109191655"
"a1_304" = "1391510091"
"a1_307" = "328418570"
"a1_306" = "1193681575"
"a1_301" = "3281474746"
"a1_300" = "3409014806"
"a1_303" = "281271270"
"a1_302" = "4232255009"
"a3_792" = "1399711281"
"a1_309" = "4232133548"
"a1_308" = "652684686"
"a2_540" = "3871318468"
"a2_541" = "3878502061"
"a2_542" = "3885670225"
"a1_481" = "1155689469"
"a2_544" = "3900003183"
"a2_545" = "3907167249"
"a2_546" = "3914336903"
"a2_547" = "3921502083"
"a2_548" = "3928686307"
"a2_549" = "3935854046"
"a2_894" = "2114235125"
"a2_895" = "2121386808"
"a2_892" = "2099893853"
"a2_893" = "2107063984"
"a2_890" = "2085542469"
"a2_891" = "2092714875"
"a2_438" = "3140067640"
"a2_439" = "3147250637"
"a2_434" = "3111402396"
"a2_435" = "3118565308"
"a2_436" = "3125735129"
"a2_437" = "3132900107"
"a2_430" = "3082715342"
"a2_431" = "3089883318"
"a2_432" = "3097064780"
"a2_433" = "3104203336"
"a2_948" = "2501356403"
"a2_949" = "2508536486"
"a4_908" = "2214594572"
"a2_944" = "2472674821"
"a2_945" = "2479854881"
"a2_946" = "2487022480"
"a2_947" = "2494188336"
"a2_940" = "2444004747"
"a1_488" = "3658395806"
"a2_942" = "2458337713"
"a2_943" = "2465521137"
"a1_279" = "3783503052"
"a1_278" = "2551129103"
"a1_489" = "2273469427"
"a1_271" = "1651668838"
"a1_270" = "3771646795"
"a1_273" = "2060527633"
"a1_272" = "4105160542"
"a1_275" = "1308340987"
"a1_274" = "3335992809"
"a1_277" = "1852447273"
"a1_276" = "1324046810"
"a2_764" = "1182240682"
"a2_765" = "1189404994"
"a2_766" = "1196573779"
"a2_767" = "1203742847"
"a2_760" = "1153557851"
"a2_761" = "1160736886"
"a2_762" = "1167905363"
"a2_763" = "1175074532"
"a2_768" = "1210924990"
"a2_769" = "1218093694"
"a2_382" = "2738613185"
"a2_383" = "2745775742"
"a2_380" = "2724258910"
"a2_381" = "2731441060"
"a2_386" = "2767275802"
"a2_387" = "2774442260"
"a2_384" = "2752950957"
"a2_385" = "2760108134"
"a2_388" = "2781610798"
"a2_389" = "2788794338"
"a1_613" = "2237802000"
"a1_612" = "3592091135"
"a1_611" = "2790239480"
"a2_368" = "2638238915"
"a2_369" = "2645407242"
"a1_610" = "1385291422"
"a2_88" = "630890877"
"a2_89" = "638057327"
"a2_84" = "602208079"
"a2_85" = "609384216"
"a2_86" = "616539712"
"a2_87" = "623707384"
"a2_80" = "573523997"
"a2_81" = "580703288"
"a2_82" = "587873549"
"a2_83" = "595039338"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161402757"
"a2_163" = "1168558964"
"a3_279" = "1983582110"
"a3_278" = "2009623423"
"a2_166" = "1190071116"
"a2_167" = "1197235760"
"a2_164" = "1175739180"
"a2_165" = "1182903509"
"a3_690" = "668723035"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Aas]
"a3_679" = "589715310"
"a1_666" = "205562502"
"a3_677" = "541662892"
"a3_676" = "568228365"
"a3_675" = "560775658"
"a3_674" = "553725259"
"a3_673" = "513247528"
"a3_672" = "505681033"
"a3_671" = "532246550"
"a3_670" = "525328375"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "4002485400"
"a1_450" = "1524389595"
"a1_453" = "4096605595"
"a1_452" = "3226269247"
"a1_455" = "1707587543"
"a1_454" = "4039819588"
"a1_457" = "918337770"
"a1_456" = "2337853926"
"a1_459" = "2616660829"
"a1_458" = "1411118810"
"a1_693" = "2776384595"
"a1_692" = "549796378"
"a1_691" = "2950707821"
"a1_690" = "1146520304"
"a1_697" = "709121696"
"a1_696" = "2741954983"
"a1_695" = "1228144619"
"a1_694" = "973511722"
"a1_699" = "2561877667"
"a1_698" = "446445346"
"a3_896" = "2145139113"
"a3_695" = "704178558"
"a1_962" = "2354930398"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a3_887" = "2047190590"
"a3_730" = "921917107"
"a4_88" = "630882648"
"a4_89" = "638051769"
"a3_731" = "962513618"
"a4_954" = "2544374138"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Aas]
"a3_913" = "2267125720"
"a3_736" = "998505673"
"a1_740" = "3452787243"
"a3_737" = "1005490536"
"a3_697" = "685057584"
"a3_892" = "2083171285"
"a3_891" = "2109683634"
"a3_890" = "2102235923"
"a3_897" = "2119163336"
"a3_734" = "950445111"
"a3_895" = "2138211638"
"a3_894" = "2131222679"
"a3_899" = "2166680202"
"a3_735" = "990926934"
"a3_696" = "678137233"
"a1_967" = "4286410713"
"a4_387" = "2774449827"
"a1_940" = "4229432446"
"a1_752" = "2230095913"
"a4_629" = "214409813"
"a4_628" = "207240692"
"a4_627" = "200071571"
"a4_626" = "192902450"
"a4_625" = "185733329"
"a4_624" = "178564208"
"a4_623" = "171395087"
"a4_622" = "164225966"
"a4_621" = "157056845"
"a4_620" = "149887724"
"a2_75" = "537677217"
"a2_74" = "530522560"
"a2_77" = "552019126"
"a2_76" = "544856869"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas]
"a2_71" = "509014829"
"a2_70" = "501831500"
"a4_753" = "1103380817"
"a4_752" = "1096211696"
"a4_751" = "1089042575"
"a4_750" = "1081873454"
"a4_757" = "1132057301"
"a2_73" = "523353002"
"a4_755" = "1117719059"
"a4_754" = "1110549938"
"a1_877" = "663187079"
"a1_876" = "3637904988"
"a4_759" = "1146395543"
"a2_72" = "516169346"
"a1_873" = "84723591"
"a1_872" = "1388507860"
"a1_871" = "2901627579"
"a1_870" = "2176569967"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a1_909" = "2838861736"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a4_577" = "4136582817"
"a3_123" = "898388146"
"a4_575" = "4122244575"
"a4_574" = "4115075454"
"a4_573" = "4107906333"
"a4_572" = "4100737212"
"a4_571" = "4093568091"
"a3_122" = "891468819"
"a4_970" = "2659080074"
"a3_121" = "850861040"
"a4_579" = "4150921059"
"a4_578" = "4143751938"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_636" = "247859925"
"a3_120" = "843343697"
"a4_985" = "2766616889"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "1475670451"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_965" = "2623234469"
"a3_691" = "642161658"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Aas]
"a3_967" = "2620735566"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a3_966" = "2647370799"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a3_964" = "2599327597"
"a3_963" = "2592338634"
"a3_962" = "2584764075"
"a4_756" = "1124888180"
"a3_961" = "2611395080"
"a1_755" = "2166061902"
"a1_437" = "3199544265"
"a3_960" = "2604335593"
"a2_553" = "3964519158"
"a2_552" = "3957354494"
"a2_551" = "3950189459"
"a2_550" = "3943020467"
"a2_557" = "3993206246"
"a2_556" = "3986038507"
"a2_555" = "3978857351"
"a2_554" = "3971690493"
"a2_889" = "2078379706"
"a2_888" = "2071211402"
"a2_559" = "4007540984"
"a2_558" = "4000370837"
"a4_980" = "2730771284"
"a4_981" = "2737940405"
"a2_429" = "3075547911"
"a2_428" = "3068391681"
"a2_427" = "3061215605"
"a2_426" = "3054047679"
"a2_425" = "3046882773"
"a2_424" = "3039714573"
"a2_423" = "3032531004"
"a2_422" = "3025363633"
"a2_421" = "3018197666"
"a2_420" = "3011032865"
"a1_758" = "2322775684"
"a2_565" = "4050556099"
"a4_984" = "2759447768"
"a2_959" = "2580222612"
"a2_958" = "2573057669"
"a2_957" = "2565874424"
"a2_956" = "2558709075"
"a2_955" = "2551539585"
"a2_954" = "2544371419"
"a1_785" = "789294881"
"a2_952" = "2530044035"
"a2_951" = "2522873532"
"a2_950" = "2515690076"
"a1_208" = "2804924885"
"a1_209" = "1474456175"
"a1_204" = "2716438121"
"a1_205" = "2405645200"
"a1_206" = "407031666"
"a1_207" = "4057934508"
"a1_200" = "1790492997"
"a1_201" = "1973130976"
"a1_202" = "4168317639"
"a1_203" = "2829720894"
"a2_777" = "1275441993"
"a2_776" = "1268277138"
"a2_775" = "1261109162"
"a2_774" = "1253927192"
"a2_773" = "1246758242"
"a2_772" = "1239592222"
"a2_771" = "1232424436"
"a2_770" = "1225258691"
"a2_779" = "1289777132"
"a2_778" = "1282611024"
"a2_395" = "2831809500"
"a2_394" = "2824627713"
"a2_397" = "2846143234"
"a2_396" = "2838974835"
"a2_391" = "2803135164"
"a2_390" = "2795962028"
"a2_393" = "2817472648"
"a2_392" = "2810292278"
"a2_399" = "2860478380"
"a2_398" = "2853313105"
"a2_568" = "4072056907"
"a2_569" = "4079237192"
"a2_379" = "2717093236"
"a2_378" = "2709923091"
"a2_373" = "2674090094"
"a2_372" = "2666906904"
"a2_371" = "2659739344"
"a2_370" = "2652573202"
"a2_377" = "2702756364"
"a2_376" = "2695592215"
"a2_375" = "2688421943"
"a2_374" = "2681256741"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283272965"
"a2_178" = "1276111011"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254590881"
"a2_174" = "1247421057"
"a2_177" = "1268940614"
"a2_176" = "1261771571"
"a2_171" = "1225923547"
"a2_170" = "1218753008"
"a2_173" = "1240256506"
"a3_249" = "1801832560"
"a4_960" = "2587388864"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Aas]
"a1_511" = "3495790669"
"a1_512" = "2290028980"
"a1_513" = "874449170"
"a1_514" = "1858262648"
"a1_515" = "3009186061"
"a1_516" = "1721610930"
"a1_517" = "3285485259"
"a1_518" = "1969143339"
"a1_519" = "3035052937"
"a3_648" = "367361953"
"a3_649" = "340792256"
"a3_617" = "111511520"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_784" = "3492025158"
"a3_514" = "3667976427"
"a2_543" = "3892824752"
"a1_424" = "2434635028"
"a1_425" = "3625150903"
"a1_426" = "2134993488"
"a1_427" = "1792861333"
"a1_420" = "995981720"
"a1_421" = "231684177"
"a1_422" = "1634306378"
"a1_423" = "3079729694"
"a3_199" = "1409969486"
"a1_428" = "47062255"
"a1_429" = "3125109201"
"a3_515" = "3709043978"
"a3_693" = "690213052"
"a2_965" = "2623241942"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a1_738" = "852341780"
"a1_739" = "2147530316"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a1_864" = "715000030"
"a2_915" = "2264784443"
"a1_865" = "3581895836"
"a4_870" = "1942167974"
"a4_873" = "1963675337"
"a1_861" = "3219740264"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091820140919]
"CachePrefix" = ":2014091820140919:"

[HKCU\Software\Aas]
"a1_863" = "2379300165"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a4_612" = "92534756"
"a4_613" = "99703877"
"a4_610" = "78196514"
"a4_611" = "85365635"
"a4_616" = "121211240"
"a4_617" = "128380361"
"a4_614" = "106872998"
"a4_615" = "114042119"
"a4_968" = "2644741832"
"a4_969" = "2651910953"
"a4_618" = "135549482"
"a4_619" = "142718603"

"a4_871" = "1949337095"
"a3_689" = "661144376"
"a3_812" = "1543047557"
"a3_692" = "649083933"
"a4_876" = "1985182700"
"a4_766" = "1196579390"
"a4_767" = "1203748511"
"a4_764" = "1182241148"
"a4_765" = "1189410269"
"a4_762" = "1167902906"
"a4_763" = "1175072027"
"a4_760" = "1153564664"
"a4_761" = "1160733785"
"a1_848" = "697949674"
"a1_849" = "3148779434"
"a1_439" = "1452892680"
"a4_768" = "1210917632"
"a4_769" = "1218086753"
"a3_938" = "2446500163"
"a3_512" = "3687557161"
"a2_662" = "451008895"
"a3_513" = "3660926024"
"a3_930" = "2355479115"
"a3_931" = "2362926826"
"a3_932" = "2403474189"
"a3_814" = "1523992135"
"a4_877" = "1992351821"
"a3_510" = "3639513879"
"a3_936" = "2398382209"
"a3_937" = "2439449888"
"a3_511" = "3679991734"
"a3_516" = "3715971501"
"a3_517" = "3723025868"
"a1_198" = "2072743519"
"a1_199" = "2495426867"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "3806065693"
"a4_145" = "1039522545"
"a1_190" = "981511488"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a2_983" = "2752276268"
"a3_910" = "2245638887"
"a4_548" = "3928678308"
"a4_549" = "3935847429"
"a4_542" = "3885663582"
"a4_543" = "3892832703"
"a4_540" = "3871325340"
"a4_541" = "3878494461"
"a4_546" = "3914340066"
"a4_547" = "3921509187"
"a4_544" = "3900001824"
"a4_545" = "3907170945"
"a4_839" = "1719925223"
"a1_662" = "2852980367"
"a1_663" = "3179549067"
"a3_965" = "2639793036"
"a1_660" = "4283923104"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"

"a1_667" = "3553413899"
"a1_664" = "1377613614"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a1_665" = "3213288644"
"a1_0" = "974207072"
"a1_1" = "298321366"
"a1_2" = "3190822834"
"a1_3" = "1675254169"
"a1_4" = "264976382"
"a1_5" = "4055213004"
"a1_6" = "2877104659"
"a1_7" = "1452991644"
"a1_8" = "4016929358"
"a1_9" = "73811250"
"a2_566" = "4057713837"
"a2_567" = "4064888121"
"a2_564" = "4043387102"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Aas]
"a2_562" = "4029041275"
"a2_563" = "4036221775"
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953680243"
"a2_413" = "2960844038"
"a2_410" = "2939346805"
"a2_411" = "2946499273"
"a2_416" = "2982348156"
"a2_417" = "2989529523"
"a2_414" = "2968013843"
"a2_415" = "2975179218"
"a2_418" = "2996698807"
"a2_419" = "3003863082"
"a2_962" = "2601723953"
"a2_963" = "2608889928"
"a2_960" = "2587390792"
"a2_961" = "2594555160"
"a2_966" = "2630408400"
"a2_967" = "2637574685"
"a2_964" = "2616057540"
"a4_950" = "2515697654"
"a1_631" = "1084627018"
"a2_968" = "2644742161"
"a2_969" = "2651909745"
"a4_564" = "4043384244"
"a1_219" = "4057773741"
"a1_218" = "2142044964"
"a1_217" = "2114604036"
"a1_216" = "4133805558"
"a1_215" = "3098329051"
"a1_214" = "1482541734"
"a1_213" = "2557032575"
"a1_212" = "301890022"
"a1_211" = "3030312009"
"a1_210" = "391556955"
"a4_567" = "4064891607"
"a1_630" = "1197912328"
"a2_980" = "2730777727"
"a4_560" = "4014707760"
"a2_982" = "2745113491"
"a4_956" = "2558712380"
"a2_984" = "2759445389"
"a2_985" = "2766611420"
"a4_561" = "4021876881"
"a4_562" = "4029046002"
"a4_563" = "4036215123"
"a4_443" = "3175920603"
"a1_633" = "508668010"
"a4_442" = "3168751482"
"a4_441" = "3161582361"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
f3a7c130d68a08273040bc680ff8e88d	c:\rphkms.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[1].txt (392 bytes)
   %WinDir%\system.ini (70 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA98FY3B.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (4534 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sd_101361_af128[1].jpg (19103 bytes)
   C:\autorun.inf (245 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fad58-b3118[1].css (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\itools-for-windows-06-100x100[1].png (12210 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CABKDTRC.gif (35 bytes)
   C:\rphkms.exe (103 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA5S0VDT.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sprite[1].png (2244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nr-412.min[1].js (8758 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cc92a7d66e[1].setToken (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fad58-b3118[2].css (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[2].txt (3789 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].txt (109 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_100624_634cd[1].jpg (21742 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (1183 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\winsopeag.exe (741 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (840 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CASJFFA8.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\blank[1].gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gradientbg[1].png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\container[1].html (1287 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\campaign-101361,100624[1] (2390 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pubads_impl_49[2].js (2659 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sd_100624_634cd[1].jpg (27174 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\campaign-101361,100624[1].htm (2272 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAQV4PW9.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\container[1].htm (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\81fe5-9d45e[1].js (6960 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[1].txt (11145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAXJVTKW.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pubads_impl_49[1].js (1704 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (18316 bytes)
   %Program Files%\Common Files\Java\Java Update\jusched.exe (272 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAX5VB7F.gif (35 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[2].txt (10187 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Softonic
Product Name: Softonic Downloader
Product Version: 1, 40, 1, 0
Legal Copyright: Copyright (C) 2013
Legal Trademarks:
Original Filename: SoftonicDownloader.exe
Internal Name: Softonic Downloader
File Version: 1, 40, 1, 0
File Description: Softonic Downloader
Comments:
Language: Language Neutral

Company Name: Softonic Product Name: Softonic Downloader Product Version: 1, 40, 1, 0Legal Copyright: Copyright (C) 2013Legal Trademarks: Original Filename: SoftonicDownloader.exe Internal Name: Softonic Downloader File Version: 1, 40, 1, 0File Description: Softonic Downloader Comments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
PSB2C3k2	4096	1081344	0	0	d41d8cd98f00b204e9800998ecf8427e
8m10paCF	1085440	360448	357376	5.54408	45c3f55344e41401420e5dfcf9cdaa5b
.rsrc	1445888	94208	94208	5.38423	8eeaa85c2607c6defe5bf4532984af05

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://itools-for-windows.sd.en.softonic.com/universaldownloader-prefetch
hxxp://itools-for-windows.sd.en.softonic.com/3347095/universaldownloader-prefetch
hxxp://itools-for-windows.sd.en.softonic.com/js/generated/81fe5-9d45e.js
hxxp://itools-for-windows.sd.en.softonic.com/universaldownloader-track
hxxp://softonic-analytics.net/blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=405E8CDB-A8BC-4F43-A4AC-636EF4818C4At1411058467f3347095&id_campaign=101361&id_campaign=100624&ts=1411058467996
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=1&utmn=1671254013&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=installation assistant&utmhid=1623881195&utmr=-&utmp=/3347095/universaldownloader-prefetch&utmht=1411058467793&utmac=UA-48247475-1&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://itools-for-windows.sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467
hxxp://itools-for-windows.sd.en.softonic.com/css/generated/fad58-b3118.css
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100624/sd_100624_634cd.jpg
hxxp://screenshots.en.sftcdn.net/en/scrn/3347000/3347095/itools-for-windows-06-100x100.png
hxxp://itools-for-windows.sd.en.softonic.com/shared/img/sd_client/gradientbg.png
hxxp://itools-for-windows.sd.en.softonic.com/shared/img/sd_client/sprite.png
hxxp://itools-for-windows.sd.en.softonic.com/shared/img/sd_client/loading.gif
hxxp://screenshots.en.sftcdn.net/campaign/scrn/101000/101361/sd_101361_af128.jpeg
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=1244257137&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=-&utmp=/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467&utmht=1411058469340&utmac=UA-48247475-1&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=1701586535&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1411058469387&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100624/sd_100624_634cd.jpg?v=0.020139567775189604
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=1923575903&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1411058469371&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=703327289&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1411058469418&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=787385459&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1411058469434&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=728143713&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/C101361--load1&utmht=1411058469465&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=2129336247&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/C100624--load2&utmht=1411058469480&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://c.global-ssl.fastly.net/nr-412.min.js
hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_49.js
hxxp://pagead46.l.doubleclick.net/pagead/show_companion_ad.js
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-0/html/container.html
hxxp://beacon-6.newrelic.com/1/cc92a7d66e?a=2337116&ap=151&fe=1422&dc=719&v=412.920d26d&to=NQcAZUJXXUdWAEZdVwxNN0NZGVtAUwxRRxcLDAZUSBhDXEc=&f=["err"]&jsonp=NREUM.setToken
hxxp://www.googletagservices.com/tag/js/gpt.js
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=1244257137&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=-&utmp=/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467&utmht=1411058469340&utmac=UA-48247475-1&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=1701586535&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1411058469387&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://tpc.googlesyndication.com/safeframe/1-0-0/html/container.html	173.194.43.107
hxxp://static.sd.en.softonic.com/shared/img/sd_client/sprite.png
hxxp://pagead2.googlesyndication.com/pagead/show_companion_ad.js
hxxp://static.sd.en.softonic.com/shared/img/sd_client/loading.gif
hxxp://sd.en.softonic.com/3347095/universaldownloader-prefetch	46.28.209.70
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=728143713&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/C101361--load1&utmht=1411058469465&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467	46.28.209.70
hxxp://static.sd.en.softonic.com/js/generated/81fe5-9d45e.js
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=2129336247&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/C100624--load2&utmht=1411058469480&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://static.sd.en.softonic.com/shared/img/sd_client/gradientbg.png
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=787385459&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1411058469434&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://static.sd.en.softonic.com/css/generated/fad58-b3118.css
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=1&utmn=1671254013&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=installation assistant&utmhid=1623881195&utmr=-&utmp=/3347095/universaldownloader-prefetch&utmht=1411058467793&utmac=UA-48247475-1&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=1923575903&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1411058469371&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=703327289&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1411058469418&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://sd.en.softonic.com/universaldownloader-track	46.28.209.70
hxxp://partner.googleadservices.com/gpt/pubads_impl_49.js
hxxp://js-agent.newrelic.com/nr-412.min.js

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /__utm.gif?utmwv=5.4.6&utms=1&utmn=1671254013&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=installation assistant&utmhid=1623881195&utmr=-&utmp=/3347095/universaldownloader-prefetch&utmht=1411058467793&utmac=UA-48247475-1&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 08 Sep 2014 22:24:56 GMT

Server: Golfe2

Content-Length: 35

Age: 843393

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Date: Mon, 08 Sep 2014 22:24:56 GMT..Server: Golfe2..Content-Length: 35..Age: 843393..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=2&utmn=1244257137&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=-&utmp=/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467&utmht=1411058469340&utmac=UA-48247475-1&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 08 Sep 2014 22:24:56 GMT

Server: Golfe2

Content-Length: 35

Age: 843395

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=4&utmn=1701586535&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1411058469387&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 08 Sep 2014 22:24:56 GMT

Server: Golfe2

Content-Length: 35

Age: 843395

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=5&utmn=703327289&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1411058469418&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 08 Sep 2014 22:24:56 GMT

Server: Golfe2

Content-Length: 35

Age: 843395

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=7&utmn=728143713&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/C101361--load1&utmht=1411058469465&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 08 Sep 2014 22:24:56 GMT

Server: Golfe2

Content-Length: 35

Age: 843395

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Date: Mon, 08 Sep 2014 22:24:56 GMT..Server: Golfe2..Content-Length: 35..Age: 843395..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a.............,...........D..;..

GET /nr-412.min.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js-agent.newrelic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: mZ38p9x7 6lET9fvdRu0yyqIpAaPEpXVmuG8N1V8Kum5cfiLfrPa0FHBT0k8TO h

x-amz-request-id: 8BF027566AAC8475

Cache-Control: public, max-age=315360000

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Last-Modified: Fri, 09 May 2014 18:03:22 GMT

ETag: "e9277060b8e4dfb70120dcdefe5b54d7"

Content-Type: application/javascript

Server: AmazonS3

Content-Length: 14848

Accept-Ranges: bytes

Date: Thu, 18 Sep 2014 16:41:32 GMT

Via: 1.1 varnish

Age: 2631894

Connection: keep-alive

X-Served-By: cache-dfw1828-DFW

X-Cache: HIT

X-Cache-Hits: 48862

X-Timer: S1411058492.022415876,VS0,VE0

Vary: Accept-Encoding

!function(n,e,t){function r(t,i){if(!e[t]){if(!n[t]){var u="function"==typeof __nr_require&&__nr_require;if(!i&&u)return u(t,!0);if(o)return o(t,!0);throw new Error("Cannot find module '" t "'")}var a=e[t]={exports:{}};n[t][0].call(a.exports,function(e){var o=n[t][1][e];return r(o?o:e)},a,a.exports)}return e[t].exports}for(var o="function"==typeof __nr_require&&__nr_require,i=0;i<t.length;i )r(t[i]);return r}({1:[function(n,e){e.exports=function(n,e){return"addEventListener"in window?addEventListener(n,e,!1):"attachEvent"in window?attachEvent("on" n,e):void 0}},{}],2:[function(n,e){function t(n,e,t,o){l[n]||(l[n]={});var i=l[n][e];return i||(l[n][e]=i={params:t||{}}),i.metrics=r(o,i.metrics),i}function r(n,e){return e||(e={count:0}),e.count =1,f(n,function(n,t){e[n]=o(t,e[n])}),e}function o(n,e){return e?(e&&!e.c&&(e={t:e.t,min:e.t,max:e.t,sos:e.t*e.t,c:1}),e.c =1,e.t =n,e.sos =n*n,n>e.max&&(e.max=n),n<e.min&&(e.min=n),e):{t:n}}function i(n,e){return e?l[n]&&l[n][e]:l[n]}function u(n){for(var e,t={},r="",o=0;o<n.length;o )r=n[o],t[r]=a(l[r]),t[r].length&&(e=!0),delete l[r];return e?t:null}function a(n){return"object"!=typeof n?[]:f(n,function(n,e){return e})}function c(n,e){"undefined"==typeof e&&(e=(new Date).getTime()),d[n]=e}function s(n,e,r){var o=d[e],i=d[r];"undefined"!=typeof o&&"undefined"!=typeof i&&t("measures",n,{value:i-o})}var f=n(1),l={},d={};e.exports={store:t,take:u,get:i,mark:c,measure:s}},{1:20}],3:[function(n,e){function t(n){return c[n]}function r(n){return null===n||void 0===n

<<< skipped >>>

GET /safeframe/1-0-0/html/container.html HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tpc.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/html

Last-Modified: Tue, 14 Jan 2014 13:13:27 GMT

Date: Thu, 11 Sep 2014 12:09:10 GMT

Expires: Fri, 11 Sep 2015 12:09:10 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 1287

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 621142

Alternate-Protocol: 80:quic,p=0.002

......n....VyS.8...Oa<.G".....4.#C.Q.B.= Iw.[q\.;......>.N..;;.3MyO...]Vs...}{w}d..8..j....9.<...*R.....8.|,.v.(.¶.R....As..O.e..h.J.0..p..*J.B...4|P.(.4..Z6`...BMeb.....m..y.m..BU.!....a.].....E!W.lm..4.. ..j$.8....0...n.2..!I`Lh.l.....:@b.<S.I .WCb^M..&.So......w.u....szd........DaR.... .718.P...t;.......?.&....4..*.0.a.$.X.!.......A.O...[..5X.]..h..(0.9.y[.Q...4.B....v..I...*....a......M=MD:4.ZO.6.<.g.@/...G.z.....^.FI..=.4...7 ..N.R.h.a....arQ..L.!.N.:.-.P....B.D...=...n.a....e".`J....'\f.8N."s]j.(.%!9..@..`.<..<..v.`... g...Y....6.......C....h.......b.s_..G.......-....2..v6.#EL...je;....p.......d."...]U.e..b.s.R.[O.j.E...../.X..p.".......b.^/..R..w.....|.........V....@.=...,........l"..n._..,.......8............"...u....U. .._y.[.i..../T...C..GQ,...yYx.7...h...mL.;.#.zla.-..lw:n;.O..I9......ZC..q5..j&uN.rY...fO......7..;Y..e.......I...{.U..Y..}L..G...1..^....~..P..Sp~.....H/...f..w...).T.8...~s.X..w.X....*..Q5...l.$I.Q......8z...p....b.$.....D.4...p...og.A.$..uj.t.t.....u..ej...e.]....Sa.G.....A.;_.s.)A.5..i&....*.].9....."..(..C...n\.....M..j..V..h....3..e..z...n...]_..d.\;.kW..&"..D...h...T7I..R].u.....).t....e.........C.;.......=...]A!{o...l"..........H..*.o{..E..w..PD.......po.L#L5v....i.gUM....8.....5f..3^...U.l....-............... ......S.S.......Si.......

<<< skipped >>>

GET /universaldownloader-prefetch HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: itools-for-windows.sd.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Date: Thu, 18 Sep 2014 16:41:26 GMT

Server: Apache

Set-Cookie: sd_client_en-admin=deleted; expires=Wed, 18-Sep-2013 16:41:25 GMT; path=/; domain=sd.en.softonic.com

Location: hXXp://sd.en.softonic.com/3347095/universaldownloader-prefetch

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 20

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

....................HTTP/1.1 301 Moved Permanently..Date: Thu, 18 Sep 2014 16:41:26 GMT..Server: Apache..Set-Cookie: sd_client_en-admin=deleted; expires=Wed, 18-Sep-2013 16:41:25 GMT; path=/; domain=sd.en.softonic.com..Location: hXXp://sd.en.softonic.com/3347095/universaldownloader-prefetch..Vary: Accept-Encoding,User-Agent..Content-Encoding: gzip..Content-Length: 20..Keep-Alive: timeout=3, max=10..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8........................

GET /gpt/pubads_impl_49.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partner.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Mon, 08 Sep 2014 11:09:31 GMT

Date: Wed, 10 Sep 2014 22:14:05 GMT

Expires: Thu, 10 Sep 2015 22:14:05 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 34135

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 671247

Alternate-Protocol: 80:quic,p=0.002

......n.....y..H.8..^E..'#..c.c@../..a.&......u....K...{.....d....wg.[}..U.u..b...tj;...|{....`....S..m....t.*.F..... ..o.]...J`e.....4...0..4........O......,..........mY.?,...-U"3m.....".9..y.m6..}>.N.......u. z...p...=.I.Z.} e..P.....&A<..5..8........Fq2....S.f..0.7.BGg.<.=.N..x..1...O.-Q.......39......dT.......*z...Z..,.......(...3..(u./w..(j.W,.5.RN.T.!r....Hi^..LT. .K.Vy....3.cF......U.bq.H....Y|.T.....S..s..Y..%...q.-...b.]X.-.}...k...s..bb;..?n9.......c..5..k.............>..i.A...%a.w........|..m:......g1....g.....<...;P..].b.O.w.j..4...\.-d.n..8..j...Z6cBV.fmBn|u^..q&ww..;..5T..&|.7o.PMy>....4....pw...........m]r.)...4.^..........b.......-..........Vo8...........p>.....e[X.j`f.K`..w.......6i.l...."en.N'..=?p.............JW..v..SX....a.7?V..|8.....S....0O.>...J{=d...F....N.......n....4.h6..5]\.2)..8Mt........y8.0.a.l......PD.,!.<....y.N(...k{.U.$.2..}..9...jO8...ob...Ob.:^dy:.t..0....A........o.......,.]..G..\.U6.....?.N:5.....Y....x6..).o,u...>.,h.fm.w.p.E..C..x.yqLw-....E s..]>.yp.Vs....0.8...x-s...u...~.f^`./...._............M..V....(....As.....f.{..9.>....Z.{.....5.b.......w..[....Q..Y.......@.K...V. ...........P..y..E.....g..I...../M.P3...@O.1~.V4....D..........?...^...N..z.........r....}..a......P..@(...=...7v.Y..D..d.N...c.. .Y%...lM....._..am[,.8...Y~<..#.&..../$..[l.].&..OVp4....y.v..?^..x..[&.t.e..<....9......J.g..D.8.q.*._.=Vq.0*.V..D./...f1..bd.bX.E8.b}..&3rVzw.\<....=..wq....1..E.....[.......L(.`pJ.)....c0.`......._.Ct.=?.~..s....{...J..........

<<< skipped >>>

GET /en/scrn/3347000/3347095/itools-for-windows-06-100x100.png HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Mon, 25 Nov 2013 16:30:25 GMT

Cache-Control: max-age=172800

Content-Type: image/png

Content-Length: 28341

Accept-Ranges: bytes

Date: Thu, 18 Sep 2014 16:41:30 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 54210

Expires: Sat, 20 Sep 2014 16:41:30 GMT

.PNG........IHDR...d...d.....p..T....bKGD..............pHYs..........&.?..l.IDATx....XU..5L.QT..#.{/...h..Qc..5jb....{AQz.....@....Q.Dz....k.....................s.9.Zko54...F.6....m...FS.@c.Bh.[.......].r..4^.........h..8.mr...].....|.I......oR....}.....4......................1[y.m.....y]..'.t. >...:!._n;.F[O.1.i"......r._l;.\c.r.h.W.?._i..k....>..*...'....46......l.Ah....E........h4k.....M~../......4Z..F./...............Y.b.|h.Y...........h.....>...N@.7.d.i|.....vG.......ES.Mv{....K..S~.B#.}..K}.../....}...o.y>......C..m...Mw........g..~.....{..}5..A.=l...<....8.....f.....>./../..K.R..N7:.)..Wt.F......%;.d.6h.`f.E..K.5~.........h.....B.Q.@{.b......Y.........D...^.t.)4.v..v{....49........@49......6..]....*.7?...G...F...}<...p4=.....U~w.@..l.I.v.._....[..:..M.04;...BhA<O...5....ph.........Z........iMy..mr4._.a.....~/4%....o>.&.....}h.|74.nC.9....%...t.v..........t.4..f....k.x.)j.!h.a.o$-..B.=>hv......S.Pw..G$.yF..W4.....g..{.o. .....c....#.-......<M=....f..j.....xG..O.4M..Z$.......w,...W>............}.../}b....{.O.........(.....v..Dc./........jM.j3.Y.u...b...!(..B....a..h..A....h9y9....&.w.EF.V..V..VO4;......'/...F.q."0A.f.E4.J.[a.i_..c_.\R..i_......7V...t.v...7.4._.x.v.vI.f..ZS..Y.%..o..w....2.*....&.........]........%r...."..?..v.\../.6..M......t.....t.V...?..%...5E.\...W.A...........h.u...o....M.Z........7r.?Z..@.}....hv2....../..x./.x....5....4....&j.*ZX.bg...M...O~..&Q...y.M#h..h.....hF%.....G&C *.."o.u$;=.......nB3:.....eX*Z...u..Z2Z..@.......Q..)...A..I..r.4...s7..FG...

<<< skipped >>>

GET /campaign/scrn/100000/100624/sd_100624_634cd.jpg?v=0.020139567775189604 HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 11 Feb 2014 10:50:08 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 55463

Accept-Ranges: bytes

Date: Thu, 18 Sep 2014 16:41:31 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: MISS

X-Cache-Hits: 0

Expires: Sat, 20 Sep 2014 16:41:31 GMT

......JFIF.....%.%.....C....................................................................C.........................................................................|..............................................p...........................!..1A...Qaq.."T.....2RSV..........$&'38Urw...#46BXfv....%(CDFHWb.....)5gsu..7G........................................c........................!..1.AQ..."aq2R......#ST......3BU.....$%&4Cbdst..56Dceru.....EVv....FW...............?........T.I$.e.QC.....&9.s...)K..a....uy.#G.GH...I$..#...wwb..T.....$.U*... ;.*"".wv8UEPY...*....k...7..2....~z..b..-...2].R..%.N....(.n'HT..L.....w.......q.....p..qF..Xh.\>...{.....0..i,!...qum..n.#0W..k?#<x.i...7...>..H.......h......4g.....8..P..........x..........)Z...fr......V.*H*S.....C..._;."..t....[.......Oxv.F.....u[..)5.v.kM.[.....V.5).....%..v..nVT..o'1.v.5..x.m.A.Egx#.....Yf{<H.f...\F.r.p%..d..X.W..txG..Y..]#.R\.0.bW.>.....>.....;....;...I.DY...Lx..6.....,/...u8..CZjCO....}..`..Htt.Q....]Ar[..\.P..x......uk. ".R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R......0...[Fh.Xh...B.&F......;..."..v..u...T ...............?.V.......]s[..z.W..v............X.m..0.pJ.E=.i........'.Q<.ym......h.W.X..mB.^......8.C..7.O.*Ij...{ k...Z7.....t8......n....`.E....)i8....d..HD...4u..c..8<..x....)......M...3.........e.....=...M*..-D.........q.v1...8E.t..c.$P...._p....^J...P..2.5Mf...%./.,..F..hu[[H...[U.....-.... ....vx....T(..s.H....*........I.....=..&..4..,h..$T.p...q...s.)..._>.. )...=..i...w

<<< skipped >>>

GET /tag/js/gpt.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googletagservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 12398482878374649242

Date: Thu, 18 Sep 2014 16:21:47 GMT

Expires: Thu, 18 Sep 2014 17:21:47 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 14914

X-XSS-Protection: 1; mode=block

Age: 1184

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic,p=0.002

...........}kw.:..........1i.....d.(P..r..<]..$ns.vZ....gF..........4.4..F...H...)....v~^.d;r/.l.....)...D.".n_..p....l.2V.........`.y...f.E.3....>...n..4cS.`GI.n...b.aye.7.D.m....}...'.l.e6..Y...a........D..?..pv...pU..[...CP..5]L.(.....8.......... .F......q..u.P.y.d7'.1 .....v.>...2.............bg..*m.....k...ZE.4......x..u.@@..j..*..E.....P... B.. 7.#DJ.J.....(.F..y.N..N.....;...f.q....ou...W.7[.....O.U......5. j.%C..i.B?...0.;..F..z.8If.M.c.P.......[4..y."!.I.....g.K........P.i:...l.wC]..q....Zj......U.....1*....{....Q3..i.g......e.U..g!...g...zG.F8%..4.#..Sq..Z..y.~..=.< }.p..z..1M>.>.,x6K|.).....Pw............j..Y...I.Y.FO.3..Sr;N_..6w...!......:|...z.'S...[.$"...{..{_.o.._...".s.]9..N.u..~....s.r.b..........Q^i...V....^0?..V..o.-..T..E.c...K...M..Nk....Cf[..-H...;W ...}..~7...sZ*).b[.Q["...Y...q.....c.w.9....>...}.y.=.....kfQ.8..N...v........E....'f.-.xZ..Lt..O..P.?..j.`eRU#....-....5...........d..1..#.'..A.Q...:..I4.3..yI......... .U.NU...{..a..n......0..p{b. Mm3."1.X..zz*.z9............]Xd.Q.._e....l6.G........\A.. .....,D(.m.....o.=..9q...7..i.._..y..Y4..n5.........v:..e...dw...b.T..f}..z.{.....[s6.X./...L..3Z..lb9.........a3.-@L.. /..(#....F|......Q~.A.d..#J.......}..e.......2u/.............s.......m.......S.@....&.(.....\.(p..'........<...<............k.@#.S.0.P.0...`~..-...G.u...S.P.S.P?.......(....R.(..>...z..k.:..H.-...#Ge..}..#%.t.Hk.@.,.`:eh...."|...E...F..|.[..F...p.....Ujj.0S. .J(..J.A...m.9......7...qb.0-`..Q9S..\.n.W.)........P.ln.f@...;...].-.2.a..oy....B..X..

<<< skipped >>>

GET /pagead/show_companion_ad.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 3413441162474773766

Date: Thu, 18 Sep 2014 16:22:30 GMT

Expires: Thu, 18 Sep 2014 17:22:30 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 46156

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 1142

Alternate-Protocol: 80:quic,p=0.002

............i[...0.._..sIw,......_....ia..,?=...v.6C..o.U..........p...[Ri..JU.......?....[o.<p..~.n\..Y.&.t6......rm.u.9.<...,.~y.WM....4....n..8p...U.... A5...v0.....z.4.n......&&.C....aw.[]5C,.....e9.J.rc.V#...\..:..B6E.....5..5g....W.F..a2..A.C.^{.....l.....e.J...`{}w.0.F....c.....`j..oA.`..r_..`...{.x5.......S!.h.w.......d4.a....=....j...P.5...`.s......%..M.-.F.A.%.,c8.....d.....a...a.. i*.|.-J......a?iA.......R.`..0.*..j.[1..-hoi.8...&aQi.....h.D."v8...b....P ..7........q.2.......s..!".9..>.S....Es<gK?.jN..4.9..........%;..8.....&..8g.".Q................ta......W.....Y..dt...L......Q.........m.%..b..,lC..r......r.P.!Q>......O.ao..b..0m@.,).H.......C...V_q.$*.cZU.F....Co.....Q. ........D..'93G....;......w...f...gI.d8.#J......s..iT......c[.....lZ..=.5g.%......s6..Y..........~..x..H..Q..S.F..Lf.t4q=H..$..].X.....b.....J.@.......tN..$...F.4%U....;2......T..:h..>g.r..2..P.......7...j.o....zu.%...J.^.;..x..u.h..s..6/....*.U........yi_..^]U...u6....Ln...7.4.......,. ..@~x..i......,6.A.%...i.9K?o.....>.|H?...M....{i.Bo..]..PB..c.....|.1....j..uc.Z.,.M...-.......>.C...T.<......;..0.v..h..u..z].FS............B..*..<..~..].F7.-J.=.....G?.. 80.)..o.e.........h<..X..}q.\.{.....z..e......|.yp...c..w3v.K..a.`.G.cT7.u.Q?f.L._....Wz.).. ...B..'W..{....Kw.U...~A[.<.N.:.E..u.8._....4....P..B.0&KrP.....Z!G:b....;:....3{..;.{......~....~...).b.......^.ym<.Zg....8..#..D..8.....).../........cC.b.m..1.6...7....GN.....L"..[..k4...kX..*.P........[....w..ZWbZ....BN....Isj.,..s.. .BjT.j2.a;4.0m

<<< skipped >>>

GET /campaign/scrn/100000/100624/sd_100624_634cd.jpg HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 11 Feb 2014 10:50:08 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 55463

Accept-Ranges: bytes

Date: Thu, 18 Sep 2014 16:41:30 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 6329

Expires: Sat, 20 Sep 2014 16:41:30 GMT

......JFIF.....%.%.....C....................................................................C.........................................................................|..............................................p...........................!..1A...Qaq.."T.....2RSV..........$&'38Urw...#46BXfv....%(CDFHWb.....)5gsu..7G........................................c........................!..1.AQ..."aq2R......#ST......3BU.....$%&4Cbdst..56Dceru.....EVv....FW...............?........T.I$.e.QC.....&9.s...)K..a....uy.#G.GH...I$..#...wwb..T.....$.U*... ;.*"".wv8UEPY...*....k...7..2....~z..b..-...2].R..%.N....(.n'HT..L.....w.......q.....p..qF..Xh.\>...{.....0..i,!...qum..n.#0W..k?#<x.i...7...>..H.......h......4g.....8..P..........x..........)Z...fr......V.*H*S.....C..._;."..t....[.......Oxv.F.....u[..)5.v.kM.[.....V.5).....%..v..nVT..o'1.v.5..x.m.A.Egx#.....Yf{<H.f...\F.r.p%..d..X.W..txG..Y..]#.R\.0.bW.>.....>.....;....;...I.DY...Lx..6.....,/...u8..CZjCO....}..`..Htt.Q....]Ar[..\.P..x......uk. ".R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R......0...[Fh.Xh...B.&F......;..."..v..u...T ...............?.V.......]s[..z.W..v............X.m..0.pJ.E=.i........'.Q<.ym......h.W.X..mB.^......8.C..7.O.*Ij...{ k...Z7.....t8......n....`.E....)i8....d..HD...4u..c..8<..x....)......M...3.........e.....=...M*..-D.........q.v1...8E.t..c.$P...._p....^J...P..2.5Mf...%./.,..F..hu[[H...[U.....-.... ....vx....T(..s.H....*........I.....=..&..4..,h..$T.p...q...s.)..._>.. )...=..i...w

<<< skipped >>>

GET /campaign/scrn/101000/101361/sd_101361_af128.jpeg HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 21 Aug 2014 13:49:15 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 50331

Accept-Ranges: bytes

Date: Thu, 18 Sep 2014 16:41:30 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 213292

Expires: Sat, 20 Sep 2014 16:41:30 GMT

......JFIF.....H.H......Exif..II*................*hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:E51D1E8EAAD211E382BC8783FA93A9BA" xmpMM:DocumentID="xmp.did:E51D1E8FAAD211E382BC8783FA93A9BA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E51D1E8CAAD211E382BC8783FA93A9BA" stRef:documentID="xmp.did:E51D1E8DAAD211E382BC8783FA93A9BA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C....................................................................C......................................................................................................................`............................!"1..2A.BQRa.#3bqr...$....C...%4Scs.....Dt.....&'58Tduv.....9UWe...................................F........................"..2..BR.#13br!A..$4Qq........a...S..................?....4y..z..@I=@x.`$..$..J@S.1.IJ.y-.J..V....;..h. bv...z...!?5K..W%...$...b2...9.?v..I...OC.b..i.}3*.K......B....!..5m.\.D.*.\.P.Y)R..y~...U.!n.......;.'4.)<qs..`.V....O[.K.>..Q........vT..w..:....nK.I.....Z;h.m..e3.!

<<< skipped >>>

GET /3347095/universaldownloader-prefetch HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sd.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 16:41:27 GMT

Server: Apache

Set-Cookie: sd_client_en-admin=deleted; expires=Wed, 18-Sep-2013 16:41:26 GMT; path=/; domain=sd.en.softonic.com

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Vary: Accept-Language,Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 10209

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

...........}i[.......P.!..l.{!N..dNr..b23....!...#.Hr.......Y^ QB.....................wwG9IO.....o^m jec./k{c...V.....7.Q...... ....nl..S..$MG........U.........e`c......^.S....v..t.&.%`.F..Z.....-..*Vof.g.=zzB........TI.G....K......\.Y.,.{.Y........%...&.ru.y=.w.(......Q.k..........?.v......1.[.d.*(Z......w......>...jD..."..%H...cr.../>{...0.. _FQ.&...d3......{.a).."-.KDSZ.8: G.1I.1..=...<."-kY..R.JdN..U.T[-$\.W..).f...~..X..f.4..I8HO6...2.. :*g.LJ.F. O..-2..@......[.Az.y.....wpy.kI <...:...c@.{6..c.....7...K..$.H&9.S....v..0h...au4NN...6......0..`.d'u........k.4H..d.]L.43?..0....hI."../.......K*.cU;H./Cr.|.}o<8Iw..d.c.....R.......`.}....^J...I..SR*k...I......d....'Wz.$ZT......./..ccJ..P..v.S.$.....KU.T..(V...D.#.....W..&....h.}..c.|.{.",c....N..R.............../...Z.`}..2.bZr..M|.F!.....A...0....}...H....Y.f...t.W.(.|.C..M...$......NgNMR......?yRJKFYKKfYS.4;...o.$%......<IKV...o......,B..O.....8J#...K..]a.v....'....AX.D.T....E....[F..[V.N....YM:...!...R\.m....?..y.d.L.. ...X.1.O.N@..rnA,g.. @ .,r`.....4..jN....ak.c.j.i.........G....P..m]....j...=......jjLN..d6.HS *,.y>gB ...q...\...LS...M.B......I~.G.z.....&..A...tio.@..z.%..Bh5"qz^Z...Y.Z.Lu.~)(#.......b.M.....?....2.!.N.0!.....N..U....e..V.."...'.i..|..\"`.s..g1HY..=........l>.9...[q.h.v.rsY7U...mT....pc..Y.....b.].........&..N. .......b..`.... ..6.e-l!/.N..2~..c65[a.....;%..N....(:#.......dy..#..@.-d......`..`mC ..l..u"B0.....q..r............2a.a6..f..I.3...$L....0.L.B.......).. %...j.d.)...N..l....-_DSy..E"F0k...!.Fa.v.9t....v@..;o.

<<< skipped >>>

POST /universaldownloader-track HTTP/1.1

md5_hash: 664290c91b91eae5b567df874eb6a57d

Accept-Language: en-us

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader-prefetch

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

x-requested-with: XMLHttpRequest

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sd.en.softonic.com

Content-Length: 11370

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: __utma=30725629.537996373.1411058468.1411058468.1411058468.1; __utmb=30725629.1.10.1411058468; __utmc=30725629; __utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_3347095=false; UACA_3347095=false; _FCen=100516||.100623||.100624|1|1411058467.101361|1|1411058467; UD1_POSITION_3347095=

id_session=405E8CDB-A8BC-4F43-A4AC-636EF4818C4At1411058467f3347095&id_machine=a8a67a25000000000000000c295c9464&id_user=405E8CDB-A8BC-4F43-A4AC-636EF4818C4A&id_file=3347095&id_section=675&id_main_section=616&ab_test=&api_version=1.40.2&timestamp=1411058467&download_browser=unknown_browser&download_browser_version=unknown_version&client_timezone=3&test_track=false&flavour=&av_installed=&step=prefetch_events&events=[["special_conditions_evaluation",[{"campaign_id":"100516","campaign_priority":1193,"campaign_reranked_priority":null,"special_condition_i

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 16:41:29 GMT

Server: Apache

Set-Cookie: sd_client_en-admin=deleted; expires=Wed, 18-Sep-2013 16:41:29 GMT; path=/; domain=sd.en.softonic.com

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 35

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: application/json; charset=utf-8

...........V*.I,)-V.R..V.....l.........

GET /3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sd.en.softonic.com

Connection: Keep-Alive

Cookie: __utma=30725629.537996373.1411058468.1411058468.1411058468.1; __utmb=30725629.1.10.1411058468; __utmc=30725629; __utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_3347095=false; UACA_3347095=false; _FCen=100516||.100623||.100624|1|1411058467.101361|1|1411058467; UD1_POSITION_3347095=

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 16:41:30 GMT

Server: Apache

Set-Cookie: sd_client_en-admin=deleted; expires=Wed, 18-Sep-2013 16:41:29 GMT; path=/; domain=sd.en.softonic.com

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 16565

Keep-Alive: timeout=3, max=8

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

.............r.J.0..~..=-....H.L..%....Z,.....E....XD..:.k|..c~.......}.....B..|......q.".....\...^<.>.:.|............R.R.r...T.O..OoO...Z......X..:.].....:.C.S.L&...Qv.a...r..jXY.,...e34.../........0...5^[Ul..vU..X..?m<}.b.ts.E`...*..c]5d7a..~....Fab9.;).......Y.....b.l......:.k....,..~..[g......l..}9}54...."(Z...=.}.,.u..c`?...4.x ....O....]8...k.W...........s{w......e..m....'-..dU*X..`..>.#.[p_..V..\-.Y.._.)....P%H..E...%.....~.>p..o....p.6s..h.}.....p/.1.w..Z."M..-b.8@H.......Ex..].i.....Y...sa]bq.Cd...}#Z.......{.=-....".K..P.&.j.@.... ...(..m.x.n.4..:....@vR..$]..u:...V.q.....K...h...wS...x.....eT..:~Ae..j......(g..G.Q.sc0/.<..;C..Q...... .Z. n.! ..,<...P..U.*f....!g.... W8...-..0.3....yVK....[.W.. ..........`.....G..*.i..W,..y..&.....7...^.......s.f..mL.0...|..nXPG.c.L-j ..v.F1,...MBx]...nzV#..:\......@..pf.6.Z.".Ir_v..2...s.qp...N.......n\....KK..P ja.^.T ..5.|..B....oni),4..?.....x.B..pi).\.|7tq\..).6..4.H.j.....:pJ......)...q..[ ....h02z..%i........_.Vt.Y..Ru....*6XJ7h....>%..t...@.....P...Z .M..ih.N[kujZ.Skj.c:.vk;.;R5........ [..n,.n..l9G.n.._.....l.^...KM-. D.|..V.Z=....r............,.==..|8@.:..c..)...5].D{..r[....N...1?...q......S../XE......w.1......jO_..^D ...1;`.B.~.....zq.%V..5'.!Yp. nI@.......^.cO|....;..D<../......3.........N^3e...6.L....1..Y....\...0f^.E7S.Yg(...)[5...HJ........ y.V,jN.y.l....3.....t,n'^..........>MX....}..._...>..h...<..>.W.....$..z..OEHF.....o9....)....z.8x@&l..G..{-i.....<...........?.u[<....@K".DQ......7..,.....-...>D.".

<<< skipped >>>

GET /shared/img/sd_client/sprite.png HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.sd.en.softonic.com

Connection: Keep-Alive

Cookie: __utma=30725629.537996373.1411058468.1411058468.1411058468.1; __utmb=30725629.1.10.1411058468; __utmc=30725629; __utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_3347095=false; UACA_3347095=false; _FCen=100516||.100623||.100624|1|1411058467.101361|1|1411058467; UD1_POSITION_3347095=

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 16:41:30 GMT

Server: Apache

Last-Modified: Thu, 29 May 2014 10:05:02 GMT

Accept-Ranges: bytes

Content-Length: 7892

Cache-Control: max-age=172800

Expires: Sat, 20 Sep 2014 16:41:30 GMT

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: image/png

.PNG........IHDR.......\.....ld......sBIT.....O.....PLTE...................................................................................................................................h.......................f.....n........Dw.I..............U..}..,...v..\. g...........x.a...R..............>....:n........M..].T*..:.....m....tV.....]........7....Q..P..O)....P.i...O..N..N..M....sJ..M..K..L..L..J..J..JJz...I..I..H..I..H..Istv..H..G..H..G..G..G..F..F.x.go...F..F..E..E..D..D..D..B..C/v...B:~4kid..A..A..@..A..>/g..m..p..i...<..=.z:.g.;b..z:.7@.6?[ZW.5>.u8.4<.s7.b..3;.1:.09{O$./8.p5..7.-6.[..m4&Q..,5. 3.k3(X..*2.)1.R..(0.'/.%,.T..f1.e1.&..$,.$,.%-.# .# ."*.#,."*.!)." .!(.!*.!). (..'. (..&. '.I...'..&..%..&..%..%..$..$.."..#..#..".."..!..!....9.899...................*................>.j.....tRNS.....................................................................................................................................................................................................................................................~T.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.......gIDATx...._[.^..'.LhC...4.t.K....H.w0......^.)w.i..T...q..w..bq..*U.2j]..hU...^.}).\.......,.@......._..!0.u>y....@.......eh\..fUHC....c.X;4.c..I...m..c...d.B.2...}. ..- ...A....,.:p51.4.Ig..:.}......r......WXw..........z. 3v..^.....2......5.Bw.;...M.......ffx..Ac.......jf...F53.K...y...^.(h..M].>....................y.o.:...m.-.2C....................(.Jro.P............wqo....7....<...7*.z......

<<< skipped >>>

GET /__utm.gif?utmwv=5.4.6&utms=3&utmn=1923575903&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1411058469371&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 08 Sep 2014 22:24:56 GMT

Server: Golfe2

Content-Length: 35

Age: 843395

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=6&utmn=787385459&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1411058469434&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 08 Sep 2014 22:24:56 GMT

Server: Golfe2

Content-Length: 35

Age: 843395

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=8&utmn=2129336247&utmhn=sd.en.softonic.com&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=iTools For Windows installation assistant&utmhid=302167999&utmr=http://unknown_browser_unknown_version&utmp=/C100624--load2&utmht=1411058469480&utmac=UA-152357-4&utmcc=__utma=30725629.537996373.1411058468.1411058468.1411058468.1;+__utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 08 Sep 2014 22:24:56 GMT

Server: Golfe2

Content-Length: 35

Age: 843395

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Date: Mon, 08 Sep 2014 22:24:56 GMT..Server: Golfe2..Content-Length: 35..Age: 843395..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a.............,...........D..;..

GET /blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=405E8CDB-A8BC-4F43-A4AC-636EF4818C4At1411058467f3347095&id_campaign=101361&id_campaign=100624&ts=1411058467996 HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: softonic-analytics.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 16:41:29 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Wed, 18-Sep-2013 16:41:28 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /js/generated/81fe5-9d45e.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.sd.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 16:41:28 GMT

Server: Apache

Last-Modified: Tue, 16 Sep 2014 12:49:15 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Sat, 18 Oct 2014 16:41:28 GMT

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/javascript

1faa...............z.H.8..?O!a.U..Q.lk!..'Kr.......b..AH.D...-.9.y..`.Inl....jf...V.E .{FFFD...l-....t......{^s....l=[...I:i... ...$...>..........Co.o&..u.nv.I..b3.....}:....d..?....f.'...T..?z..K.i2........ .}<..M.~6..`:..._.qr....G......h..8....W.a.....t.9..|s2MG......T..K......<....t.O...xx1..G..8M..A....N.......t.S....B.&.....9.d....,......8..........~...M....8=O.....8...t<.B..c..Fqv.....,....No...:y(.>..x.s..I6.l.g}.F.BL.L.Y.O..i|......>.&....MR.qor.MF......-.C=....7'.s.Q..*...Q.&A.....X....~...i.'?.zq.W=.Z3..&..o..l.9.MO.....yO.an'.'C..^..uwx.o..^....*.&...g...l.k..._`..Y..,..O~T..u...$.....>6] |...WR.]h3.eo....4......zZ'.7...Y/...{H...q.~.......Iz9......../....O>}1......5....ES.T...d..v......X.F.szdZ........(........k.T.O.m|....t.]....t[.....f..NG......[.......$O..^:Y;..}......}BiW....p.@...]....o......,.......Z.C.N/aA.B...;..............|.<k.O....$.'.r....-.....O...f......v.Q.........<.~..0...s..0J..k.a..J.E..{.....p.T.X......<.>u..a2..;m.P.t<K..n0.....)x.^..wkyz.v.....t!*.`k..k.w.gz.o...,..t6..b.w.H......G5 ......<....Z...^f.Pw,~....#.d.)jw...1.?U'8.....wX.$.R....f.Kz....Pyz....$.M..>...tx..._P.O.r.O>....C8G.........m@o...8.<.X/..D..i...2.8....y.....i..E[...&g...o.....:.y......{..6....0.5....g.x.['.......e0....<.X..E..../...!.A........ .C.@......qz........F-.........n.c..d.W.Fu.NM.TgJ..|.....U..Y.i....@..i...V.k..Br.T....p..."..Uk.~..A3.....i7D..Rp;....^.j..a.'...,4....#5...E8.Ge#..u.}.d<.]......37<bJ...."....Kf.P..*.....?._...`..@.LWU...5....

<<< skipped >>>

GET /css/generated/fad58-b3118.css HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.sd.en.softonic.com

Connection: Keep-Alive

Cookie: __utma=30725629.537996373.1411058468.1411058468.1411058468.1; __utmb=30725629.1.10.1411058468; __utmc=30725629; __utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_3347095=false; UACA_3347095=false; _FCen=100516||.100623||.100624|1|1411058467.101361|1|1411058467; UD1_POSITION_3347095=

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 16:41:30 GMT

Server: Apache

Last-Modified: Tue, 16 Sep 2014 12:49:15 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Sat, 18 Oct 2014 16:41:30 GMT

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 5307

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: text/css

...........<i...q.. .y..= 5...6....b..:....ZdK..".$5o.........%....}.]...........H..v..s...o6...].....].'......hGZ..Iw...I..*2......_...~.E..U.K...........\.U..yxL..8<N..4<...<........sZd..0/.s.v.sG.J.:..U...s...;.]&F\N.9..:..$....>.yI.#...n.,......z.U..6J.. uK...F...$.......?.....t.P. ...m.........Q.V...}.$~".e_.].v/.].ly...'..8....r..E..CKzUp......"?.......?.'....8~.C..zG..i....;.\R6.......d.kB.6U.r..X..-.K..l._.QdM...D/...6....*=...T....x........-.oFo6.6.....x.g.wUw.|..|..y..>.YF....,/9N.......{......81..n.......GUY.l..p$....q.LxL.........H.]Ge....8k.C..,X..cX{. F'.T..B.I.M[5......0.Z.y.....D.}Q=;dl..Lz...]{nH.~....*h..........!H#.e..1...*......m......../..MN..%e......!..o.L.k.......y).A2.B.3.Y..... ...8N....qA2a?.@.I.......S..Z%.J.w._....W.4.."8.@..1..SRH-pb.W....S......2]*..r.=....R........;.................],.m.....~tj.....3.........g..lA.K..L........."7.pj}.{.;....0C...<..... .N[.9.'..E..G.LR..2.......5......Mu....)~..}.L&..3.....i..C..e.....<..}.-..h1../...5%].D.~.O7.=.-$..Pr..~...@.........nN.._%C..]..-..6..`.\..d...0.H.....wt. ...A...[.........d..3.......te..n!..%.de.f3.3Og...~i.Y.,...........z../......x....K}......|....>l....O....[f.......C.&7t...MPL1.c%4.....q.I..E...5Isp]lX......6..N......-Y........0.o.H....S.(@7..D..1f<S'-e..n...,*.m[J......#ce.6.....f...>........H.oQ^f.3.^J...ZW.`y..d..%...q.A.A......q..<....0!...F..1gD0..".5..p..RR.`....5_.Fr\.B0.. iJ.N...l....#...:G....,5cb....z..k.](..m\L. .`'.......kc.xlT,#...."g.ki..3F....9.5../}.4.H.j.$0W...#.g\.*.=.....

<<< skipped >>>

GET /shared/img/sd_client/gradientbg.png HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.sd.en.softonic.com

Connection: Keep-Alive

Cookie: __utma=30725629.537996373.1411058468.1411058468.1411058468.1; __utmb=30725629.1.10.1411058468; __utmc=30725629; __utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_3347095=false; UACA_3347095=false; _FCen=100516||.100623||.100624|1|1411058467.101361|1|1411058467; UD1_POSITION_3347095=

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 16:41:30 GMT

Server: Apache

Last-Modified: Thu, 27 Mar 2014 08:17:09 GMT

Accept-Ranges: bytes

Content-Length: 2958

Cache-Control: max-age=172800

Expires: Sat, 20 Sep 2014 16:41:30 GMT

Keep-Alive: timeout=3, max=8

Connection: Keep-Alive

Content-Type: image/png

.PNG........IHDR...)...........\.....tEXtSoftware.Adobe ImageReadyq.e<....PLTE............................................................................................................................................................O *E...4tRNS....................................................KW"e...HIDATx....v.9..Q{.%y......I.3.\...m..`..u.s1.s.D...Q,. ..`(..S....O.....SJ........8...=.LR.[.&......:.eJY..oI:./...$..BJ.#KS.sH2..%.{F..='..?HR./..6.X......)./R.. ..6.....F..g.[.I.<.l..2$...42.....S.....>..........h2..f..3.........<...X&r....T..gg.-...t.....em<b.V&.g.c....6E,.-..qF6. ...o.Q.$S...(./y...DD..w..:iQ .c....3.&.TcCT.t,UE.E..HP.R.s.......V.`...%...'6.`...g..UIf(..K....uF2..r......T.!..]fLWF..\lU$....=c:2#.`....<...E". .".. qU.7P.[..c.}.J.q.N.*..:g)%...!.. ..,.@x..0.m.8.........A..,9.:l....c....<...G.8...O......?.....5..'}.....TB..#.... Uxq..\..Y....1.P ..P.........Cda...g.....V'....G.:..uW..2.X......a2!.....L..2...mb...f:.i. z........S...u)d8dC.R..q.`..N.^.~.q.......].....U.....%..p1&..b5..K..q..h...D......0...b..?M`...ak..2}J.7....l..<........7\...g!.Jf.0k.......){.-[.f...M.. ..`.hY}..]....Z...z`.J.eb.........Vl..s...p.Zi.*..kd~..Q...l.@......(l.v.L%:..|.c....,..Tg.....I..7[.-#,.....j#...B.`..b.m`..[....g..<Gs......".5c.R.4QC.5.]...X......@.S..I...T.h.6.9MD....w.Xb..N....%0.m./....z{{~.y...........gz.zz.........??{..g~....D...............z._.......k.}...^?v..w.O..........t.x...~..x..}.......................................=..m...]Ew7...._....j_.j.....~.&....\7....~.....Pw..

<<< skipped >>>

GET /shared/img/sd_client/loading.gif HTTP/1.1

Accept: */*

Referer: hXXp://sd.en.softonic.com/3347095/universaldownloader/campaign-101361,100624?sd_timestamp=1411058467

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.sd.en.softonic.com

Connection: Keep-Alive

Cookie: __utma=30725629.537996373.1411058468.1411058468.1411058468.1; __utmb=30725629.1.10.1411058468; __utmc=30725629; __utmz=30725629.1411058468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_3347095=false; UACA_3347095=false; _FCen=100516||.100623||.100624|1|1411058467.101361|1|1411058467; UD1_POSITION_3347095=

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 16:41:30 GMT

Server: Apache

Last-Modified: Thu, 27 Mar 2014 08:17:09 GMT

Accept-Ranges: bytes

Content-Length: 1553

Cache-Control: max-age=172800

Expires: Sat, 20 Sep 2014 16:41:30 GMT

Keep-Alive: timeout=3, max=7

Connection: Keep-Alive

Content-Type: image/gif

GIF89a........................................................................................................................................................................................................................................................................................................................................~..}..|..z..y..x..t..v..s..r..q..p..m..o..l..k..j..............!..NETSCAPE2.0.....!.....|.,............|..;\r....bvwz.....-lqK'......|.[p9.....4lE.....Nj#.....^g.....[c.....G_......[8..!..IV*..'..|#OP1......).. @JGB=93)...$3<9 ......!.....|.,..........y.|.|4RhjW:...)Vilortvd1.&]eA..&Lwt.N`..|<.-[;...|AX....NU....JQ....8M.....%I.....|8C ......<=%.........173/*&!....% '.....!.....|.,..........w.|.|-EY[L3..!GX[_cgjZ..LS6.Cmj..?M)..6r`."I0..Iu:3E...&xZ<A...zr9=.. 8....5!....*0....... *..........!$!................!.....|.,..........w.|.|$9IM@,...8GJOSWZM&..;A..:_]).1<...0dU|.7$..Aj4&3..mR,0..pi(...qk.)..&uX.$..Mw;|....{g.|.......|2....................!.....|.,..........z.|.|.(591#...'258=AE<...)-....-KI ..)...&PE|."...5W,......ZD...._X....c[....fL....Dk4|....9o\......'Jsl......zxa.....[;....!.....|.,..........x.|.|..$'#......"&*.2-......... 77.......=5|.....(C#......G6....LG....QJ...|U?....:Z,|...1_M.N'|.Be]&.fyxtrokV)..;YljS....!.....|.,..........w.|.|...........................$%........*&|......0......3)..95..=9[z...B1<wL./G#.ct8.)M>./mrF.7TL...]nkfc_ZH!.5O_[G....!.....|.,..........v.|.|........|.........1.......gz.|...|;wM.|...Xv'..!.lt..&"jr.|*'So../#5lD.#3.|

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_464:

`.rsrc

`.rsrc

j;j.htzR

j;j.htzR

j;j.hD}R

j;j.hD}R

G><.tn>

G><.tn>

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

88888888888888888

88888888888888888

%u$Vj%

%u$Vj%

t.Gj:W

t.Gj:W

.tMHtJH

.tMHtJH

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

j;j.hh

j;j.hh

hTCP

hTCP

%s:%d

%s:%d

WARNING: failed to save cookies in %s

WARNING: failed to save cookies in %s

About to connect() to %s%s port %d (#%d)

About to connect() to %s%s port %d (#%d)

Connected to %s (%s) port %d (#%d)

Connected to %s (%s) port %d (#%d)

malformed

malformed

:]://%[^

:]://%[^