Gen.Variant.Application.Bundler.Amonetize.11_208031ff5e

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1664

The Trojan injects its code into the following process(es):

1clickdvd__2650_il1135283.exe:652

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1664 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\1MediaPlayer_1.0.exe (7402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\1clickdvdcopyprosetup4.3.1.3.exe (114787 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\1clickdvd__2650_il1135283.exe (4005 bytes)

The process 1clickdvd__2650_il1135283.exe:652 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\10MGBSEC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WHEBI5YX\main[1].css (769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WHEBI5YX\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7KLUZUF\index[1].htm (12315 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WHEBI5YX\cancel[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\10MGBSEC\amipb[1].js (26013 bytes)
%Documents and Settings%\%current user%\Desktop\Continue installation - %appname% Installation.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WHEBI5YX\install[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\10MGBSEC\decline[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\checkbox_yes[1].png (486 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1clickdvd__2650_il1135283.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\logo[1].png (9362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\10MGBSEC\checkbox_yes[1].png (486 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\footer_img[1].png (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\next[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7KLUZUF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7KLUZUF\accept[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7KLUZUF\skip[1].gif (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\10MGBSEC\checkbox_yes[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\checkbox_yes[1].png (0 bytes)

Registry activity

The process %original file name%.exe:1664 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D 66 70 AC 5E 79 F3 98 43 17 70 D9 E2 89 66 F4"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

The process 1clickdvd__2650_il1135283.exe:652 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\1clickdvd__2650_il1135283.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\VersionIndependentProgID]
"(Default)" = "AmiBs.Installer"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}\TypeLib]
"(Default)" = "{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}]
"(Default)" = "Installer Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\TypeLib\{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\LocalServer32]
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\1clickdvd__2650_il1135283.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCR\AmiBs.Installer.1\CLSID]
"(Default)" = "{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}"

[HKCR\TypeLib\{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\1clickdvd__2650_il1135283.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\AmiBs.Installer]
"(Default)" = "Installer Class"

[HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCR\TypeLib\{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}]
"(Default)" = "IBoot"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "1clickdvd__2650_il1135283.exe"

[HKCR\AmiBs.Installer.1]
"(Default)" = "Installer Class"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\TypeLib]
"(Default)" = "{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\ProgID]
"(Default)" = "AmiBs.Installer.1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1372776490"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 45 85 FE D7 F9 CD B8 0C 22 1B 42 73 20 3A AD"

[HKCR\TypeLib\{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}\1.0]
"(Default)" = "InstallerLib"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCR\AmiBs.Installer\CurVer]
"(Default)" = "AmiBs.Installer.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\1clickdvd__2650_il1135283\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\1clickdvd__2650_il1135283\DEBUG]
"Trace Level"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:1664
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\1MediaPlayer_1.0.exe (7402 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\1clickdvdcopyprosetup4.3.1.3.exe (114787 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\1clickdvd__2650_il1135283.exe (4005 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\10MGBSEC\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WHEBI5YX\main[1].css (769 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WHEBI5YX\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7KLUZUF\index[1].htm (12315 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WHEBI5YX\cancel[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\10MGBSEC\amipb[1].js (26013 bytes)
   %Documents and Settings%\%current user%\Desktop\Continue installation - %appname% Installation.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WHEBI5YX\install[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\10MGBSEC\decline[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\checkbox_yes[1].png (486 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\1clickdvd__2650_il1135283.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (31 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\logo[1].png (9362 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\10MGBSEC\checkbox_yes[1].png (486 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (766 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\footer_img[1].png (937 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5M1UBXC9\next[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7KLUZUF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7KLUZUF\accept[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7KLUZUF\skip[1].gif (1 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

Static Analysis

VersionInfo

Company Name: LG Software Innovations
Product Name: 1Click DVD Copy Pro
Product Version: 4.3.1.3
Legal Copyright: 2011 LG Software Innovations
Legal Trademarks:
Original Filename: D:Documents and SettingsJuxhinDesktopjnjn.EXE
Internal Name: D:Documents and SettingsJuxhinDesktopjnjn.EXE
File Version: 4.3.1.3
File Description: DVD Movie Backup Software
Comments:
Language: English (United States)

Company Name: LG Software InnovationsProduct Name: 1Click DVD Copy ProProduct Version: 4.3.1.3Legal Copyright: 2011 LG Software InnovationsLegal Trademarks: Original Filename: D:Documents and SettingsJuxhinDesktopjnjn.EXEInternal Name: D:Documents and SettingsJuxhinDesktopjnjn.EXEFile Version: 4.3.1.3File Description: DVD Movie Backup SoftwareComments: Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /Html/8c5ad15b-ec45-41f9-b821-46e23e670ef8/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.livemonetizer.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Mon, 01 Sep 2014 00:53:40 GMT

ETag: "43883-8871-501ea25b588d8"

Last-Modified: Sun, 31 Aug 2014 10:14:10 GMT

Server: Apache/2.2.15 (Red Hat)

Content-Length: 34929

Connection: keep-alive

.PNG........IHDR.............Iq......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

POST /index.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.livemonetizer.com

Content-Length: 302

Connection: Keep-Alive

Cache-Control: no-cache

Net1.1=&Net2=3.5.21022.08&Net4=4.0.30319&OSversion=NT5.1SP3&Slv=&Sysid=D6A6947B24975DB6AB9DE8B171C5FA6E&Sysid1=D6A6947B24975DB6AB9DE8B171C5FA6E&X64=N&admin=Y&browser=IEXPLORE.EXE&chver=&exe=1clickdvd__2650_il1135283&ffver=&lang_DfltSys=0409&lang_DfltUser=0409&screen=1276x818&ver=1.1.5.26&ts=1409532825

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Mon, 01 Sep 2014 00:53:37 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive

1b79.... ..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">..<html>..<head>..<meta http-equiv="content-type" content="text/html; charset=UTF-8" /> ..<title>%appname% Installation</title>..<base href="hXXp://VVV.livemonetizer.com:80/index.php" />..<link rel="stylesheet" type="text/css" href="hXXp://cdn2.vitaldownload.com/e44013c9-4630-4ac2-bfe2-6e8c40801e01/main.css" /><script type="text/javascript" src="hXXp://cdn1.vitaldownload.com/V2/amipb.js"></script>..<script type="text/javascript">..var g_amiobj = '', g_ami, g_updb = false;..var g_eula = 'VGhlIGRvd25sb2FkIGFuZCBpbnN0YWxsYXRpb24gcHJvY2VzcyBvZiB0aGlzIGZpbGUgaXMgcnVuIGJ5IEluc3RhbGxQYXRoIEluc3RhbGwgTWFuYWdlci4KQnkgY2xpY2tpbmcgdGhlICJBY2NlcHQiIG9yICJOZXh0IiBidXR0b25zIGJlbG93LCBvciBieSBjb250aW51aW5nIHRoaXMgSW5zdGFsbFBhdGggSW5zdGFsbCBNYW5hZ2VyIGluc3RhbGxhdGlvbiwgb3Igb3RoZXJ3aXNlIHVzaW5nIHRoZSBTb2Z0d2FyZSwgeW91IGFncmVlIHRvIGJlIGJvdW5kIGJ5IHRoZSB0ZXJtcyBvZiBJbnN0YWxsUGF0aCBJbnN0YWxsIE1hbmFnZXIgRVVMQSAoRW5kIFVzZXIgTGljZW5zZSBhZ3JlZW1lbnQpIGxvYWN0ZWQgYXQgaHR0cDovL3d3dy5pbnN0YWxscGF0aC5jb20vZXVsYS5odG1sLCBpdHMgUHJpdmFjeSBQb2xpY3kgKGh0dHA6Ly93d3cuaW5zdGFsbHBhdGguY29tL3ByaXZhY3kuaHRtbCkgYW5kIFRlcm1zIG9mIFNlcnZpY2UgKGh0dHA6Ly93d3cuaW5zdGFsbHBhdGguY29tL3Rlcm1zLmh0bWwpLiBGb3IgYW55IGFkZGl0aW9uYWwgaW5mb3JtYXRpb24gb24gSW5zdGFsbFBhdGggSW5zdGFsbCBNYW5hZ2VyIHlvdSBjYW4gdmlzaXQgSW5zdGFsbFBhdGgncyB3ZWJzaXRlIGF0IHd3dy5JbnN0YWxsUGF0aC5jb20gLgoKSW5zdGFsbFBhdGggSW5zdGFsbCBNYW5hZ2VyIGRvZXMgbm90IGhhdmU

<<< skipped >>>

POST /finalize.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.livemonetizer.com/index.php

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.livemonetizer.com

Content-Length: 593

Connection: Keep-Alive

Cache-Control: no-cache

_hdn=0&_ver=1.1.5.26&_p=1&_s=10&_cc=UA&_cid=2650&_psb=0&_cnt=8457fa637c8d882404be14dfb1999ae0&_instid=&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=0&_vert=0&r_DownloadManager=0&r_updater=0.01&r_NetFilter=0.01&r_Yontoo1=1&r_Yontoo3=3&r_Yontoo5=1&r_Yontoo6=1&r_Yontoo7=1&r_NationZoom=1&r_ElectroRevizer1=900&r_ElectroRevizer2=900&r_MariMediaRevize=900&r_PlusHDrow=3&r_AdvancedSysCare=5&r_AmigoIM=6&DownloadManager=3&updater=2&NetFilter=2&Yontoo1=1&Yontoo3=0&Yontoo5=0&Yontoo6=0&Yontoo7=0&NationZoom=1&ElectroRevizer1=0&ElectroRevizer2=0&MariMediaRevize=0&PlusHDrow=1&AdvancedSysCare=1&AmigoIM=1

HTTP/1.1 200 OK

Content-Type: text/xml

Date: Mon, 01 Sep 2014 00:53:39 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive

21d7....<Array><page><f>1</f><fb>1</fb><pt>0</pt><cats>0</cats><updh>1</updh><wrn></wrn><comps>DownloadManager</comps><bdy>DQoNCgk8ZGl2IHN0eWxlPSJ3aWR0aDogMTAwJTsgaGVpZ2h0OiA4NXB4OyBib3JkZXItYm90dG9tLXdpZHRoOiAxcHg7IGJvcmRlci1ib3R0b20tc3R5bGU6IHNvbGlkOyBib3JkZXItYm90dG9tLWNvbG9yOiByZ2IoMTcwLCAxNzAsIDE3MCk7IG1hcmdpbi10b3A6IDBweCI DQoJPGltZyBzcmM9Ikh0bWwvNDBlODM4ZGUtNDYxMS00NzU5LTg3ZGYtZWMxODMwMWIwYWE3LyVhcHBpbWFnZXVybCUiIHN0eWxlPSJ3aWR0aDogNzVweDsgaGVpZ2h0OiA3NXB4OyBmbG9hdDogbGVmdDsgZGlzcGxheTogYmxvY2s7IG1hcmdpbjogMTBweCIgLz4mbmJzcDsmbmJzcDsNCgk8cCBzdHlsZT0icGFkZGluZzogNXB4OyB0ZXh0LWFsaWduOiBsZWZ0OyBmb250LXNpemU6IDE3cHgiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTdweDsgdGV4dC1hbGlnbjogbGVmdCI RG93bmxvYWQgJmFtcDsgSW5zdGFsbCA8Yj4lYXBwbmFtZSU8L2I IGZvciBGUkVFPC9zcGFuPg0KICA8L3A DQo8L2Rpdj4NCjxkaXYgaWQ9ImRfYW1pX0Rvd25sb2FkTWFuYWdlciIgc3R5bGU9ImhlaWdodDogMTMwcHgiPiANCjxiciAvPg0KPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTNweDsgdGV4dC1hbGlnbjogY2VudGVyOyBwYWRkaW5nOiAwcHgiPjxiPkNsaWNrIE5leHQgb3IgSW5zdGFsbCBiZWxvdyB0byBiZWdpbiB5b3VyIGluc3RhbGxhdGlvbi48L2I PC9wPg0KCTxkaXYgZGF0YS1hZGp1c3QtaGVpZ2h0PSIwIiBpZD0ibWlkZGxlIiBzdHlsZT0id2lkdGg6IDEwMCU7IHBhZGRpbmc6IDBweDsgaGVpZ2h0OiAxMTBweDsgbWFyZ2luLXRvcDogMHB4Ij4NCgkNCgkJPHRleHRhcmVhIHNwZWxsY2hlY2s9ImZhbHNlIiBjbGFzcz0idGV4dGFyZWExIiBpZD0iYW1pX2V1bGFfRG93bmxvYWRNYW5hZ2VyIiByZWFkb25seT0icmVhZG9ubHkiPgkJDQoJCTwvdGV4dGFyZWE DQoNCgk8L2Rpdj4NCgk8L2Rpdj4NCg0KCTxpbnB1dCBpZD0iaV9hbWlfRG93bmxvYWRNYW5hZ2VyIiB

<<< skipped >>>

GET /Html/40e838de-4611-4759-87df-ec18301b0aa7/%appimageurl% HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.livemonetizer.com

Connection: Keep-Alive

HTTP/1.1 400 Bad Request

Content-Type: text/html; charset=iso-8859-1

Date: Mon, 01 Sep 2014 00:53:40 GMT

Server: Apache/2.2.15 (Red Hat)

Content-Length: 314

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.livemonetizer.com Port 80</address>.</body></html>.nt>....

GET /Html/40e838de-4611-4759-87df-ec18301b0aa7/%appimageurl% HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.livemonetizer.com

Connection: Keep-Alive

HTTP/1.1 400 Bad Request

Content-Type: text/html; charset=iso-8859-1

Date: Mon, 01 Sep 2014 00:53:40 GMT

Server: Apache/2.2.15 (Red Hat)

Content-Length: 314

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.livemonetizer.com Port 80</address>.</body></html>.HTTP/1.1 400 Bad Request..Content-Type: text/html; charset=iso-8859-1..Date: Mon, 01 Sep 2014 00:53:40 GMT..Server: Apache/2.2.15 (Red Hat)..Content-Length: 314..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.livemonetizer.com Port 80</address>.</body></html>...

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/main.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Content-Length: 7737

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:36:32 GMT

Content-Disposition: attachment; filename="main.css"

Last-Modified: Thu, 12 Jun 2014 09:27:02 GMT

ETag: "b40f2509433ec024dd4958f40c593dd0"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11787

X-Cache: Hit from cloudfront

Via: 1.1 4c1f0139ed0ab9168f34254dee1c1a16.cloudfront.net (CloudFront)

X-Amz-Cf-Id: iAOhv-Iwyy4ga53nwpNVbsGQjyTRcrDp2wBUQFOr3vvhbcSEEakkeQ==

body {. font-size:10px;. background:#eaeaea;. font-family: verdana;. margin: 0;. padding: 0;. color:#000000; .}.div, span, textarea {. cursor: default;.}.a, a span, a div {. cursor: pointer;.}../* whole screen stules */...ami-wrapper{. background : none no-repeat scroll 0 0 #eaeaea;. border:2px solid #989898; .}../* moddle element */..#ami-body.{. padding-left:27;. padding-right:27;.}...bottom-line{. background-color:#5cafd4;. height:45px;. width:100%;.}.table {. border-collapse: collapse;. margin: 0 ;. padding: 0;. font-size:10px;.}..textarea {..font-size:10px;..font-family: verdana;..width:98%;..padding: 5px;.}...textarea1{. background:#ffffff;. color:#000000;. height:100%;. width:100%;. overflow-x:hidden;.}..td{. padding: 0px;.}../* footer and footer buttons */...bottom-holder{. background-image:url('footer_img.png');. background-repeat:repeat-x;. height:59px;. position:absolute;. bottom:0px;. padding-left:20px;. padding-right:20px;.}...#btnNext{.background: url('next.gif') no-repeat;.}..#btnCancel{.background: url('cancel.gif') no-repeat;.}..#btnDecline{.background: url('decline.gif') no-repeat;.}..#btnAccept{.background: url('accept.gif') no-repeat;.}..#btnSkip{.background: url('skip.gif') no-repeat;.}..#btnInstall{.background: url('install.gif') no-repeat;.}....left-bottom-button-holder,.right-bottom-button-holder.{.width:101px;.height:24px;.cursor:hand;.display:none;.}...left-bottom-button-holder.

<<< skipped >>>

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/footer_img.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 937

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:36:33 GMT

Content-Disposition: attachment; filename="footer_img.png"

Last-Modified: Thu, 12 Jun 2014 09:27:01 GMT

ETag: "e2bf2d203887961a2e93c1a68b7e7534"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11787

X-Cache: Hit from cloudfront

Via: 1.1 4c1f0139ed0ab9168f34254dee1c1a16.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RlTV9nNV6r0bztqL913pcjor9CxkMfA0JDM-Ec26KFJ9BSJc0IAEgQ==

.PNG........IHDR.......;........B....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:E57C9F23EFB911E397DFE4EB8E55B910" xmpMM:DocumentID="xmp.did:E57C9F24EFB911E397DFE4EB8E55B910"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E57C9F21EFB911E397DFE4EB8E55B910" stRef:documentID="xmp.did:E57C9F22EFB911E397DFE4EB8E55B910"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.b.y........g...?.(....0.....N.]l....IEND.B`.....

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/skip.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1740

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:36:34 GMT

Content-Disposition: attachment; filename="skip.gif"

Last-Modified: Thu, 12 Jun 2014 09:27:02 GMT

ETag: "7c96892b1948a6e97494e2d58cafe1c0"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11787

X-Cache: Hit from cloudfront

Via: 1.1 4c1f0139ed0ab9168f34254dee1c1a16.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PFtrONElNaCQciemkdCVtSAWJrnW9ZEsc9zztXF8NReDh-0nr9u0Ow==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,....e........|"E......*\......?...)....3j...... Cb.....R...\.....0c..I.&K8q........@...J....>...C...:P.J.J.*U.X.:......`...C....h....'...d..= W...x...Cp..=....L..`>}...Q...>b.....N.3~.k..y..>....M.....I...CB..1R......?....1.P............. _.\. :.f..$...@*@..$h. @y....$(P.A..._..O .....O.>.Ct..Idh. B.\.. ..........f.!D.0..D..Uha}..B.!..... .(.....H...Q."..b..! ...[..../4...Vxq.......D.9"!.....L6...O&....L........C... ......ta...$ D./ ...p:YH...h..x.......F....."/<A...0.. .x........J..D......z2B."..*....jj#.(.F.d8....|...#......t..!.$..........[*$.5..#.6....F.l#.0..#%....p...".........!.4.I...R.....m$.A............".T..%.pPC./.@....P.".......!.%......v.1...4.$$.l..(.lr%}HQ..f@.. .`..$..`...l0.'6T@..?.........*cB.%PG-..TW

<<< skipped >>>

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/decline.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1293

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:36:34 GMT

Content-Disposition: attachment; filename="decline.gif"

Last-Modified: Thu, 12 Jun 2014 09:27:01 GMT

ETag: "137a96f0655570ffdf65ae14dad52404"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11787

X-Cache: Hit from cloudfront

Via: 1.1 4c1f0139ed0ab9168f34254dee1c1a16.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1zrZpf13QcoSgNLWGzBa83lhsqcGrHds3sGxy3lCnp3IUKwRvtMCtA==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................!.....t.,....e........ns.............n..mB.............FBm.s.C.............AB.DE.............DDI.GGF.............G.I.........(.....HJ.LML..........%....8...z.J.\..a.%N.5qB......8...F......H..F...$)..e.&P.A.I....37>......Ax..JT.N%D..\....)..H.J..U...H..u...[.... ..&/H.{!%.V.m...X0...)Se.......W.P!D.J.... ^.a@..T..(.........B.E....4.<Z4..-2..r....7L.....m*W.Y..........Nc...<.x..a.....Do..........;........{......_.>.. ..3(p....W._9p........{.........z... {[.....Vh...F0@..vX..Y.....D.E..v.!. f.".%j...#bh#._....[....@.)..@.1..[.....L2YD...I..C.X...H@..M2.D.`.....|...h....^.0@.pv.D..`...S.........o....z....7......9.!b.!...Vji. .... ....`<A'..f...T....=......:....0A.[$0@.>......{....a...&.....8@........a...&`...6.l.bP0....;n._. B...@.....l...a.......d......,....k......!h4....G....Wl.j..g....w.q.g.2..$.l..(....,....0..s.4..r......<....6.-t.?.m4.l.<G.o....PG-..TWM..M[...P....X...$d.m..g..@ .;....

<<< skipped >>>

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/accept.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1924

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:36:34 GMT

Content-Disposition: attachment; filename="accept.gif"

Last-Modified: Thu, 12 Jun 2014 09:27:01 GMT

ETag: "6f7cf4707c399344760298cf068eafd6"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11787

X-Cache: Hit from cloudfront

Via: 1.1 4c1f0139ed0ab9168f34254dee1c1a16.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2PH0GCxpdQXldWM5y_lZ16Ttyunek9_VJEwuzt42o-a1KbN0HGdrig==

GIF89ae............ppp@.H>.H=.F=.D;.B:.A8.?4.92.7-.3-.2 ./*.-)./'. ...&.<>.Q... ., .6&.26.C,.7;.I?.K<.GA.O>.JQ.\..$'.1'.0".*,.5..9).1-.74.?..7-.4:.C9.B6.>>.G=.G<.E=.G;.CA.L@.I=.E@.I?.G?.H>.F>.F@.I?.G?.GC.M@.H>.GC.MB.LB.KE.OC.JQ.Xu.z..................#.)!.().0 .&(.-&. %.*'.-'.,)..)....5-.4 .0-.3-.3*./5.<0.7/.4..31.70.5/.5:.A<.B9.?7.>6.;6.<-.39.@8.>;.A;.A;.B:.A5.:=.D<.A<.C;.B>.D>.E=.B=.D<.AA.IC.KB.HC.IC.K@.GD.L?.F3.8D.IC.IE.K>.D<.AD.KM.QL.PR.XY.^`.e_.e^.dg.lo.tl.qk.ol.pj.nz..y.~y.}..........................................................................................".%&.)#.&&.)4.9'. ). ). .. .-*.--.0,./1.5/.22.43.7<.>5.7C.F?.CG.I?.BZ.]i.lf.ij.mh.kx.{v.x..............................'.(*. *. (.)-../.0...-.--.-.....................*.(,. ?.=C.B*.& .'-.&.........wwwuuu...!.......,....e..........'......*\..........@..?D...!$... C..)..G!E~8sV.P.B#G...!.4g.`...3&4..~..'...??j. 4d...P.J....S?T.:... ....9;.O@."0X.......p...;....x......_.0d...h...)p........lH...re..3k.......;.A....=....a`.. y....G........CG.<u...N...... _n.P..w..)....9...9...w;p....#*@*9..._.........c'C.z3L..3...;..1....8......;s4.`..F(...V....fHa....L.%..F.$.h...D....h...0.h"*..h../FQ..j....@.aJ.......,..;.0.F.K6..$.,8J...........U. f.?r...d.........p..&...0.;o..d..........$...g.I..J..l..;..1.,.Xb..p...'.n...o.P..l.j....J.....I....c....j.,.......0I........jl.....(.&.....1BA.Tk...*pJ..drM..T[A....m.b......km....n..V.N-.../..NQ....,.....n.....8./<p.LL#.........R...w..7.p..

<<< skipped >>>

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/checkbox_yes.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 243

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:50:16 GMT

Content-Disposition: attachment; filename="checkbox_yes.png"

Last-Modified: Thu, 12 Jun 2014 09:27:01 GMT

ETag: "0bd7bcc8b99bf952120ffd5e4200816b"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11513

X-Cache: Hit from cloudfront

Via: 1.1 391dfa5542d8d96966e1c02fe2c44aa9.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bZX2zntphsX8QC-b3DlFXNJZDTkvPOfXTOz-UhvozG_Ihzs2uXM1pg==

.PNG........IHDR................a....IDATx...q.. ....M..L..D.........S.zOO..uo.....tjH.......3T.)esy.w.........u]...1.2iF.!....6..I;.,..M....vP.A..y6...L;....=......8.......L.t.B..\..>...X.b.......1....r.'.PJ...ua@s.....n....p.N.......IEND.B`.....

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/checkbox_yes.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 243

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:50:16 GMT

Content-Disposition: attachment; filename="checkbox_yes.png"

Last-Modified: Thu, 12 Jun 2014 09:27:01 GMT

ETag: "0bd7bcc8b99bf952120ffd5e4200816b"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11513

X-Cache: Hit from cloudfront

Via: 1.1 391dfa5542d8d96966e1c02fe2c44aa9.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Fr10d5qlaa4kGJmdwyu2QF9c9UJmiaPBstL65ehEkMn10By0dnrExg==

.PNG........IHDR................a....IDATx...q.. ....M..L..D.........S.zOO..uo.....tjH.......3T.)esy.w.........u]...1.2iF.!....6..I;.,..M....vP.A..y6...L;....=......8.......L.t.B..\..>...X.b.......1....r.'.PJ...ua@s.....n....p.N.......IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png..Content-Length: 243..Connection: keep-alive..Date: Fri, 22 Aug 2014 22:50:16 GMT..Content-Disposition: attachment; filename="checkbox_yes.png"..Last-Modified: Thu, 12 Jun 2014 09:27:01 GMT..ETag: "0bd7bcc8b99bf952120ffd5e4200816b"..Accept-Ranges: bytes..Server: AmazonS3..Age: 11513..X-Cache: Hit from cloudfront..Via: 1.1 391dfa5542d8d96966e1c02fe2c44aa9.cloudfront.net (CloudFront)..X-Amz-Cf-Id: Fr10d5qlaa4kGJmdwyu2QF9c9UJmiaPBstL65ehEkMn10By0dnrExg==...PNG........IHDR................a....IDATx...q.. ....M..L..D.........S.zOO..uo.....tjH.......3T.)esy.w.........u]...1.2iF.!....6..I;.,..M....vP.A..y6...L;....=......8.......L.t.B..\..>...X.b.......1....r.'.PJ...ua@s.....n....p.N.......IEND.B`...

GET /V2/amipb.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn1.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 40585

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:33:35 GMT

x-amz-meta-cb-modifiedtime: Tue, 29 Jul 2014 10:46:22 GMT

Last-Modified: Wed, 30 Jul 2014 08:42:33 GMT

ETag: "d10a2ed9a4a2e81b939e360fc4931c09"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11787

X-Cache: Hit from cloudfront

Via: 1.1 16ca5942af24643aa2b8013f40df9e53.cloudfront.net (CloudFront)

X-Amz-Cf-Id: A8XiAnMWYOISZrQWGmk1ooXeWt85xSgh6nh17bCDSGeX8QSpPxaPZw==

//<!-- ../* Progress bar */..var g_AmiPbs = new Array();..function LogMessage(message)..{.. try.. {.. g_ami.Log(message);.. }.. catch (excpt) { }..}..function AmiPbDelayedCheck(id) {.. var that = g_AmiPbs[id];.. if (that && that.periodicCheck) that.periodicCheck();..}..function InitPb() {.. .. LogMessage('InitPb function started');.. .. Show('header-close', 'none');.. var progress1 = new AmiPb("download_progress_host", 400, 20);.. var progress2 = new AmiPb("install_progress_host", 400, 20);.. progress1.start(function () {.. var p = g_ami.DownloadProgress;.. this.setValues(p, p);.. if (g_ami.DownloadCompleted) {.. LogMessage('InitPb g_ami.DownloadCompleted is True');.. g_ami.ReleasePostponedInstallations();.. for (var j = 0; j < g_comps.length; j ).. if ((g_comps[j].id == 0 && g_comps[j].sel == 0) || g_comps[j].id == 0x7fffffff) {.. g_ami.AddThanksParameter('c[' g_comps[j].sn '][s]', g_comps[j].pir ? '-2' : '-1');.. if (g_testa && !ArrayContains(g_notest, g_comps[j].sn) && !ArrayContains(g_notest1, g_comps[j].sn)) {.. if (g_testa.constructor != Array || ArrayContains(g_testa, g_comps[j].sn)).. g_ami.WriteProfileString(g_testf, '', g_comps[j].sn, g_comps[j].pir ? 'R' : 'S');.. }.. }.. this.stop();.. }.. }, 20);.. progress2.start(function ()

<<< skipped >>>

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/cancel.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1262

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:36:33 GMT

Content-Disposition: attachment; filename="cancel.gif"

Last-Modified: Thu, 12 Jun 2014 09:27:01 GMT

ETag: "d92b8cccf7616d9e5f6162571dd3e1e8"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11787

X-Cache: Hit from cloudfront

Via: 1.1 391dfa5542d8d96966e1c02fe2c44aa9.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AZXGu9NN2sFZyDmkiPC2rkdZ3QyxduIWcc0iA2xtdgvSXqpDKgPcXA==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................!.....u.,....e........ot.............o..nC.............GCn.t.D.............BC.EF.............EEJ.HHG.............H.J............*..IK.MNM......8.....H..H.`....*....!'O"J.H..D%....P.... C..8......D!.....0c.......4s.....O.....I.h.(S.QY.....K....c...Vg,.......f. 0.k... \..b.. L..@.J...)U.U.b......W.0......t..a.....7..7..."pt.<`...}/..M.o.,...^......_...`...MT.8p.........Z..../.^...j:Y.K.N.zt,,.`...;.)&.h.>....X4.p...z...D. ............................... }.J0...&x...f...-......AH.]pa..(..".A....=.(....p....X#...0#.5. ..A....H&ib.......PF).._x.E...`..^.0...n9..[z........".P..P.@..t..$...!..|....b..F.. ....$.....`....!g.6.j..?..A.[....?t............!d..........v....%.A.c.P@. .0..c.P..cT0@. .. ...P.... ......!gt......m...k..........n.f.AH...k...............p..../.......7.....!...Wl.K..c....C..!l.,..$..r.(....,.<r.".!..n.l..8....<....=.-..o....t....L7...s....;....

<<< skipped >>>

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/next.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2157

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:36:34 GMT

Content-Disposition: attachment; filename="next.gif"

Last-Modified: Thu, 12 Jun 2014 09:27:02 GMT

ETag: "ba2e9f310f01397a1f41cb6a7ab2e3c9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11787

X-Cache: Hit from cloudfront

Via: 1.1 391dfa5542d8d96966e1c02fe2c44aa9.cloudfront.net (CloudFront)

X-Amz-Cf-Id: glRhDCIWFjGo0H3geoKOn1PyB1el3Dk0zxMRhlJ8u-DHd1I8iFWFTg==

GIF89ae............pppC.K@.H>.H=.F=.D;.B7.>6.<4.9-.3-.2 ./*.-)./'. ...&.<>.Q..' ., .6&.26.C5.A,.7;.I<.G .*'.1'.0".*$.,,.43.<*.11.9/.8..76.?9.D5.=4.<:.C9.B9.A6.><.E:.B?.I>.G=.G;.C<.D@.I>.F@.I?.H>.GC.MB.LB.K@.IE.OK.RT.\..$..# .%!..)&..%. ".'&.-*.1!.&).1-.5)..&. -.5*.0'.,-.4*.0)..)./(.-'.-0.8,.2'.,)../.6-.4,.1 .1 .1)..0.7-.2,.23.;-.2*./3.9/.42.90.60.50.7..3..5-.24.;1.70.55.<4.;..48.?7.>6.=5.<4.:2.78.?6.=<.B:.A9.@8.?2.7-.3:.A8.?7.=;.B8.><.B<.C;.B;.@7.=@.H>.D>.D=.D:.A>.D:.?C.KC.IC.J8.=D.L?.F3.8?.F<.AE.JD.KF.LB.HA.FD.HN.TK.PP.TX.]a.fe.jn.rx.|~............................................$.('. %.)4.9).,).-*.. .-). .. .-*.--.10.41.5/.22.44.86.:C.HG.IH.L_.b.............................................'.(*.*(.)-../.0-.->.>C.E........................,. .&..................uuu...!.......,....e..........'......*\.........'.....f...i... C...i...Az...qZ.O"Ej...Z..0c....Z...4..8.....|.X.....P..X:5.U.U.j.....v3...Q.......].....p.....F...FM.R....1r..a........A.D.....NL........2...J.[T:p.....H.^....G...IQ..-Z{Z.&].....w....u.O<:<.....G..!pD......g...\.l\.q..'.......H..S...-....Q...lp)....D.......h......>...E..p...i@a!....D..0...\4..<i4..#..XH$...b .0...S.T.!8....<........8...G.f... .."K)S..M l.Q.,....>..RJ.9.QG.9..G..h...;6QP.p.)..t..G..h..?.X.'7V..J<....8....>.$A.>..R.?.."..p.!D ~..G...b...h.B....AA0........ .,......#...~ D<.."H ....,..B.<....8..r."....7.Xc...|.K(#(..................nD.D ....8.(aK>.............

<<< skipped >>>

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/install.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1977

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:36:34 GMT

Content-Disposition: attachment; filename="install.gif"

Last-Modified: Thu, 12 Jun 2014 09:27:02 GMT

ETag: "6f21b0fe1db5314357f4d28b9303fa81"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11787

X-Cache: Hit from cloudfront

Via: 1.1 391dfa5542d8d96966e1c02fe2c44aa9.cloudfront.net (CloudFront)

X-Amz-Cf-Id: XmPQbbTm-VF8Sbx_Nm_ZxOdbuL7O1aw7mCkNOO-y2F1k9pHUaz_Omw==

GIF89ae...............pppC.K@.H>.H=.F=.D;.B:.A8.?-.3-.2 ./*.-)./'. &.<>.Q..' ., .6&.26.C5.A,.7;.I<.G .*'.1'.0".*$.,,.43.<*.11.9/.8..76.?9.D5.=4.<:.C9.B9.A6.><.E?.I>.G=.G;.C<.D@.I>.F@.I?.H>.GC.MB.LB.K@.IE.OC.KK.RT.\k.q........#!..)%. ".'&.-*.1!.&)..&. -.5*.0*.0'.-0.8'.,)../.6-.4,.1 .1)..0.7-.2,.23.;-.2*.//.42.90.60.50.7..3..5-.24.;1.70.55.<4.;..46.=5.<4.:2.78.?4.9<.B:.A9.@7.>6.<2.7-.38.?;.B8.><.B<.C;.@;.B>.D>.D=.D>.DC.KC.IC.JD.L?.F3.8?.F<.AE.J;.@>.DD.KC.IH.NB.HA.FQ.WO.SP.TX.]W.[a.fe.jk.on.rx.}y.}s.v~..........................................................................$.('. %.)4.9).,).- .-). .. .-*.--.10.41.5/.22.44.86.:C.HG.I@.D_.bv.y.............................................'.(*.*(.)-../.0-.->.>C.E.................................,. .&............uuu.........!.......,....e..........7......*\.........'p....b. ..... C...(...?v.{....E"E"....:.0c...........8sG...x.X.....P..X:5...U.j.jc.$u3...1.E.....].....p....v.... I.RpD..0n .q...... ^.x.......<....:|....PA... .d(.!...........[.F-.]...c....u!F:8.:.. .@..$.t'....VC.N.z....;...{w............hP).g. ...(.O_........N?.........W...$g ~t`.G:-@Q...Th....#...vh...xx.......'V...pX.F..f...4..DAy....;j.....b......$..."&.....y .!<...c......[..F......yx2..%....<..f......t.Y..t.........C.IK>D.R..@..g(....-.."@ s.9g. d...Wl..6.. . .....z.a.......z..*....#....CI....K.Y..G....K<...k<r4.l.cL..:..1.'........-...T....[...fY..ux#@6...O..pc....;n.k....kD..*.........3s.....&Q...

<<< skipped >>>

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/checkbox_yes.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 243

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:50:16 GMT

Content-Disposition: attachment; filename="checkbox_yes.png"

Last-Modified: Thu, 12 Jun 2014 09:27:01 GMT

ETag: "0bd7bcc8b99bf952120ffd5e4200816b"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11513

X-Cache: Hit from cloudfront

Via: 1.1 ec74445a7733efc28e51489e77d41558.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bgEtmSPb8j4ca9AkB2qoSCJI66dV-ZMfphL2gER6YrkeXundonejtw==

.PNG........IHDR................a....IDATx...q.. ....M..L..D.........S.zOO..uo.....tjH.......3T.)esy.w.........u]...1.2iF.!....6..I;.,..M....vP.A..y6...L;....=......8.......L.t.B..\..>...X.b.......1....r.'.PJ...ua@s.....n....p.N.......IEND.B`.....

GET /e44013c9-4630-4ac2-bfe2-6e8c40801e01/checkbox_yes.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.livemonetizer.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 243

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:50:16 GMT

Content-Disposition: attachment; filename="checkbox_yes.png"

Last-Modified: Thu, 12 Jun 2014 09:27:01 GMT

ETag: "0bd7bcc8b99bf952120ffd5e4200816b"

Accept-Ranges: bytes

Server: AmazonS3

Age: 11513

X-Cache: Hit from cloudfront

Via: 1.1 ec74445a7733efc28e51489e77d41558.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4CjamexIAhu7W_zf36h0_M8FttMo_bm9jT4dkup5gWw-byxG1IxNYw==

.PNG........IHDR................a....IDATx...q.. ....M..L..D.........S.zOO..uo.....tjH.......3T.)esy.w.........u]...1.2iF.!....6..I;.,..M....vP.A..y6...L;....=......8.......L.t.B..\..>...X.b.......1....r.'.PJ...ua@s.....n....p.N.......IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png..Content-Length: 243..Connection: keep-alive..Date: Fri, 22 Aug 2014 22:50:16 GMT..Content-Disposition: attachment; filename="checkbox_yes.png"..Last-Modified: Thu, 12 Jun 2014 09:27:01 GMT..ETag: "0bd7bcc8b99bf952120ffd5e4200816b"..Accept-Ranges: bytes..Server: AmazonS3..Age: 11513..X-Cache: Hit from cloudfront..Via: 1.1 ec74445a7733efc28e51489e77d41558.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 4CjamexIAhu7W_zf36h0_M8FttMo_bm9jT4dkup5gWw-byxG1IxNYw==...PNG........IHDR................a....IDATx...q.. ....M..L..D.........S.zOO..uo.....tjH.......3T.)esy.w.........u]...1.2iF.!....6..I;.,..M....vP.A..y6...L;....=......8.......L.t.B..\..>...X.b.......1....r.'.PJ...ua@s.....n....p.N.......IEND.B`...

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1664:

.text

.text

`.data

`.data

.rsrc

.rsrc

ADVAPI32.dll

ADVAPI32.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

GDI32.dll

GDI32.dll

USER32.dll

USER32.dll

COMCTL32.dll

COMCTL32.dll

VERSION.dll

VERSION.dll

advapi32.dll

advapi32.dll

advpack.dll

advpack.dll

wininit.ini

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

Software\Microsoft\Windows\CurrentVersion\App Paths

setupapi.dll

setupapi.dll

setupx.dll

setupx.dll

IXPd.TMP

IXPd.TMP

TMP4351$.TMP

TMP4351$.TMP

FINISHMSG

FINISHMSG

USRQCMD

USRQCMD

ADMQCMD

ADMQCMD

msdownld.tmp

msdownld.tmp

wextract.pdb

wextract.pdb

PSSSSSSh

PSSSSSSh

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

GetWindowsDirectoryA

GetWindowsDirectoryA

ExitWindowsEx

ExitWindowsEx

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

rundll32.exe %s,InstallHinfSection %s 128 %s

rundll32.exe %s,InstallHinfSection %s 128 %s

SHELL32.DLL

SHELL32.DLL

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows\CurrentVersion\RunOnce

PendingFileRenameOperations

PendingFileRenameOperations

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

wextract_cleanup%d

%s /D:%s

%s /D:%s

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

Command.com /c %s

Command.com /c %s

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

33333330

33333330

3333333

3333333

33333333

33333333

1clickdvdcopyprosetup4.3.1.3.exe

1clickdvdcopyprosetup4.3.1.3.exe

1clickdvd__2650_il1135283.exe

1clickdvd__2650_il1135283.exe

1MediaPlayer_1.0.exe

1MediaPlayer_1.0.exe

.kT=Ki

.kT=Ki

*%7XU

*%7XU

*%CMUw

*%CMUw

.mAXtd

.mAXtd

.vFx8

.vFx8

P%cX[G

P%cX[G

F5qr #Ww.kZ

F5qr #Ww.kZ

-S}!-

-S}!-

%CxQ"s

%CxQ"s

.Tv3T

.Tv3T

nF-jKxrC8ChFn}'

nF-jKxrC8ChFn}'

;%U%c

;%U%c

%FZiu

%FZiu

bu.EU

bu.EU

.LLE\y

.LLE\y

.WJ)E

.WJ)E

Q.V\}F%X

Q.V\}F%X

n.Uk|(`f

n.Uk|(`f

E%u.[

E%u.[

>ÃŽj

>ÃŽj

%X08-R!ji21

%X08-R!ji21

-M.wI4

-M.wI4

,2%D};i

,2%D};i

7W.fI

7W.fI

d.zaM

d.zaM

.$Z%f@]

.$Z%f@]

-'1.Pc

-'1.Pc

1v.dH

1v.dH

]%F=%

]%F=%

h?.kmO

h?.kmO

U4i.ASx

U4i.ASx

"}[% .ZR

"}[% .ZR

.Hc@ b

.Hc@ b

8.JjO

8.JjO

}:3/'/}

}:3/'/}

Z-7L}$

Z-7L}$

E1%ufL

E1%ufL

5@.UC_2$

5@.UC_2$

B%cl{

B%cl{

OExE-

OExE-

.lVJgB

.lVJgB

I.pRO

I.pRO

K3.xP

K3.xP

E7.wy5

E7.wy5

.if7xl

.if7xl

.COO>n

.COO>n

.aHnA

.aHnA

S-sM}'

S-sM}'

ZÙq

ZÙq

.iOrmb }

.iOrmb }

v.Yks^

v.Yks^

.OO$t

.OO$t

LH.Gv#_}

LH.Gv#_}

1%cltGz

1%cltGz

-F}g]J

-F}g]J

.BxGf4`

.BxGf4`

.BBJ]G

.BBJ]G

%x(DFgx

%x(DFgx

.tNZu?K

.tNZu?K

k:\eG

k:\eG

.IFdP

.IFdP

X.aXP

X.aXP

wXu.UrK

wXu.UrK

PxTu.iM

PxTu.iM

I'i%D

I'i%D

FXy%sL=l

FXy%sL=l

%XzB)

%XzB)

*B|%C

*B|%C

n/M.RC

n/M.RC

04R%X)

04R%X)

%DS:'

%DS:'

N.Pei

N.Pei

rL"d-r}

rL"d-r}

.zy%*

.zy%*

Eg=.zL

Eg=.zL

.UIp#

.UIp#

.BcIl

.BcIl

N.sG

N.sG

b%Xt[TTf

b%Xt[TTf

r.Lg!?

r.Lg!?

/6R.FW

/6R.FW

l:%Si

l:%Si

%Uf[n

%Uf[n

AH:#c.Na

AH:#c.Na

^.pljbv

^.pljbv

x|%Xm

x|%Xm

%6%do

%6%do

T~.fG

T~.fG

b%unp

b%unp

GMa].BDD

GMa].BDD

".bB;R

".bB;R

.YPY;

.YPY;

Jo.lP

Jo.lP

X%X^

X%X^

.zMIt

.zMIt

.Nv6B

.Nv6B

JTCP

JTCP

1%xrR

1%xrR

be.Gt

be.Gt

O8%dO

O8%dO

AftP

AftP

m^Ii%d

m^Ii%d

K.ed'jD

K.ed'jD

QYF.Ps

QYF.Ps

}Wf`ó

}Wf`ó

u.II:%j

u.II:%j

04E%U

04E%U

Uftp

Uftp

)%c)Y

)%c)Y

crZkNN.qS

crZkNN.qS

%FPU$

%FPU$

.~.eJI

.~.eJI

.EnSO

.EnSO

%S{P@

%S{P@

~U.gd

~U.gd

K:-.ST

K:-.ST

$.Yak

$.Yak

]%u{3

]%u{3

.Ydht

.Ydht

O`_%U!3

O`_%U!3

vxÍ

vxÍ

^.Ms]

^.Ms]

-P.Nx

-P.Nx

B6?.Ei

B6?.Ei

q.upH

q.upH

6UiS%c

6UiS%c

>[.HH

>[.HH

.vK%Y

.vK%Y

.qqIo^

.qqIo^

A2^%u

A2^%u

k%xrB

k%xrB

(.qH>

(.qH>

42p-.LJ!

42p-.LJ!

mm.BKP

mm.BKP

NA.KJ]

NA.KJ]

*.TXx

*.TXx

c ;.dCFU

c ;.dCFU

a{.wC

a{.wC

k-1T}

k-1T}

.RC|/1} Y

.RC|/1} Y

.wsu5\

.wsu5\

.oikK

.oikK

.gn!&Rl)

.gn!&Rl)

%Sa&HE1f]

%Sa&HE1f]

v.Ei2r]J

v.Ei2r]J

5N%cs

5N%cs

MÚ]

MÚ]

/N.PD

/N.PD

l*).OF

l*).OF

u.oH=

u.oH=

Q.Bir

Q.Bir

URlK

URlK

$!=*3(&?

$!=*3(&?

91%5xu

91%5xu

.sm h

.sm h

j86o.kP

j86o.kP

Bn.mN#

Bn.mN#

64.dZ

64.dZ

z-j.Nne

z-j.Nne

%SLa]z

%SLa]z

.kqCR

.kqCR

.GB_J)

.GB_J)

ZM.nK

ZM.nK

Ô5g5

Ô5g5

%DvZj

%DvZj

D.eT{

D.eT{

M-2}*z

M-2}*z

v=@.DXmD

v=@.DXmD

F%UYJM

F%UYJM

U|.yP?&

U|.yP?&

>/.js

>/.js

%xvMQ

%xvMQ

.EF@WaL{-

.EF@WaL{-

pa[.IKx

pa[.IKx

.vE)"O

.vE)"O

.QEvh@

.QEvh@

!(Z`-Y}

!(Z`-Y}

E?#

E?#

.wSR8

.wSR8

R.Du>?;

R.Du>?;

o%Cqb

o%Cqb

&G.hd

&G.hd

L.STR

L.STR

\AhM%d

\AhM%d

[d%XF

[d%XF

Z.aa)

Z.aa)

N)x%S

N)x%S

5Q.pW

5Q.pW

%4sPS

%4sPS

.HP.Ar

.HP.Ar

%9Xue

%9Xue

XtB:%C

XtB:%C

O.RD[

O.RD[

.XS Qyo

.XS Qyo

%C]RU

%C]RU

~=%co

~=%co

XMb.Fx

XMb.Fx

.OK:KQ

.OK:KQ

.acd*e/J

.acd*e/J

R,:.Yl

R,:.Yl

>Q.df/E

>Q.df/E

B.BtyU

B.BtyU

#.Agq

#.Agq

-hqA}

-hqA}

:).AS

:).AS

Bu.onF/

Bu.onF/

I_%X|

I_%X|

X%X11

X%X11

.mLG?

.mLG?

.dFl.Se

.dFl.Se

=.AC!5

=.AC!5

U'.Ue^

U'.Ue^

3VÞbm

3VÞbm

v%d:LE/#M

v%d:LE/#M

l.tk(

l.tk(

5.LwW

5.LwW

.VPxj

.VPxj

?A=*NB%u

?A=*NB%u

.bXxx

.bXxx

2Vo9

2Vo9

.ZnA0

.ZnA0

q.Puk]

q.Puk]

)@%XG

)@%XG

0r.wx

0r.wx

/g%U2

/g%U2

>br.sL

>br.sL

$)\S%sh

$)\S%sh

.cX

.cX

'/d.Nf(

'/d.Nf(

d.fIt

d.fIt

#kY,%d

#kY,%d

.EU8u

.EU8u

:J%usx

:J%usx

-M}e%p

-M}e%p

_Um%D

_Um%D

g7qX.iX#

g7qX.iX#

n.Mqz

n.Mqz

!g%U|_/

!g%U|_/

$x>&MdzXnQ%3SM

$x>&MdzXnQ%3SM

%fy:

%fy:

Y4%sk

Y4%sk

(yR%x

(yR%x

.xD&.

.xD&.

\.CmH

\.CmH

%6uyU

%6uyU

%fGW)

%fGW)

%xFpo`^]~

%xFpo`^]~

cF|%C

cF|%C

%x0i;

%x0i;

.knD)0bc

.knD)0bc

^Gd.Uh

^Gd.Uh

.P\.Vc

.P\.Vc

8"L%d

8"L%d

o;.Hx

o;.Hx

Û^.

Û^.

u:}%S

u:}%S

.oa1o

.oa1o

.aQO9

.aQO9

.VO5y

.VO5y