MemScan.Application.Bundler.Outbrowse.K_aeb7dc2706 – Adaware

not-a-virus:AdWare.Win32.OutBrowse.ajy (Kaspersky), MemScan:Application.Bundler.Outbrowse.K (AdAware), Trojan.NSIS.StartPage.FD, Trojan.Win32.Swrort.3.FD, TrojanDropperVtimrun.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: aeb7dc27069a3a429ef465c4b493eeb8

SHA1: 9a4c59c75882e718085dd66997c434436cfadcb6

SHA256: 65a5853fd4ebf95a9a560bda012082d4a99ef2ba193d712d366bd6e97cabdc4a

SSDeep: 24576:4y4OQYjmeh0Wfxuakp9aZc21lu1RkjY 1GxobrAY6iGGQ27/l:/4DXJ8ZLlQRkZyobrui

Size: 1467904 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: Premium Installer

Created at: 2013-02-17 09:00:50

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The MemScan creates the following process(es):

wmic.exe:2452
%original file name%.exe:944
Setup__5551_il350168.exe:1356
SETUP.exe:2396
Setup.exe:2372
SETUP_~2.EXE:592

The MemScan injects its code into the following process(es):

ins.exe:2420

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process wmic.exe:2452 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (238 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (0 bytes)

The process %original file name%.exe:944 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Setup.exe (18559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\SETUP_~2.EXE (7168 bytes)

The process Setup__5551_il350168.exe:1356 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\index[1].htm (7617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\amipb[1].js (27951 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe:typelib (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\desktop.ini (67 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (0 bytes)

The process SETUP.exe:2396 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ins.exe (148860 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Convert.dll (3647 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ins.dat (26689 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (0 bytes)

The process Setup.exe:2372 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\SETUP.exe (9321 bytes)

The process ins.exe:2420 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\button_over[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\bottomLine[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\topComp[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\bodyImg[1].png (1748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\dc[1].js (2685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\nextCase[1].jpg (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\topLine[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\bgImg[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\button[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\DynamicOfferScreen[1].htm (1843 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (0 bytes)

The process SETUP_~2.EXE:592 makes changes in the file system.

The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe (3249 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe (0 bytes)

Registry activity

The process wmic.exe:2452 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E AB BC AB 8D 97 BE 18 01 21 07 00 69 5E 6D 10"

The process %original file name%.exe:944 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 54 39 74 8C 73 5C 33 28 A3 33 FD 7E 66 36 1B"

To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

The process Setup__5551_il350168.exe:1356 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCR\mandrel.yodles]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\LocalServer32]
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\Setup__5551_il350168.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0]
"(Default)" = "InstallerLib"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\mandrel.yodles.1\CLSID]
"(Default)" = "{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Setup__5551_il350168\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\Version]
"(Default)" = "1.0"

[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\TypeLib]
"(Default)" = "{69155DE9-A119-4606-BE6A-28B4BEBFA504}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "Setup__5551_il350168.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\ProgID]
"(Default)" = "mandrel.yodles.1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1408604790"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\VersionIndependentProgID]
"(Default)" = "mandrel.yodles"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\Setup__5551_il350168.exe"

[HKCR\mandrel.yodles\CurVer]
"(Default)" = "mandrel.yodles.1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 22 8F 03 2A 49 EC B7 11 FE E1 68 61 21 40 1B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\TypeLib]
"(Default)" = "{69155de9-a119-4606-be6a-28b4bebfa504}"

[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\Setup__5551_il350168.exe"

[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\mandrel.yodles.1]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000"

[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}]
"(Default)" = "IBoot"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Setup__5551_il350168\DEBUG]
"Trace Level"

The process SETUP.exe:2396 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 32 CD 71 BA B5 0A 71 4D F5 AA 96 16 F3 61 5C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process Setup.exe:2372 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Administrative Tools" = "%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Administrative Tools" = ""
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 F9 D4 A0 FA 74 A4 A4 03 37 25 22 02 49 D6 8B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
"Recent" = "%Documents and Settings%\%current user%\Recent"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000]
"setup.exe" = "This program will help you through the installation of your downloaded software"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process ins.exe:2420 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014090720140908\"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 51 EE 23 90 21 92 44 CE 65 7E 9C 39 18 CE 4F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CacheRepair" = "0"
"CachePrefix" = ":2014090720140908:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The MemScan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SETUP_~2.EXE:592 makes changes in the system registry.

The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Administrative Tools" = "%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000]
"Setup__5551_il350168.exe" = "Setup__5551_il350168"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Administrative Tools" = ""
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 96 CF BD D5 54 3D C3 1C 7E 00 19 D1 D3 23 BF"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5	File path
ca23c5b6b9508ca13daec5afb858631a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\SETUP.exe
861ac12605c00bdb57bd92b999329c3d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\SETUP_~2.EXE
d5887a209f45c421bad4204f85ddc72f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\Setup.exe
56de3fe6ad5d12c03eb7b262348acd08	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ins.exe
cd55b7934eaf455340e760b12416f259	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa3.tmp\Convert.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
wmic.exe:2452
%original file name%.exe:944
Setup__5551_il350168.exe:1356
SETUP.exe:2396
Setup.exe:2372
SETUP_~2.EXE:592
Delete the original MemScan file.
Delete or disinfect the following files created/modified by the MemScan:
%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Setup.exe (18559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\SETUP_~2.EXE (7168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\index[1].htm (7617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\amipb[1].js (27951 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe:typelib (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ins.exe (148860 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Convert.dll (3647 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ins.dat (26689 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\SETUP.exe (9321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\button_over[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\bottomLine[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\topComp[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\bodyImg[1].png (1748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\dc[1].js (2685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\nextCase[1].jpg (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\topLine[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\bgImg[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\button[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\DynamicOfferScreen[1].htm (1843 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 10.00.9200.16521
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE .MUI
Internal Name: Wextract
File Version: 10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: HD Player Product Version: 10.00.9200.16521Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE .MUIInternal Name: Wextract File Version: 10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)File Description: Win32 Cabinet Self-Extractor Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	25636	26112	4.3729	30b0e8189e280a7cdb22d1991ab59a9e
.data	32768	7788	1536	4.56584	d67cb441a80679d33fc3bdcfa7cfe3b3
.idata	40960	4284	4608	3.54952	32ebfbff8812f1402a4062b0066c17ed
.rsrc	49152	1433600	1430528	5.52848	87f968ecd7ed325f8fe9e1f062886859
.reloc	1482752	3594	4096	3.00418	730dcb51042a052c358983687569656c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/index.php
hxxp://dyno3mlj15jgv.cloudfront.net/V2/amipb.js
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/finalize.php
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/thankyou.php
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=4360&distid=19710&productid=18873&subpubid=0&campaignid=0&networkid=&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&ds1=&hb=0&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
hxxp://stats.l.doubleclick.net/dc.js
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/topLine.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/topComp.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/bgImg.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/bodyImg.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/bottomLine.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/nextCase.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/button_over.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/button.png
hxxp://cdn1.vitaldownload.com/V2/amipb.js	54.192.55.17
hxxp://stats.g.doubleclick.net/dc.js	74.125.192.156
hxxp://installer.ppdownload.com/Installer/Flow?pubid=4360&distid=19710&productid=18873&subpubid=0&campaignid=0&networkid=&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&ds1=&hb=0&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2	50.19.221.149
hxxp://static.revenyou.com/offers/images/Theme7/nextCase.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme7/button_over.png	198.232.124.224
hxxp://www.idyllicdownload.com/index.php	107.20.210.63
hxxp://static.revenyou.com/offers/images/Theme7/bodyImg.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme7/button.png	198.232.124.224
hxxp://www.idyllicdownload.com/finalize.php	107.20.210.63
hxxp://www.idyllicdownload.com/thankyou.php	107.20.210.63
hxxp://static.revenyou.com/offers/images/Theme7/topComp.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme7/bottomLine.jpg	198.232.124.224
hxxp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&	50.19.221.149
hxxp://static.revenyou.com/offers/images/Theme7/bgImg.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme7/topLine.jpg	198.232.124.224

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /Installer/Flow?pubid=4360&distid=19710&productid=18873&subpubid=0&campaignid=0&networkid=&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&ds1=&hb=0&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.ppdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Sun, 07 Sep 2014 14:41:38 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8522

Connection: keep-alive

..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"8/$.Fmkcsez_oajgRvjdo"8..'.PbaJay 5..% O_fGew1,.3 .&!NenjjoG_j_!6" '.KkmaobpIB.2 % >fv]yqJ^a^p.4/("GnO\brCiqEnqoYge 7 .Ev`MME 7.!("Cs]PKJ/.9."*.;jfk^hcHil`.5. ).NbfcmMME 7.gptn5'*qki(sde \hk&gk`n*cmh'*hdc_qo/Btf\fg`IebepN[m^ck9nbfcma_63#^hotg_5,25.*%he__h8*6512"cmpfokwf^<.60!ktl`fn</2$debnpi7%`f`8(!a`:*!("P\l`.8* .Ab_aobmk[k@ar\.5. ).@jtgqamnqbmQagI`qn.8.. .P_tgpm 7'0("Ca^`\rfpd.: ,$.IplgnpimiJ\mc.4,-, ?an\pbj`jcwMYo^ 7'0("Qg]`i?cndnIlnl\ej.4/("Tdjon_iIebep>ghf_k^Kenc.2..{)u!Loqo=s^ 7.!("Nm]@qc.4!., >ghimk_mpTwk].36).LkngoauZrfimPyn`k.3 -'0)3 '.M^eH_x.: .$.KcdEdu62.2..*.LdlopoF\fc.4!UosOm]^.>]balcmYohp.%.Oat`H\lq.&!Lrm_m^mGA.9.3*.9gp_vmNbfcm.5)*.CrSago>jkGkms]lj.2,% BrdQRJ.2..*.?waUPG*.3 .&!?okhYi]Jfhd.: .$.Hdc_qQRJ.2.arqj9 /vhd)mfb'`lp dfah,`il /ma^`kq,>xjakd[J_dblR_rc`f:hdc_qed;-./.tlcc921!\dlrf^<-95,(!ec^^o9163/..alomprwd\8 4/ rus`dl8,0#^e^=.!`]6..&!Nar`.5&/).@`dgoajg_i>`pa 5., 7/3,-5241.% >hsevgmmn^qO_fGewn.5. ).O]ympl.3 .&!Afd`[obtb.9)1*.HmhklnhknP\l`.8* .Dgn[m^n^hbuR_o].3 .&!Olc`h<_rblHjsr\dg.8-&!Ripom\eMc`dnCmhe\gbIcma"8..x%y.JnotCs].3 .&!Lrc@p`.8.. .CmhhjgcknSupc.2,% JimetguYobmkNxleq.2.) ).QagI`q.3 EEDU_APJM>LQYTOEP.Kj_rt[qa\ZDfnm_ifd`Bpjon^pBrsanqdgilZY,8375.$.KcdEdu62.2.AIBS^?UPM=IM]RMDN Qj^op_o_[XIlnl\ejb^Anoun]m>vq_moimikWU06163"*.J`imonM]mc.2.L_s_O]sq.Fjg P_`ncf.$.Ip

<<< skipped >>>

GET /V2/amipb.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.idyllicdownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn1.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 40585

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:33:35 GMT

x-amz-meta-cb-modifiedtime: Tue, 29 Jul 2014 10:46:22 GMT

Last-Modified: Wed, 30 Jul 2014 08:42:33 GMT

ETag: "d10a2ed9a4a2e81b939e360fc4931c09"

Accept-Ranges: bytes

Server: AmazonS3

Age: 61283

X-Cache: Hit from cloudfront

Via: 1.1 7c92101f5a051b6077d0586c8a74d49e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0booVGIZcRnCi6YE6Y0wLmpxoKeOsxBQjbptWSn98DWOyCSuIo-yLw==

//<!-- ../* Progress bar */..var g_AmiPbs = new Array();..function LogMessage(message)..{.. try.. {.. g_ami.Log(message);.. }.. catch (excpt) { }..}..function AmiPbDelayedCheck(id) {.. var that = g_AmiPbs[id];.. if (that && that.periodicCheck) that.periodicCheck();..}..function InitPb() {.. .. LogMessage('InitPb function started');.. .. Show('header-close', 'none');.. var progress1 = new AmiPb("download_progress_host", 400, 20);.. var progress2 = new AmiPb("install_progress_host", 400, 20);.. progress1.start(function () {.. var p = g_ami.DownloadProgress;.. this.setValues(p, p);.. if (g_ami.DownloadCompleted) {.. LogMessage('InitPb g_ami.DownloadCompleted is True');.. g_ami.ReleasePostponedInstallations();.. for (var j = 0; j < g_comps.length; j ).. if ((g_comps[j].id == 0 && g_comps[j].sel == 0) || g_comps[j].id == 0x7fffffff) {.. g_ami.AddThanksParameter('c[' g_comps[j].sn '][s]', g_comps[j].pir ? '-2' : '-1');.. if (g_testa && !ArrayContains(g_notest, g_comps[j].sn) && !ArrayContains(g_notest1, g_comps[j].sn)) {.. if (g_testa.constructor != Array || ArrayContains(g_testa, g_comps[j].sn)).. g_ami.WriteProfileString(g_testf, '', g_comps[j].sn, g_comps[j].pir ? 'R' : 'S');.. }.. }.. this.stop();.. }.. }, 20);.. progress2.start(function ()

<<< skipped >>>

POST /thankyou.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.idyllicdownload.com

Content-Length: 1006

Connection: Keep-Alive

_srvlog=&c[AdvancedSysCare][r]=5&c[AdvancedSysCare][s]=-31&c[AmigoIM][r]=6&c[AmigoIM][s]=-31&c[DownloadManager][r]=0&c[DownloadManager][s]=-31&c[ElectroRevizer1][s]=-31&c[ElectroRevizer2][s]=-31&c[MariMediaRevize][s]=-31&c[NationZoom][r]=1&c[NationZoom][s]=-31&c[NetFilter][r]=0.01&c[NetFilter][s]=-31&c[PlusHDrow][r]=3&c[PlusHDrow][s]=-31&c[Yontoo1][s]=-31&c[Yontoo3][s]=-31&c[Yontoo5][s]=-31&c[Yontoo6][s]=-31&c[Yontoo7][s]=-31&c[updater][r]=0.01&c[updater][s]=-31&capp=DownloadManager&cc=UA&cid=5551&clip=193.138.244.231&cmdl=Setup__5551_il350168.exe /S /NCRC&cnt=87fc35be4bb81198d9fd59a8fe3438b0&is=-31&netfs=-31&sysid=D6A6947B24975DB6AB9DE8B171C5FA6E&sysid1=D6A6947B24975DB6AB9DE8B171C5FA6E&te=1410100915&thankyoupage=http://VVV.installpath.com/thank-you.html?subid=5551&tid=&ts=1410100904&ver=1.1.6.20&vert=3

HTTP/1.1 200 OK

Content-Type: text/plain; charset=UTF-8

Date: Sun, 07 Sep 2014 14:41:37 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 14

Connection: keep-alive

.... ..HTTP/1.1 200 OK..Content-Type: text/plain; charset=UTF-8..Date: Sun, 07 Sep 2014 14:41:37 GMT..Server: Apache/2.2.15 (Red Hat)..X-Powered-By: PHP/5.3.3..Content-Length: 14..Connection: keep-alive...... ....

GET /offers/images/Theme7/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/jpeg

Content-Length: 1785

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Tue, 12 Mar 2013 18:05:10 GMT

ETag: "0fac224c1fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes

......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................2.N.............\.................................................................R..T.................................?.....mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2................................................................................................................ ................................................................................................................... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD.(......P..@(......P..@(......P..@(......P..@(......P..@(......P..@(......

<<< skipped >>>

GET /offers/images/Theme7/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/jpeg

Content-Length: 2801

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Tue, 12 Mar 2013 18:05:10 GMT

ETag: "0fac224c1fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes

......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................,.N.............Q...........................................................................................?..H........ ... .U..@E.....@@............( .PE..E...@P...............................%.A..D...@.@@...."......"..%.P...@..E.@................- ..... ........@..D...@.@@....".......(...(......". ................FZ....P...QA...@..D...@.@@.....P.@.P@........E...........................(. ... ........... ..... .. .( ...."..."... (... ..............Q......@.T.@.P...P...............A......@.......D..................j2..........%P...P.......... .. .. ."..%Q...P..D..@...................- .. .... .E............( ..............@..E..A.....@...............j2.(.......P....@.A......... . . .."..%.P...@..E.@...................i................... .....(. .( ........".........................4.i.........A.@.A......@....@.P@........E............................H ... .(...(...................... ...............................e@.EA..@...@.@.....J.............. . .............................I..E.@........ ........@P.@T...A...(.....".. ......................4.i...J(. .(...(........A@A.AA.E..J....".. ..... ....................E........@.A......... . . ..".. ".......(.........................4YP.E..E...E........A@A.AA.@..@.@.......@.........................,........ ..... ..........( .(. .(..".............................U..A....

<<< skipped >>>

GET /offers/images/Theme7/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/jpeg

Content-Length: 1654

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Wed, 13 Mar 2013 13:08:16 GMT

ETag: "35420d3eb1fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes

......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................2.N.............[..............................................................Q.....T................................?..?/.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...\................................................................................................................@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..j.N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N...................................................................................................................................................

<<< skipped >>>

GET /offers/images/Theme7/button_over.png HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/png

Content-Length: 1274

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 22 Oct 2012 15:36:02 GMT

ETag: "0dd0f16ab0cd1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR...|..."........9....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[Kl.E..gw............J.Q...p..\..Rz...!A#.KE..=...J.....6.B....\@....*.m.Kh.H.4..{c......8vHD9.f...>...x....1.Y...A`h\.z |O....N.c.&../!w C...<3s]......<..v.`.|O.;l.....B...o.t!].6.8|`..M.df...e...e((.$2Q...tx/.>~W..}.e..a..lF=N......OxHJ. .c..3PR.(:..^.q<8mn.......ZVaA..MW...#(|i........t.....]C#}..BB....M(*9f.....Fb........q.>.......G*.....$.?..m$.....e.<.y.....z...)a.W0-..n..(.........g[ ..,...}......L.*.r..~...o..wU.A..wN.......N<.rQ...)O...ra...[.b....c.........._-.1.S.....:1|k...@u...!..y................}.v..i\tiP.chx..a...<p.y..N.<|..tAVN1...h}.6.6.7.].....;y..5\..}...N#6/..v.0.W..R.W.9..j...2...%..V..i..1..n......Ws6my..-.......p.....4.....X....3..@pN..t..v.....Bz.x8 .....K1B.-....%..z..[..a@Y7.....]F....;.f5h..j........\..r..`.ef!.A).....u.........}....`.n5d.....LQg...8.J..../.v'{..R.-k.N.......]9...s...s.......<...d!,....O...lD....z...w.>|..........`...b..L~?.....9.....Z...?_..>...h{|gY7... .v..!a.&......%.9...C.SgG.....&.".....C..>..2.....Z.nf..BN*..p..?.#.g.?.2.DUp..''fv.......lz......O.....B......<L..D.E.q....ALHp.l..j.v.y....[E............M.`.6....;8.~..f..u......)....^.\."...7..9..W.t)F_'Uks.....~...0...d7r.I.wZ..".f...N.9R.z.....@7[.N.G.......u]......IEND.B`...

<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0& HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xml.the-app-info.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Sun, 07 Sep 2014 14:41:35 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 11168

Connection: keep-alive

<html>. <head>. <title>5 - NonProduct (Setup Launcher)</title><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]);.. _gaq.push(['_trackPageview']);.. (function() {.. var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.. ga.src = ('https:' == document.location.protocol ? 'hXXps://' : 'hXXp://') 'stats.g.doubleclick.net/dc.js';.. var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.. })();</script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px; } .divLeadpName { margin-left:61px; margin-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; } .divOnNext { position:absolute; bottom:11px; right:28px; width:124px; height:35px; cursor:pointer; background:url("hXXp://static.revenyou.com/offers/images/Theme7/button.png");}

<<< skipped >>>

POST /index.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.idyllicdownload.com

Content-Length: 275

Connection: Keep-Alive

Cache-Control: no-cache

Net1.1=&Net2=3.5.21022.08&Net4=4.0.30319&OSversion=NT5.1SP3&Slv=&Sysid=D6A6947B24975DB6AB9DE8B171C5FA6E&Sysid1=D6A6947B24975DB6AB9DE8B171C5FA6E&X64=N&admin=Y&browser=IEXPLORE.EXE&chver=&exe=Setup__5551_il350168&ffver=&lang_DfltUser=0409&netfs=3&s=Y&ts=1410100904&ver=1.1.6.20

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sun, 07 Sep 2014 14:41:26 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive

1b79.... ..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">..<html>..<head>..<meta http-equiv="content-type" content="text/html; charset=UTF-8" /> ..<title>%appname% Installation</title>..<base href="hXXp://VVV.idyllicdownload.com:80/index.php" />..<script type="text/javascript" src="hXXp://cdn1.vitaldownload.com/V2/amipb.js"></script>..<script type="text/javascript">..var g_amiobj = '', g_ami, g_updb = false;..var g_eula = ''; ..var g_post1 = '_hdn=1&_ver=1.1.6.20&_p=1&_s=10&_cc=UA&_cid=5551&_psb=0&_cnt=ff5c2d87d1f88a8168429e3755eec003&_instid=&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=-31&_vert=3';..var g_icon = '';..var g_comps = [], g_pages = [], c, g_curPage = -1;..var g_cid = '5551';..var g_tid = '';..var g_cc = 'UA';..var g_lang = 'en';..var g_ip = '193.138.244.231';..var g_browser = 'ie';..var g_cnt = '87fc35be4bb81198d9fd59a8fe3438b0';..var g_ver = '1.1.6.20';..var g_buttonImage = 1;..var g_thanks = 'thankyou.php';..var g_images = [];..var g_purl = 'hXXp://VVV.idyllicdownload.com:80/pix.php';..var g_skipCats = 4096;..var g_ieVer = '6.0';..var g_chVer = '';..var g_ffVer = '';..var g_netfs = -31;..var g_vert = 3;..function InitInstall()..{.. g_ami.AddThanksParameter('tid', g_tid);.. g_ami.AddThanksParameter('cid', g_cid);.. g_ami.AddThanksParameter('cc', g_cc);.. g_ami.AddThanksParameter('cnt', g_cnt);.. g_ami.AddThanksParameter('ver', g_ver); .. g_ami.AddThanksParameter('vert', g_vert);.. g_ami.Ad

<<< skipped >>>

POST /finalize.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.idyllicdownload.com/index.php

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.idyllicdownload.com

Content-Length: 595

Connection: Keep-Alive

Cache-Control: no-cache

_hdn=1&_ver=1.1.6.20&_p=1&_s=10&_cc=UA&_cid=5551&_psb=0&_cnt=ff5c2d87d1f88a8168429e3755eec003&_instid=&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=-31&_vert=3&r_DownloadManager=0&r_updater=0.01&r_NetFilter=0.01&r_Yontoo1=1&r_Yontoo3=3&r_Yontoo5=1&r_Yontoo6=1&r_Yontoo7=1&r_NationZoom=1&r_ElectroRevizer1=900&r_ElectroRevizer2=900&r_MariMediaRevize=900&r_PlusHDrow=3&r_AdvancedSysCare=5&r_AmigoIM=6&DownloadManager=3&updater=2&NetFilter=2&Yontoo1=1&Yontoo3=0&Yontoo5=0&Yontoo6=0&Yontoo7=0&NationZoom=1&ElectroRevizer1=0&ElectroRevizer2=0&MariMediaRevize=0&PlusHDrow=1&AdvancedSysCare=1&AmigoIM=1

HTTP/1.1 200 OK

Content-Type: text/xml

Date: Sun, 07 Sep 2014 14:41:27 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive

1b89....<Array><page><f>1</f><fb>1</fb><pt>0</pt><cats>0</cats><updh>1</updh><wrn></wrn><comps>DownloadManager</comps><bdy>DQoNCgk8ZGl2IHN0eWxlPSJ3aWR0aDogMTAwJTsgaGVpZ2h0OiA4NXB4OyBib3JkZXItYm90dG9tLXdpZHRoOiAxcHg7IGJvcmRlci1ib3R0b20tc3R5bGU6IHNvbGlkOyBib3JkZXItYm90dG9tLWNvbG9yOiByZ2IoMTcwLCAxNzAsIDE3MCk7IG1hcmdpbi10b3A6IDBweCI DQoJICZuYnNwOyZuYnNwOw0KCTxwIHN0eWxlPSJwYWRkaW5nOiA1cHg7IHRleHQtYWxpZ246IGxlZnQ7IGZvbnQtc2l6ZTogMTdweCI DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxN3B4OyB0ZXh0LWFsaWduOiBsZWZ0Ij5Eb3dubG9hZCAmYW1wOyBJbnN0YWxsIDxiPiVhcHBuYW1lJTwvYj4gZm9yIEZSRUU8L3NwYW4 DQogIDwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iZF9hbWlfRG93bmxvYWRNYW5hZ2VyIiBzdHlsZT0iaGVpZ2h0OiAxMzBweCI IA0KPGJyIC8 DQo8cCBzdHlsZT0iZm9udC1zaXplOiAxM3B4OyB0ZXh0LWFsaWduOiBjZW50ZXI7IHBhZGRpbmc6IDBweCI PGI Q2xpY2sgTmV4dCBvciBJbnN0YWxsIGJlbG93IHRvIGJlZ2luIHlvdXIgaW5zdGFsbGF0aW9uLjwvYj48L3A DQoJPGRpdiBkYXRhLWFkanVzdC1oZWlnaHQ9IjAiIGlkPSJtaWRkbGUiIHN0eWxlPSJ3aWR0aDogMTAwJTsgcGFkZGluZzogMHB4OyBoZWlnaHQ6IDExMHB4OyBtYXJnaW4tdG9wOiAwcHgiPg0KCQ0KCQk8dGV4dGFyZWEgc3BlbGxjaGVjaz0iZmFsc2UiIGNsYXNzPSJ0ZXh0YXJlYTEiIGlkPSJhbWlfZXVsYV9Eb3dubG9hZE1hbmFnZXIiIHJlYWRvbmx5PSJyZWFkb25seSI CQkNCgkJPC90ZXh0YXJlYT4NCg0KCTwvZGl2Pg0KCTwvZGl2Pg0KDQoJPGlucHV0IGlkPSJpX2FtaV9Eb3dubG9hZE1hbmFnZXIiIHR5cGU9ImhpZGRlbiIgdmFsdWU9IjEiIC8 DQoNCgk8ZGl2IGlkPSJwaG9sZGVyc0Rvd25sb2FkTWFuYWdlciIgc3R5bGU9InBhZGRpbmctbGVmdDogMTBweCI DQoNCgkJPGRpdiBjbGFzcz0iYW1pLWV4cHJlc3MtY3VzdG9tIiBzdHlsZT0id2lkdGg6IDE

<<< skipped >>>

GET /offers/images/Theme7/topComp.png HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/png

Content-Length: 1684

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Tue, 12 Mar 2013 18:06:58 GMT

ETag: "08db634c1fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR...*...0.....g.......tEXtSoftware.Adobe ImageReadyq.e<...6IDATx..Y{LSW....mK_.....,.....%..q.....23...9..1....p.7..h.3c>..2g.5f3Q.=..8.M.5....V..[.S...}_[..-m!n....s.wO..........OB...i1.1...........`.=8"../..]c....4..=.o=n..^.....d4X.w.AAvF...R......a..-...J...od......#\.~{.....Y.\.\7.&.@vf.s.!m..D.S...VSKOE..C....k.."PmXg.{uJ.....i..B..%......P.........5^*C.i7/.)..p...<.....=........[.P.x.j[9..h.:E.]wg,..$U}(.....B.p..D.3q....u. ..T......_.....w =3.=.#..`b8fB3.<`D)~...Z...3......!:U....&..L.NZ.......5...`en{.y..8VD.......v.v.Y....?[;?*....S.7.....u.......P4-....k...x.....A6#.|......%E...............h..8r........R.g..:.WV.;..d..V....n...h.*.}....!t.A.1....o.N.^..SC..#h4..@0.h.F\p#.p..k...9..).:m).J;.z...#a6z.R........01/'..J...1.0....S....\..nJ..a.....q\.....d....W2......B....."T|..q..>.p...9E|....AF.!..(o@..d....V ......?]lD..H.E....2.g.$P..*&.]..l.z.&....`O..Y.[W8......T.92\!..8..4.*.dN.......d20..E.8....:..u...2.....-.W.O..0...W...s....\[^...5.aw5.....es.f.`...P....j..P}........P..A8 ...1g.uw...;P..}..f.FTw../~..n.e.7Wl..U)u.6.....N..B..4\5...V.w..M.6......k..E.h<>...........uU....w..><F.O.k...... >^...d2.D.6J...j]{F..K..6....J3.................N..s........r.]T`...k.Q.*.2/9A.G.....{G..B....X.8.f.jil.>..O....#...U.5...==.`w.=..A.....;,..bH.R9..*X4.5.auEr.....=1a.G...M.J*6..=,..p2.y.....p..M.mh........,......@........7.:.......U....D..M .JBL&..."....J....0(@...a.&...a..........._....X.F..0..!....9...Y}.}.6..P(.......&.`....`......9|4@...Y..xd.nP..fKEb..Q.&....L.

<<< skipped >>>

GET /offers/images/Theme7/bodyImg.png HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/png

Content-Length: 14789

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Tue, 12 Mar 2013 18:09:36 GMT

ETag: "07038c14c1fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR................s....tEXtSoftware.Adobe ImageReadyq.e<..9gIDATx.....U...7OQ..F.!py........qEY..1.....&...t.Q...5.Q{%i.a.^.JVz4.q........U .Q.#..y....1....7w.......U{..g.....U..{....G............x...6....^.x .x............../.H/^.x .x.@z..%g..oA...5k.M...../.H/^<.^.x.@z.........../.H/^jQ.8...2A....Te.*g..S.....UY.....<.^...x.*.W.2UF.l.U.7..d......Sx...@....Z.?SeR...TyZ.g"H.x .....M....^..s..~U..g.....q.......7.]..R..u.. pn.H/..HQ...............g?..8..`..I..!C...g>..Bu..<..H.dq..i.....`.y....Y......={....T...:.=.H/..b....!U...mmm.3.<....{..'..\y.....`......<.^<..........?v.X.)q.=z..>..O.W]uUp.9...G.......{ .x ...C$?Re....o~........@.2eJh...0@...*_ ..YO@.H./.....!/. .>..O.s.........n...'?.I.~.z...U. ..........P.R.V...U9:z..`..yA.~.B(w...<...... ...K.!..>..|@...H/^.......Re...........zj...j.....^.>.....]....r.......\.^.Te.Yg..|.K_.N9..PS.l..5../~.l..E....7..N.../9C.K.r.*...z.u...!..(.~.a.r.....Y..?2a.....K.P..A...<_...J....}..._.=x....n.TyHA......K.P.....0_1...w...<r.H.._.:x..7.].%..H.....Z......rh......^Z........4@9....@z.%(....x?q..`.......p.t..W..Uy....@z.5(1..."..._...6...DY.vm.H..5.....K-..TY../...R...D<,...D....H/^.....q.*.0.2s...v..<|.p...o.3G4.c.%......|.D....~..Q...c...x.w..0....4. ..M.H/^...9x..../.04]u(......7o..XM.UP^....%_A ...N:)8..............s......H/^..........z......d. ..&...}.../..2...x...~....dZ...&...C.....%?-yT....H...:./..}......U.....%?(._.%..0a../..;v....<...?.....K....s..g......".... x...M.^...../9iI...1sH.a2[.~.....C.l.

<<< skipped >>>

GET /offers/images/Theme7/nextCase.jpg HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/jpeg

Content-Length: 798

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Wed, 13 Mar 2013 12:09:45 GMT

ETag: "c8d90a6e31fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes

GET /offers/images/Theme7/button.png HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/png

Content-Length: 1256

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 22 Oct 2012 15:36:14 GMT

ETag: "0eb27f86ab0cd1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR...|..."........9....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[_h[U....776M..[..-.u6...!.N.E.......V6A..^...=....^..S....Cp8..Nl..Z..-..g.L...m...&M.=.^...............{/y.~...{.9:..p...l....'./8...."N.G.@...."7sU.@. ....'z.....\"n8s...B....0..<....X...E,...f...-...$..R..9....(...E...._^.......u8...V....%.5zaA..T:.EC..\..\.j.@.....~p.^P2......f....(..]..1.zeq..H ..6ul..t=.Y#....(r.[.F.....P..c........Q....m.K...........t<.8.,^.EK./...5..(P#..P...f......).o..Lp.T..z...[[.{..:..z.....`...].P...@Q...>...z...K!.p......,.B..m.A..1..........|...9.c..............."..Ro.i.0..XD..-A.j.<...b..d....=.\..b.t.qK9.E.... H..pz.......rZ..5.c@.S...[... .FI...(`.....p...$.(....1.....!......(8.(#.Ig..-8......>..,.v.6...........L.L.../x.Hc#/..........9.../{5{..=|...C.J...h[a.n.b...-[A......{.3aYX.QK_.x.P..-....Ws.Xm....i_......f3...<...5..0y..GOf....:...u..3..klZ>.q.P(|#HKoV8..................<...-......[.Vr.w.)......f....e.S...k...Ax.?Hv...-..b..0..$.......l.Z....g.i<.9X.p.d..(r.k.2g..J.. ./!o#i.C...#...'.#.g.>...l..........J.w|8...8;...}..../n~..T.!7o_c..|.....9o...<..._.|;hqV Y7.6XX.....0.C.4.mV..!o.t.$$.?.......1...$.........<].s.|A9.}.........._Jb.\.2..q.|..Z1..Q..9..I.=..wO..s/......d'.......Pd..BN!..^.c.-...W........./I....IEND.B`...

<<< skipped >>>

GET /dc.js HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stats.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 13:38:22 GMT

Expires: Sun, 07 Sep 2014 15:38:22 GMT

Last-Modified: Wed, 27 Aug 2014 18:16:28 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15801

Cache-Control: public, max-age=7200

Age: 3800

Alternate-Protocol: 80:quic

...........}kW....w~.....;.$..&.Y@i....Z...].,CJp..pi......d.I.~.k...X...2..f.n<ND..&........2..H~.x.;......,..A...~~...2.....p............./..A$...M!....,.~.2..."..~%.p..e..'.....a..8.`8L.v.Aq....aC._.\\8l...0..5FH%...@^Ay.;..sUI....b...&p..I...s...N6....C.,.......s...~..`(.....<.b...t...p..;@\.2.. .G..=..b.3...X............3...@........~.....S.....P.`.8......aw...~...[>.C......X..".........b.p.0....c.7}h1..n....../.....2.....W........C.BH@..FK....y. M.Yl..!..R.i.Z.eo./>1.bR.............al...b.....b.........}1L..c...;........^.....T....xp..L...B..e..Tn?vk\.<...x..mU.g.{.=..;X4.^............M.."..mo.i.h0.j....w.V..t8N"w...t..........hx.zv.1.d.x.......b.z.'......[..v.R.......}w.YQ1..>........!.0.u..]x.:^.......{.$.eL...o.m>.&r...R.8)KF........1."....h....a?.e"..,....Z...y.sqA.........CTo...........n...1....W..v9r...:E.E..{....B............_..o....g...j..f..`...(...Q.....j.......w@.....^;.G<..;..>..L....[...fx....o...K...s..!......M...w0J.arkl.............._.3..T......N. ....I.....|..*...}.Zi.....Np^IP4`n*...Q..O.%4T ...;.....%J.........xKK.&..^I../{............8..83[X......p...c...3j%.....Z.....m"tf.Gm. .ZY.Y....T.._.lH.......A=1..N.....;..R ..{...(.RS..^...)...8em.e.EU...,...."I.L..C.....R......%...<$................L.,..^.R...l...[...n2.....6.v.Q..=....v.#.0.......g.5..z]__.a.j...fJh.....r.6a.6v3..!.}^0...,...I.w................Q..q ..c;2.p2 .%..;0..14....f....c.*Z..*..>..[v].....H...N...kVT.]....I ...._..........^]..e..]..wd.N.....9..u5.bZ`.*...i.`..V..l.{.*{..(.,2.nv. .......

<<< skipped >>>

Map

The MemScan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_944:

.text

`.data

.idata

@.rsrc

@.reloc

Invalid parameter passed to C runtime function.

advapi32.dll

setupx.dll

setupapi.dll

advpack.dll

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

ADMQCMD

USRQCMD

FINISHMSG

IXPd.TMP

msdownld.tmp

TMP4351$.TMP

wextract.pdb

PSSSSSSh

PSSShX

PSShX

SShtL@

zcÃ

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

Command.com /c %s

rundll32.exe %s,InstallHinfSection %s 128 %s

SHELL32.DLL

Software\Microsoft\Windows\CurrentVersion\RunOnce

%s /D:%s

PendingFileRenameOperations

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

RegCreateKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegCloseKey

ADVAPI32.dll

GetWindowsDirectoryA

KERNEL32.dll

GDI32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

_amsg_exit

_acmdln

msvcrt.dll

COMCTL32.dll

Cabinet.dll

VERSION.dll

)%u]Q

Bp.Dx

gA`0)%UJ

SETUP_~2.EXE

Setup.exe

lW.Wi

%XTIxs

Bu.oU

=G.oV

^}0

){%%d

FtPq

:..ut

#.Ff$

{3I%s

-ky}Z

NrK%u

0w@%x

.rmf6w.

s%FZ]

.gl,K

VH;%F

N*sB.Jy

)F.Vd

4.ii.EfCKU

%SK85

ZZ-5}r

=eXEo

oh.bwR

A%CG`

2(^.EZ

Wl.Fz

&,[t|.RF4

:.cm=

'6.lp

DQ".MO

.YO{{

G.qGr

U.DY4

Q.NJe

.AJ(0A&U

.Nnee

%uE/rm

h}%CR

]:.fC'4

E.MxmO

.Yp]i

@%Dvr

.BWe@w

Gn .nHW;m

Y:\t4

.sp?!

7]%C,

s#O.mhO

.FZJ{

/.khh

b.IY,

|.drJ

e.TH]

.NK$Sb

.Wtp(0

.vY8!

W;;.eI6pa

*y%S)>

%SKebEs

,%%s]xcP

#H#Lx.ik

R.W%Xe

8.IAIS

U.NIg

E%uO~1%Sut]
3'%x%F
;s.UZ
JZ_-O}~
12%XN
j.tGz
%%fg)
xre.nRf
q&(I}.gvcBJk
.cR,tI
%C'AN
f.jB>
P ;%D
l.WlJ
-zs94%c
AO#-E}
%6 -@^//
u_.RI
g%Xof
B.Hx|
CRT4F
\.vu$M
.TsB$
^.yT1
.FCXI~
Y]K^&E.oeK
.bp '
x%U,5
q.zvN28F
nP%fM
y]v%F
GQ\.Ty
%xYcn
%5uoQ
C(.SiA
YZs%F
D!$%c
dsshM
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
5&5,52585
Kernel32.dll
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
CFailed to get disk space information from: %s.
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
8Unable to retrieve operating system version information.!Memory allocation request failed.
Filetable full.ÃŠn not change to destination folder.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Could not create folder '%s'
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
Error retrieving Windows folder
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
/C: -- Override Install Command defined by author.
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
Could not find the file: %s.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
WEXTRACT.EXE .MUI
Windows
10.00.9200.16521
Setup.exe_2372:!Require Windows
.text
`.rdata
@.data
.rsrc
v%f=a
"%s".
Could not overwrite file "%s".
Could not create file "%s".
0xX.
7-Zip: Internal error, code 0xX.
7-Zip: Internal error, code %u.
7-Zip: Unsupported method.
Error during execution "%s".
"setup.exe"
Could not find "setup.exe".
Could not find command for "%s".
Could not delete file or folder "%s".
Could not create folder "%s".
Error in line %d of configuration data:
Could not open archive file "%s".
1.4.0-i386 alpha
1.4.0-i386 alpha build 1501 (September 7, 2009)
Supported methods and filters:
:Language:%u!
Sorry, this program requires Microsoft Windows 2000 or later.
KERNEL32.dll
GetKeyState
USER32.dll
GDI32.dll
ShellExecuteW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
msvcrt.dll
_acmdln
version="1.4.0.1501"
7ZSfxx.cmd
7zSfxFolderd
setup.exe
7ZipSfx.x
@ (%u%s)
3.4.5.6
SETUP.exe_2396:.text
`.rdata
@.data
.ndata
.rsrc
uDSSh
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
KERNEL32.dll
ExitWindowsEx
USER32.dll
GDI32.dll
SHFileOperationA
ShellExecuteA
SHELL32.dll
RegEnumKeyA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
ADVAPI32.dll
COMCTL32.dll
ole32.dll
VERSION.dll
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
... %d%%
~nsu.tmp
%u.%u%s%s
RegDeleteKeyExA
%s=%s
*?|/":
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp/ins.exe /PID=4360 /SUBPID=0 /DISTID=19710 /VM=2 /NETWORDK=1 /CID=0 /PRODUCT_ID=18873 /RETURNING_USER_DAYS=2 /SERVER_URL=hXXp://installer.ppdownload.com
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\Convert.dll
operator
GetProcessWindowStation
portuguese-brazilian
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
GetCPInfo
GetProcessHeap
Convert.dll
zcÃ
=*>0>4>8>
1*2024282>&>,>5>^>
3 3$3(3,30383
.mTl6F
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp/ins.dat
Tempins.dat
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\SETUP.exe" /S /NCRC
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000
SETUP.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\SETUP.exe
aller.ppdow
/PID=4360 /SUBPID=0 /DISTID=19710 /VM=2 /NETWORDK=1 /CID=0 /PRODUCT_ID=18873 /RETURNING_USER_DAYS=2 /SERVER_URL=hXXp://installer.ppdownload.com
Nullsoft Install System v2.46
WUSER32.DLL
1.0.0.1
convert.dll
1.0.0.2
KERNEL32.DLL
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
ins.exe_2420:.text
`.rdata
@.data
.rsrc
@.reloc
spKey
szKey
keyCur
hKey
cSubKeys
cmdline
urlStr
wurl
bstrLicKey
cchLicKey
nMsg
vurl
bstrURLOut
rtExecmd
rtExeurl
reportURL
zErrMsg
compiledSql
sqliteCookieFiles
htmlDecodedUrlValue
endParamKeys
dynamicProductKeys
wUrlQS
wUrl
sqliteHistoryFiles
readDownloadUrl
.hL3Q
searchUrl
finishUrlForOuterInstaller
reportUrl
httpResponse
fullCmd
subkey
hostBrwCmd
tyUrl
baseKeys
cmdLineW
cmdW
exeUrlW
urlW
cmdLine
exeUrl
cbMaxSubKey
achKey
offersMainUrl
antivirusesRegKeys64Arr
antivirusesRegKeys32Arr
reg64Key
postExe
preExe
regKey
offerUrl
regKey64
cbSubKeys
zMsg
nCellKey
nMaxKey
nMinKey
nKey
zErrmsg
keyInfo
errMsg
t.hx3S
osCmd
finalExePath
urlComp
szURLPath
xSSSh
FTPjKS
FtPj;S
C.PjRV
RegDeleteKeyExW
RegDeleteKeyTransactedW
RegCreateKeyTransactedW
RegOpenKeyTransactedW
.vector too long

X:X:X:X:X:X

\Google\Chrome\Application\chrome.exe

%d/%d/%d %d:%d:%d

3.7.16.2

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

\ob1hhelper.txt

Error %u in WinHttpQueryDataAvailable.

Error %u in WinHttpReadData.

Error %d has occurred.

F%D,3

Run-Time Check Failure #%d - %s

%s%s%s%s

%s%s%p%s%ld%s%d%s

Visual C   CRT: Not enough memory to complete call to strerror.

RegCloseKey

RegOpenKeyExW

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

operator

GetProcessWindowStation

WinHttpCloseHandle

WinHttpReadData

WinHttpQueryDataAvailable

WinHttpReceiveResponse

WinHttpSendRequest

WinHttpOpenRequest

WinHttpConnect

WinHttpCrackUrl

WinHttpSetTimeouts

WinHttpOpen

WinHttpQueryHeaders

WINHTTP.dll

PSAPI.DLL

GetProcessHeap

KERNEL32.dll

EnumChildWindows

CreateDialogIndirectParamW

USER32.dll

GDI32.dll

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegQueryInfoKeyW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

OLEAUT32.dll

URLDownloadToFileW

urlmon.dll

IPHLPAPI.DLL

GetCPInfo

.?AV?$CAtlExeModuleT@VCSmartInstallerModule@@@ATL@@

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

RowKey

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s-shm

%s\etilqs_

%s\%s

Recovered %d frames from WAL file %s

cannot limit WAL size: %s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

keyinfo(%d

%s(%d)

%s-mjXXXXXX9XXz

MJ delete: %s

MJ collide: %s

-mjX9X

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_parent

%s OR name=%Q

type='trigger' AND (%s)

sqlite_

table %s may not be altered

there is already another table or index with this name: %s

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_stat1

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

sqlite_detach

sqlite_attach

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

unable to identify the object to be reindexed

no such collation sequence: %s

table %s may not be modified

cannot modify %s because it is a view

sqlite_version

sqlite_source_id

sqlite_log

sqlite_compileoption_used

sqlite_compileoption_get

foreign key mismatch - "%w" referencing "%w"

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

constraint %s failed

PRIMARY KEY must be unique

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_keys

foreign_key_list

foreign_key_check

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s.%s

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

too many references to "%s": max 65535

%s.%s.%s

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s TABLE %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid>? AND rowid)

%s (rowid>?)

%s (rowid)

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

SQL logic error or missing database

unknown operation

large file support is disabled

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

.?AVCWebPage@@

zcÃ

{A0386B19-B7E7-4BE7-B567-ABF77CBB6E60} = s `ATLExeServer'

`ATLExeServer.EXE'

val AppID = s {A0386B19-B7E7-4BE7-B567-ABF77CBB6E60}

ForceRemove {FA20B59B-21AA-44FC-8A68-450979B7CC90} = s 'CBrowserExternals Class'

val ServerExecutable = s '%MODULE_RAW%'

TypeLib = s '{03771AEF-400D-4A13-B712-25878EC4A3F5}'

ForceRemove {622D38AD-B4A9-4170-8192-5B865C6A5DCE} = s 'CBrowserExternalImp Class'

ForceRemove {6D4506CE-F855-4657-AA38-DB6B1F733982} = s 'CBrowserExternal Class'

stdole2.tlbWWW

~cmdWd

OpenUrlW

urlWd

method OpenUrl

Created by MIDL version 7.00.0555 at Thu Mar 13 16:11:05 2014

Red

Green

Blue

3%3u3

=0>4>8>

9%9 9;9]9

6i6C6t9

2 2$2(2,202

?-?3?^?{?

5o6^6|6

405458512
1)4 6$6(6,6
4>}>
8Â8b8|8
: :$:(:,:
0,080@0\0|0
3$3,383\3|3
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
WAdvapi32.dll
SERVER_URL
EXE_URL
EXE_CMDLINE
THANKYOU_URL
exeurl
execmdline
Exception opening/reading chrome cookies
Exception opening/reading opera cookies
a\Microsoft\Windows\Cookies
a\Mozilla\Firefox\Profiles
\Mozilla\Firefox\Profiles
sqlite
cookies.sqlite
Chrome_WidgetWin_1
a\Opera\Opera\
\..\Local\Google\Chrome\User Data\Default\
\..\Local Settings\Application Data\Google\Chrome\User Data\Default\
cookies4.dat
SELECT value,last_access_utc FROM cookies WHERE host_key LIKE '%
Found cookie in Chrome!
\..\..\Local Settings\Application Data\Opera\Opera\
Found cookie in Opera!
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
OLEACC.DLL
places.sqlite
SELECT url FROM moz_places WHERE url LIKE '%
Found history in Chrome!
SELECT urls.url FROM urls WHERE urls.url LIKE '%
\PreExe_ID_
\default.html
CHROMEVERSION
&chromev=
SOFTWARE\Microsoft\.NETFramework\policy
firefox
chrome
opera
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice
ChromeHTML
FirefoxHTML
IE.AssocFile.HTM
Opera.HTML
http\shell\open\command
Opera.exe
Safari.exe
\PostCheck.exe
SOFTWARE\Mozilla\Mozilla FireFox
Software\Mozilla\Mozilla FireFox
SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
aSoftware\Mozilla\Mozilla Firefox
*.txt
@@exeurl
OfferURL
ExeURL
RegKey
ReportName
PreExe
PostExe
RegKey64
AntivirusesRegKeys
RegKey32
Mscoree.dll
OLEAUT32.DLL
{A33DE4AA-9646-4E33-9E44-E472C6312E2F}
888816666554443
6666554443
!6666554443
virtualoffercmd:
virtualoffercmd
/REPORTURL=
\ob1hhelper.txt
user32.dll
mscoree.dll
SKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
MSPDB100.DLL
ADVAPI32.DLL
WUSER32.DLL
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe
{8856F961-340A-11D0-A96B-00C04FD705A2}
3.0.0.6
sfile.exe
3.0.0.4