not-a-virus:AdWare.Win32.OutBrowse.ajy (Kaspersky), MemScan:Application.Bundler.Outbrowse.K (AdAware), Trojan.NSIS.StartPage.FD, Trojan.Win32.Swrort.3.FD, TrojanDropperVtimrun.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: aeb7dc27069a3a429ef465c4b493eeb8
SHA1: 9a4c59c75882e718085dd66997c434436cfadcb6
SHA256: 65a5853fd4ebf95a9a560bda012082d4a99ef2ba193d712d366bd6e97cabdc4a
SSDeep: 24576:4y4OQYjmeh0Wfxuakp9aZc21lu1RkjY 1GxobrAY6iGGQ27/l:/4DXJ8ZLlQRkZyobrui
Size: 1467904 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Premium Installer
Created at: 2013-02-17 09:00:50
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The MemScan creates the following process(es):
wmic.exe:2452
%original file name%.exe:944
Setup__5551_il350168.exe:1356
SETUP.exe:2396
Setup.exe:2372
SETUP_~2.EXE:592
The MemScan injects its code into the following process(es):
ins.exe:2420
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process wmic.exe:2452 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (238 bytes)
The MemScan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (0 bytes)
The process %original file name%.exe:944 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Setup.exe (18559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\SETUP_~2.EXE (7168 bytes)
The process Setup__5551_il350168.exe:1356 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\index[1].htm (7617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\amipb[1].js (27951 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe:typelib (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\desktop.ini (67 bytes)
The MemScan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (0 bytes)
The process SETUP.exe:2396 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ins.exe (148860 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Convert.dll (3647 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ins.dat (26689 bytes)
The MemScan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (0 bytes)
The process Setup.exe:2372 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\SETUP.exe (9321 bytes)
The process ins.exe:2420 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\button_over[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\bottomLine[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\topComp[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\bodyImg[1].png (1748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\dc[1].js (2685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\nextCase[1].jpg (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\topLine[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\bgImg[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\button[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\DynamicOfferScreen[1].htm (1843 bytes)
The MemScan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (0 bytes)
The process SETUP_~2.EXE:592 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe (3249 bytes)
The MemScan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe (0 bytes)
Registry activity
The process wmic.exe:2452 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E AB BC AB 8D 97 BE 18 01 21 07 00 69 5E 6D 10"
The process %original file name%.exe:944 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 54 39 74 8C 73 5C 33 28 A3 33 FD 7E 66 36 1B"
To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"
The process Setup__5551_il350168.exe:1356 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKCR\mandrel.yodles]
"(Default)" = "Inst Class"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"
[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\LocalServer32]
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\Setup__5551_il350168.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\TypeLib]
"Version" = "1.0"
[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0]
"(Default)" = "InstallerLib"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCR\mandrel.yodles.1\CLSID]
"(Default)" = "{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}"
[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}]
"(Default)" = "Inst Class"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\ESENT\Process\Setup__5551_il350168\DEBUG]
"Trace Level" = ""
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\Version]
"(Default)" = "1.0"
[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\TypeLib]
"(Default)" = "{69155DE9-A119-4606-BE6A-28B4BEBFA504}"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "Setup__5551_il350168.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\ProgID]
"(Default)" = "mandrel.yodles.1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1408604790"
[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\VersionIndependentProgID]
"(Default)" = "mandrel.yodles"
[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\Setup__5551_il350168.exe"
[HKCR\mandrel.yodles\CurVer]
"(Default)" = "mandrel.yodles.1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 22 8F 03 2A 49 EC B7 11 FE E1 68 61 21 40 1B"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\TypeLib]
"(Default)" = "{69155de9-a119-4606-be6a-28b4bebfa504}"
[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0\FLAGS]
"(Default)" = "0"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\Setup__5551_il350168.exe"
[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\mandrel.yodles.1]
"(Default)" = "Inst Class"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000"
[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}]
"(Default)" = "IBoot"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The MemScan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
[HKLM\SOFTWARE\Microsoft\ESENT\Process\Setup__5551_il350168\DEBUG]
"Trace Level"
The process SETUP.exe:2396 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 32 CD 71 BA B5 0A 71 4D F5 AA 96 16 F3 61 5C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process Setup.exe:2372 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Administrative Tools" = "%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Templates" = "%Documents and Settings%\All Users\Templates"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Administrative Tools" = ""
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 F9 D4 A0 FA 74 A4 A4 03 37 25 22 02 49 D6 8B"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
"Recent" = "%Documents and Settings%\%current user%\Recent"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000]
"setup.exe" = "This program will help you through the installation of your downloaded software"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process ins.exe:2420 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CacheOptions" = "11"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014090720140908\"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 51 EE 23 90 21 92 44 CE 65 7E 9C 39 18 CE 4F"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CacheRepair" = "0"
"CachePrefix" = ":2014090720140908:"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CacheLimit" = "8192"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"
The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The MemScan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]
The MemScan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process SETUP_~2.EXE:592 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Administrative Tools" = "%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000]
"Setup__5551_il350168.exe" = "Setup__5551_il350168"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Templates" = "%Documents and Settings%\All Users\Templates"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Administrative Tools" = ""
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 96 CF BD D5 54 3D C3 1C 7E 00 19 D1 D3 23 BF"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Dropped PE files
MD5 | File path |
---|---|
ca23c5b6b9508ca13daec5afb858631a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\SETUP.exe |
861ac12605c00bdb57bd92b999329c3d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\SETUP_~2.EXE |
d5887a209f45c421bad4204f85ddc72f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\Setup.exe |
56de3fe6ad5d12c03eb7b262348acd08 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ins.exe |
cd55b7934eaf455340e760b12416f259 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa3.tmp\Convert.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
wmic.exe:2452
%original file name%.exe:944
Setup__5551_il350168.exe:1356
SETUP.exe:2396
Setup.exe:2372
SETUP_~2.EXE:592 - Delete the original MemScan file.
- Delete or disinfect the following files created/modified by the MemScan:
%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Setup.exe (18559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\SETUP_~2.EXE (7168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\index[1].htm (7617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\amipb[1].js (27951 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe:typelib (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ins.exe (148860 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Convert.dll (3647 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ins.dat (26689 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\SETUP.exe (9321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\button_over[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\bottomLine[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\topComp[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\bodyImg[1].png (1748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\dc[1].js (2685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\nextCase[1].jpg (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\topLine[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\bgImg[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\button[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\DynamicOfferScreen[1].htm (1843 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 10.00.9200.16521
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE .MUI
Internal Name: Wextract
File Version: 10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: English (United States)
Company Name: Microsoft CorporationProduct Name: HD Player Product Version: 10.00.9200.16521Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE .MUIInternal Name: Wextract File Version: 10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)File Description: Win32 Cabinet Self-Extractor Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 25636 | 26112 | 4.3729 | 30b0e8189e280a7cdb22d1991ab59a9e |
.data | 32768 | 7788 | 1536 | 4.56584 | d67cb441a80679d33fc3bdcfa7cfe3b3 |
.idata | 40960 | 4284 | 4608 | 3.54952 | 32ebfbff8812f1402a4062b0066c17ed |
.rsrc | 49152 | 1433600 | 1430528 | 5.52848 | 87f968ecd7ed325f8fe9e1f062886859 |
.reloc | 1482752 | 3594 | 4096 | 3.00418 | 730dcb51042a052c358983687569656c |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/index.php | |
hxxp://dyno3mlj15jgv.cloudfront.net/V2/amipb.js | |
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/finalize.php | |
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/thankyou.php | |
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=4360&distid=19710&productid=18873&subpubid=0&campaignid=0&networkid=&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&ds1=&hb=0&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2 | |
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0& | |
hxxp://stats.l.doubleclick.net/dc.js | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/topLine.jpg | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/topComp.png | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/bgImg.jpg | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/bodyImg.png | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/bottomLine.jpg | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/nextCase.jpg | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/button_over.png | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/button.png | |
hxxp://cdn1.vitaldownload.com/V2/amipb.js | 54.192.55.17 |
hxxp://stats.g.doubleclick.net/dc.js | 74.125.192.156 |
hxxp://installer.ppdownload.com/Installer/Flow?pubid=4360&distid=19710&productid=18873&subpubid=0&campaignid=0&networkid=&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&ds1=&hb=0&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2 | 50.19.221.149 |
hxxp://static.revenyou.com/offers/images/Theme7/nextCase.jpg | 198.232.124.224 |
hxxp://static.revenyou.com/offers/images/Theme7/button_over.png | 198.232.124.224 |
hxxp://www.idyllicdownload.com/index.php | 107.20.210.63 |
hxxp://static.revenyou.com/offers/images/Theme7/bodyImg.png | 198.232.124.224 |
hxxp://static.revenyou.com/offers/images/Theme7/button.png | 198.232.124.224 |
hxxp://www.idyllicdownload.com/finalize.php | 107.20.210.63 |
hxxp://www.idyllicdownload.com/thankyou.php | 107.20.210.63 |
hxxp://static.revenyou.com/offers/images/Theme7/topComp.png | 198.232.124.224 |
hxxp://static.revenyou.com/offers/images/Theme7/bottomLine.jpg | 198.232.124.224 |
hxxp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0& | 50.19.221.149 |
hxxp://static.revenyou.com/offers/images/Theme7/bgImg.jpg | 198.232.124.224 |
hxxp://static.revenyou.com/offers/images/Theme7/topLine.jpg | 198.232.124.224 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /Installer/Flow?pubid=4360&distid=19710&productid=18873&subpubid=0&campaignid=0&networkid=&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&ds1=&hb=0&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: installer.ppdownload.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Sun, 07 Sep 2014 14:41:38 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 8522
Connection: keep-alive
..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"8/$.Fmkcsez_oajgRvjdo"8..'.PbaJay 5..% O_fGew1,.3 .&!NenjjoG_j_!6" '.KkmaobpIB.2 % >fv]yqJ^a^p.4/("GnO\brCiqEnqoYge 7 .Ev`MME 7.!("Cs]PKJ/.9."*.;jfk^hcHil`.5. ).NbfcmMME 7.gptn5'*qki(sde \hk&gk`n*cmh'*hdc_qo/Btf\fg`IebepN[m^ck9nbfcma_63#^hotg_5,25.*%he__h8*6512"cmpfokwf^<.60!ktl`fn</2$debnpi7%`f`8(!a`:*!("P\l`.8* .Ab_aobmk[k@ar\.5. ).@jtgqamnqbmQagI`qn.8.. .P_tgpm 7'0("Ca^`\rfpd.: ,$.IplgnpimiJ\mc.4,-, ?an\pbj`jcwMYo^ 7'0("Qg]`i?cndnIlnl\ej.4/("Tdjon_iIebep>ghf_k^Kenc.2..{)u!Loqo=s^ 7.!("Nm]@qc.4!., >ghimk_mpTwk].36).LkngoauZrfimPyn`k.3 -'0)3 '.M^eH_x.: .$.KcdEdu62.2..*.LdlopoF\fc.4!UosOm]^.>]balcmYohp.%.Oat`H\lq.&!Lrm_m^mGA.9.3*.9gp_vmNbfcm.5)*.CrSago>jkGkms]lj.2,% BrdQRJ.2..*.?waUPG*.3 .&!?okhYi]Jfhd.: .$.Hdc_qQRJ.2.arqj9 /vhd)mfb'`lp dfah,`il /ma^`kq,>xjakd[J_dblR_rc`f:hdc_qed;-./.tlcc921!\dlrf^<-95,(!ec^^o9163/..alomprwd\8 4/ rus`dl8,0#^e^=.!`]6..&!Nar`.5&/).@`dgoajg_i>`pa 5., 7/3,-5241.% >hsevgmmn^qO_fGewn.5. ).O]ympl.3 .&!Afd`[obtb.9)1*.HmhklnhknP\l`.8* .Dgn[m^n^hbuR_o].3 .&!Olc`h<_rblHjsr\dg.8-&!Ripom\eMc`dnCmhe\gbIcma"8..x%y.JnotCs].3 .&!Lrc@p`.8.. .CmhhjgcknSupc.2,% JimetguYobmkNxleq.2.) ).QagI`q.3 EEDU_APJM>LQYTOEP.Kj_rt[qa\ZDfnm_ifd`Bpjon^pBrsanqdgilZY,8375.$.KcdEdu62.2.AIBS^?UPM=IM]RMDN Qj^op_o_[XIlnl\ejb^Anoun]m>vq_moimikWU06163"*.J`imonM]mc.2.L_s_O]sq.Fjg P_`ncf.$.Ip
<<< skipped >>>
GET /V2/amipb.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.idyllicdownload.com/index.php
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn1.vitaldownload.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 40585
Connection: keep-alive
Date: Fri, 22 Aug 2014 22:33:35 GMT
x-amz-meta-cb-modifiedtime: Tue, 29 Jul 2014 10:46:22 GMT
Last-Modified: Wed, 30 Jul 2014 08:42:33 GMT
ETag: "d10a2ed9a4a2e81b939e360fc4931c09"
Accept-Ranges: bytes
Server: AmazonS3
Age: 61283
X-Cache: Hit from cloudfront
Via: 1.1 7c92101f5a051b6077d0586c8a74d49e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 0booVGIZcRnCi6YE6Y0wLmpxoKeOsxBQjbptWSn98DWOyCSuIo-yLw==
//<!-- ../* Progress bar */..var g_AmiPbs = new Array();..function LogMessage(message)..{.. try.. {.. g_ami.Log(message);.. }.. catch (excpt) { }..}..function AmiPbDelayedCheck(id) {.. var that = g_AmiPbs[id];.. if (that && that.periodicCheck) that.periodicCheck();..}..function InitPb() {.. .. LogMessage('InitPb function started');.. .. Show('header-close', 'none');.. var progress1 = new AmiPb("download_progress_host", 400, 20);.. var progress2 = new AmiPb("install_progress_host", 400, 20);.. progress1.start(function () {.. var p = g_ami.DownloadProgress;.. this.setValues(p, p);.. if (g_ami.DownloadCompleted) {.. LogMessage('InitPb g_ami.DownloadCompleted is True');.. g_ami.ReleasePostponedInstallations();.. for (var j = 0; j < g_comps.length; j ).. if ((g_comps[j].id == 0 && g_comps[j].sel == 0) || g_comps[j].id == 0x7fffffff) {.. g_ami.AddThanksParameter('c[' g_comps[j].sn '][s]', g_comps[j].pir ? '-2' : '-1');.. if (g_testa && !ArrayContains(g_notest, g_comps[j].sn) && !ArrayContains(g_notest1, g_comps[j].sn)) {.. if (g_testa.constructor != Array || ArrayContains(g_testa, g_comps[j].sn)).. g_ami.WriteProfileString(g_testf, '', g_comps[j].sn, g_comps[j].pir ? 'R' : 'S');.. }.. }.. this.stop();.. }.. }, 20);.. progress2.start(function ()
<<< skipped >>>
POST /thankyou.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: VVV.idyllicdownload.com
Content-Length: 1006
Connection: Keep-Alive
_srvlog=&c[AdvancedSysCare][r]=5&c[AdvancedSysCare][s]=-31&c[AmigoIM][r]=6&c[AmigoIM][s]=-31&c[DownloadManager][r]=0&c[DownloadManager][s]=-31&c[ElectroRevizer1][s]=-31&c[ElectroRevizer2][s]=-31&c[MariMediaRevize][s]=-31&c[NationZoom][r]=1&c[NationZoom][s]=-31&c[NetFilter][r]=0.01&c[NetFilter][s]=-31&c[PlusHDrow][r]=3&c[PlusHDrow][s]=-31&c[Yontoo1][s]=-31&c[Yontoo3][s]=-31&c[Yontoo5][s]=-31&c[Yontoo6][s]=-31&c[Yontoo7][s]=-31&c[updater][r]=0.01&c[updater][s]=-31&capp=DownloadManager&cc=UA&cid=5551&clip=193.138.244.231&cmdl=Setup__5551_il350168.exe /S /NCRC&cnt=87fc35be4bb81198d9fd59a8fe3438b0&is=-31&netfs=-31&sysid=D6A6947B24975DB6AB9DE8B171C5FA6E&sysid1=D6A6947B24975DB6AB9DE8B171C5FA6E&te=1410100915&thankyoupage=http://VVV.installpath.com/thank-you.html?subid=5551&tid=&ts=1410100904&ver=1.1.6.20&vert=3
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Date: Sun, 07 Sep 2014 14:41:37 GMT
Server: Apache/2.2.15 (Red Hat)
X-Powered-By: PHP/5.3.3
Content-Length: 14
Connection: keep-alive
.... ..HTTP/1.1 200 OK..Content-Type: text/plain; charset=UTF-8..Date: Sun, 07 Sep 2014 14:41:37 GMT..Server: Apache/2.2.15 (Red Hat)..X-Powered-By: PHP/5.3.3..Content-Length: 14..Connection: keep-alive...... ....
GET /offers/images/Theme7/topLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 07 Sep 2014 14:41:42 GMT
Content-Type: image/jpeg
Content-Length: 1785
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Tue, 12 Mar 2013 18:05:10 GMT
ETag: "0fac224c1fce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Sun, 14 Sep 2014 14:41:42 GMT
X-Cache: HIT
Accept-Ranges: bytes
......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................2.N.............\.................................................................R..T.................................?.....mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2................................................................................................................ ................................................................................................................... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD...(..].......Qw.@j....E.Q.... 5.qD.(......P..@(......P..@(......P..@(......P..@(......P..@(......P..@(......
<<< skipped >>>
GET /offers/images/Theme7/bgImg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 07 Sep 2014 14:41:42 GMT
Content-Type: image/jpeg
Content-Length: 2801
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Tue, 12 Mar 2013 18:05:10 GMT
ETag: "0fac224c1fce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Sun, 14 Sep 2014 14:41:42 GMT
X-Cache: HIT
Accept-Ranges: bytes
......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................,.N.............Q...........................................................................................?..H........ ... .U..@E.....@@............( .PE..E...@P...............................%.A..D...@.@@...."......"..%.P...@..E.@................- ..... ........@..D...@.@@....".......(...(......". ................FZ....P...QA...@..D...@.@@.....P.@.P@........E...........................(. ... ........... ..... .. .( ...."..."... (... ..............Q......@.T.@.P...P...............A......@.......D..................j2..........%P...P.......... .. .. ."..%Q...P..D..@...................- .. .... .E............( ..............@..E..A.....@...............j2.(.......P....@.A......... . . .."..%.P...@..E.@...................i................... .....(. .( ........".........................4.i.........A.@.A......@....@.P@........E............................H ... .(...(...................... ...............................e@.EA..@...@.@.....J.............. . .............................I..E.@........ ........@P.@T...A...(.....".. ......................4.i...J(. .(...(........A@A.AA.E..J....".. ..... ....................E........@.A......... . . ..".. ".......(.........................4YP.E..E...E........A@A.AA.@..@.@.......@.........................,........ ..... ..........( .(. .(..".............................U..A....
<<< skipped >>>
GET /offers/images/Theme7/bottomLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 07 Sep 2014 14:41:42 GMT
Content-Type: image/jpeg
Content-Length: 1654
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Wed, 13 Mar 2013 13:08:16 GMT
ETag: "35420d3eb1fce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Sun, 14 Sep 2014 14:41:42 GMT
X-Cache: HIT
Accept-Ranges: bytes
......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................2.N.............[..............................................................Q.....T................................?..?/.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...\................................................................................................................@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..5.j.....P...@..j.N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N...................................................................................................................................................
<<< skipped >>>
GET /offers/images/Theme7/button_over.png HTTP/1.1
Accept: */*
Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 07 Sep 2014 14:41:42 GMT
Content-Type: image/png
Content-Length: 1274
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 22 Oct 2012 15:36:02 GMT
ETag: "0dd0f16ab0cd1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Sun, 14 Sep 2014 14:41:42 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...|..."........9....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[Kl.E..gw............J.Q...p..\..Rz...!A#.KE..=...J.....6.B....\@....*.m.Kh.H.4..{c......8vHD9.f...>...x....1.Y...A`h\.z |O....N.c.&../!w C...<3s]......<..v.`.|O.;l.....B...o.t!].6.8|`..M.df...e...e((.$2Q...tx/.>~W..}.e..a..lF=N......OxHJ. .c..3PR.(:..^.q<8mn.......ZVaA..MW...#(|i........t.....]C#}..BB....M(*9f.....Fb........q.>.......G*.....$.?..m$.....e.<.y.....z...)a.W0-..n..(.........g[ ..,...}......L.*.r..~...o..wU.A..wN.......N<.rQ...)O...ra...[.b....c.........._-.1.S.....:1|k...@u...!..y................}.v..i\tiP.chx..a...<p.y..N.<|..tAVN1...h}.6.6.7.].....;y..5\..}...N#6/..v.0.W..R.W.9..j...2...%..V..i..1..n......Ws6my..-.......p.....4.....X....3..@pN..t..v.....Bz.x8 .....K1B.-....%..z..[..a@Y7.....]F....;.f5h..j........\..r..`.ef!.A).....u.........}....`.n5d.....LQg...8.J..../.v'{..R.-k.N.......]9...s...s.......<...d!,....O...lD....z...w.>|..........`...b..L~?.....9.....Z...?_..>...h{|gY7... .v..!a.&......%.9...C.SgG.....&.".....C..>..2.....Z.nf..BN*..p..?.#.g.?.2.DUp..''fv.......lz......O.....B......<L..D.E.q....ALHp.l..j.v.y....[E............M.`.6....;8.~..f..u......)....^.\."...7..9..W.t)F_'Uks.....~...0...d7r.I.wZ..".f...N.9R.z.....@7[.N.G.......u]......IEND.B`...
<<< skipped >>>
GET //offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0& HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xml.the-app-info.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Sun, 07 Sep 2014 14:41:35 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 11168
Connection: keep-alive
<html>. <head>. <title>5 - NonProduct (Setup Launcher)</title><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]);.. _gaq.push(['_trackPageview']);.. (function() {.. var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.. ga.src = ('https:' == document.location.protocol ? 'hXXps://' : 'hXXp://') 'stats.g.doubleclick.net/dc.js';.. var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.. })();</script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px; } .divLeadpName { margin-left:61px; margin-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; } .divOnNext { position:absolute; bottom:11px; right:28px; width:124px; height:35px; cursor:pointer; background:url("hXXp://static.revenyou.com/offers/images/Theme7/button.png");}
<<< skipped >>>
POST /index.php HTTP/1.1
Accept: */*
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.idyllicdownload.com
Content-Length: 275
Connection: Keep-Alive
Cache-Control: no-cache
Net1.1=&Net2=3.5.21022.08&Net4=4.0.30319&OSversion=NT5.1SP3&Slv=&Sysid=D6A6947B24975DB6AB9DE8B171C5FA6E&Sysid1=D6A6947B24975DB6AB9DE8B171C5FA6E&X64=N&admin=Y&browser=IEXPLORE.EXE&chver=&exe=Setup__5551_il350168&ffver=&lang_DfltUser=0409&netfs=3&s=Y&ts=1410100904&ver=1.1.6.20
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Sun, 07 Sep 2014 14:41:26 GMT
Server: Apache/2.2.15 (Red Hat)
X-Powered-By: PHP/5.3.3
transfer-encoding: chunked
Connection: keep-alive
1b79.... ..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">..<html>..<head>..<meta http-equiv="content-type" content="text/html; charset=UTF-8" /> ..<title>%appname% Installation</title>..<base href="hXXp://VVV.idyllicdownload.com:80/index.php" />..<script type="text/javascript" src="hXXp://cdn1.vitaldownload.com/V2/amipb.js"></script>..<script type="text/javascript">..var g_amiobj = '', g_ami, g_updb = false;..var g_eula = ''; ..var g_post1 = '_hdn=1&_ver=1.1.6.20&_p=1&_s=10&_cc=UA&_cid=5551&_psb=0&_cnt=ff5c2d87d1f88a8168429e3755eec003&_instid=&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=-31&_vert=3';..var g_icon = '';..var g_comps = [], g_pages = [], c, g_curPage = -1;..var g_cid = '5551';..var g_tid = '';..var g_cc = 'UA';..var g_lang = 'en';..var g_ip = '193.138.244.231';..var g_browser = 'ie';..var g_cnt = '87fc35be4bb81198d9fd59a8fe3438b0';..var g_ver = '1.1.6.20';..var g_buttonImage = 1;..var g_thanks = 'thankyou.php';..var g_images = [];..var g_purl = 'hXXp://VVV.idyllicdownload.com:80/pix.php';..var g_skipCats = 4096;..var g_ieVer = '6.0';..var g_chVer = '';..var g_ffVer = '';..var g_netfs = -31;..var g_vert = 3;..function InitInstall()..{.. g_ami.AddThanksParameter('tid', g_tid);.. g_ami.AddThanksParameter('cid', g_cid);.. g_ami.AddThanksParameter('cc', g_cc);.. g_ami.AddThanksParameter('cnt', g_cnt);.. g_ami.AddThanksParameter('ver', g_ver); .. g_ami.AddThanksParameter('vert', g_vert);.. g_ami.Ad
<<< skipped >>>
POST /finalize.php HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: hXXp://VVV.idyllicdownload.com/index.php
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.idyllicdownload.com
Content-Length: 595
Connection: Keep-Alive
Cache-Control: no-cache
_hdn=1&_ver=1.1.6.20&_p=1&_s=10&_cc=UA&_cid=5551&_psb=0&_cnt=ff5c2d87d1f88a8168429e3755eec003&_instid=&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=-31&_vert=3&r_DownloadManager=0&r_updater=0.01&r_NetFilter=0.01&r_Yontoo1=1&r_Yontoo3=3&r_Yontoo5=1&r_Yontoo6=1&r_Yontoo7=1&r_NationZoom=1&r_ElectroRevizer1=900&r_ElectroRevizer2=900&r_MariMediaRevize=900&r_PlusHDrow=3&r_AdvancedSysCare=5&r_AmigoIM=6&DownloadManager=3&updater=2&NetFilter=2&Yontoo1=1&Yontoo3=0&Yontoo5=0&Yontoo6=0&Yontoo7=0&NationZoom=1&ElectroRevizer1=0&ElectroRevizer2=0&MariMediaRevize=0&PlusHDrow=1&AdvancedSysCare=1&AmigoIM=1
HTTP/1.1 200 OK
Content-Type: text/xml
Date: Sun, 07 Sep 2014 14:41:27 GMT
Server: Apache/2.2.15 (Red Hat)
X-Powered-By: PHP/5.3.3
transfer-encoding: chunked
Connection: keep-alive
1b89....<Array><page><f>1</f><fb>1</fb><pt>0</pt><cats>0</cats><updh>1</updh><wrn></wrn><comps>DownloadManager</comps><bdy>DQoNCgk8ZGl2IHN0eWxlPSJ3aWR0aDogMTAwJTsgaGVpZ2h0OiA4NXB4OyBib3JkZXItYm90dG9tLXdpZHRoOiAxcHg7IGJvcmRlci1ib3R0b20tc3R5bGU6IHNvbGlkOyBib3JkZXItYm90dG9tLWNvbG9yOiByZ2IoMTcwLCAxNzAsIDE3MCk7IG1hcmdpbi10b3A6IDBweCI DQoJICZuYnNwOyZuYnNwOw0KCTxwIHN0eWxlPSJwYWRkaW5nOiA1cHg7IHRleHQtYWxpZ246IGxlZnQ7IGZvbnQtc2l6ZTogMTdweCI DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxN3B4OyB0ZXh0LWFsaWduOiBsZWZ0Ij5Eb3dubG9hZCAmYW1wOyBJbnN0YWxsIDxiPiVhcHBuYW1lJTwvYj4gZm9yIEZSRUU8L3NwYW4 DQogIDwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iZF9hbWlfRG93bmxvYWRNYW5hZ2VyIiBzdHlsZT0iaGVpZ2h0OiAxMzBweCI IA0KPGJyIC8 DQo8cCBzdHlsZT0iZm9udC1zaXplOiAxM3B4OyB0ZXh0LWFsaWduOiBjZW50ZXI7IHBhZGRpbmc6IDBweCI PGI Q2xpY2sgTmV4dCBvciBJbnN0YWxsIGJlbG93IHRvIGJlZ2luIHlvdXIgaW5zdGFsbGF0aW9uLjwvYj48L3A DQoJPGRpdiBkYXRhLWFkanVzdC1oZWlnaHQ9IjAiIGlkPSJtaWRkbGUiIHN0eWxlPSJ3aWR0aDogMTAwJTsgcGFkZGluZzogMHB4OyBoZWlnaHQ6IDExMHB4OyBtYXJnaW4tdG9wOiAwcHgiPg0KCQ0KCQk8dGV4dGFyZWEgc3BlbGxjaGVjaz0iZmFsc2UiIGNsYXNzPSJ0ZXh0YXJlYTEiIGlkPSJhbWlfZXVsYV9Eb3dubG9hZE1hbmFnZXIiIHJlYWRvbmx5PSJyZWFkb25seSI CQkNCgkJPC90ZXh0YXJlYT4NCg0KCTwvZGl2Pg0KCTwvZGl2Pg0KDQoJPGlucHV0IGlkPSJpX2FtaV9Eb3dubG9hZE1hbmFnZXIiIHR5cGU9ImhpZGRlbiIgdmFsdWU9IjEiIC8 DQoNCgk8ZGl2IGlkPSJwaG9sZGVyc0Rvd25sb2FkTWFuYWdlciIgc3R5bGU9InBhZGRpbmctbGVmdDogMTBweCI DQoNCgkJPGRpdiBjbGFzcz0iYW1pLWV4cHJlc3MtY3VzdG9tIiBzdHlsZT0id2lkdGg6IDE
<<< skipped >>>
GET /offers/images/Theme7/topComp.png HTTP/1.1
Accept: */*
Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 07 Sep 2014 14:41:42 GMT
Content-Type: image/png
Content-Length: 1684
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Tue, 12 Mar 2013 18:06:58 GMT
ETag: "08db634c1fce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Sun, 14 Sep 2014 14:41:42 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...*...0.....g.......tEXtSoftware.Adobe ImageReadyq.e<...6IDATx..Y{LSW....mK_.....,.....%..q.....23...9..1....p.7..h.3c>..2g.5f3Q.=..8.M.5....V..[.S...}_[..-m!n....s.wO..........OB...i1.1...........`.=8"../..]c....4..=.o=n..^.....d4X.w.AAvF...R......a..-...J...od......#\.~{.....Y.\.\7.&.@vf.s.!m..D.S...VSKOE..C....k.."PmXg.{uJ.....i..B..%......P.........5^*C.i7/.)..p...<.....=........[.P.x.j[9..h.:E.]wg,..$U}(.....B.p..D.3q....u. ..T......_.....w =3.=.#..`b8fB3.<`D)~...Z...3......!:U....&..L.NZ.......5...`en{.y..8VD.......v.v.Y....?[;?*....S.7.....u.......P4-....k...x.....A6#.|......%E...............h..8r........R.g..:.WV.;..d..V....n...h.*.}....!t.A.1....o.N.^..SC..#h4..@0.h.F\p#.p..k...9..).:m).J;.z...#a6z.R........01/'..J...1.0....S....\..nJ..a.....q\.....d....W2......B....."T|..q..>.p...9E|....AF.!..(o@..d....V ......?]lD..H.E....2.g.$P..*&.]..l.z.&....`O..Y.[W8......T.92\!..8..4.*.dN.......d20..E.8....:..u...2.....-.W.O..0...W...s....\[^...5.aw5.....es.f.`...P....j..P}........P..A8 ...1g.uw...;P..}..f.FTw../~..n.e.7Wl..U)u.6.....N..B..4\5...V.w..M.6......k..E.h<>...........uU....w..><F.O.k...... >^...d2.D.6J...j]{F..K..6....J3.................N..s........r.]T`...k.Q.*.2/9A.G.....{G..B....X.8.f.jil.>..O....#...U.5...==.`w.=..A.....;,..bH.R9..*X4.5.auEr.....=1a.G...M.J*6..=,..p2.y.....p..M.mh........,......@........7.:.......U....D..M .JBL&..."....J....0(@...a.&...a..........._....X.F..0..!....9...Y}.}.6..P(.......&.`....`......9|4@...Y..xd.nP..fKEb..Q.&....L.
<<< skipped >>>
GET /offers/images/Theme7/bodyImg.png HTTP/1.1
Accept: */*
Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 07 Sep 2014 14:41:42 GMT
Content-Type: image/png
Content-Length: 14789
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Tue, 12 Mar 2013 18:09:36 GMT
ETag: "07038c14c1fce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Sun, 14 Sep 2014 14:41:42 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR................s....tEXtSoftware.Adobe ImageReadyq.e<..9gIDATx.....U...7OQ..F.!py........qEY..1.....&...t.Q...5.Q{%i.a.^.JVz4.q........U .Q.#..y....1....7w.......U{..g.....U..{....G............x...6....^.x .x............../.H/^.x .x.@z..%g..oA...5k.M...../.H/^<.^.x.@z.........../.H/^jQ.8...2A....Te.*g..S.....UY.....<.^...x.*.W.2UF.l.U.7..d......Sx...@....Z.?SeR...TyZ.g"H.x .....M....^..s..~U..g.....q.......7.]..R..u.. pn.H/..HQ...............g?..8..`..I..!C...g>..Bu..<..H.dq..i.....`.y....Y......={....T...:.=.H/..b....!U...mmm.3.<....{..'..\y.....`......<.^<..........?v.X.)q.=z..>..O.W]uUp.9...G.......{ .x ...C$?Re....o~........@.2eJh...0@...*_ ..YO@.H./.....!/. .>..O.s.........n...'?.I.~.z...U. ..........P.R.V...U9:z..`..yA.~.B(w...<...... ...K.!..>..|@...H/^.......Re...........zj...j.....^.>.....]....r.......\.^.Te.Yg..|.K_.N9..PS.l..5../~.l..E....7..N.../9C.K.r.*...z.u...!..(.~.a.r.....Y..?2a.....K.P..A...<_...J....}..._.=x....n.TyHA......K.P.....0_1...w...<r.H.._.:x..7.].%..H.....Z......rh......^Z........4@9....@z.%(....x?q..`.......p.t..W..Uy....@z.5(1..."..._...6...DY.vm.H..5.....K-..TY../...R...D<,...D....H/^.....q.*.0.2s...v..<|.p...o.3G4.c.%......|.D....~..Q...c...x.w..0....4. ..M.H/^...9x..../.04]u(......7o..XM.UP^....%_A ...N:)8..............s......H/^..........z......d. ..&...}.../..2...x...~....dZ...&...C.....%?-yT....H...:./..}......U.....%?(._.%..0a../..;v....<...?.....K....s..g......".... x...M.^...../9iI...1sH.a2[.~.....C.l.
<<< skipped >>>
GET /offers/images/Theme7/nextCase.jpg HTTP/1.1
Accept: */*
Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 07 Sep 2014 14:41:42 GMT
Content-Type: image/jpeg
Content-Length: 798
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Wed, 13 Mar 2013 12:09:45 GMT
ETag: "c8d90a6e31fce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Sun, 14 Sep 2014 14:41:42 GMT
X-Cache: HIT
Accept-Ranges: bytes
......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................2...............i..................................................................Q..S...!..c.1Aq..................................?..o....G.."..UkeDj*...b.y.q.jP..............U^E.j..J..E.S....Bi.;q..F..xz..........[...S.....(.............a:...}...&.....`:....6.Y...O...uA@.............{........i...h............z\9~./.aq.ZP................V%.......LM...4r...*\@...,.[..G.#.._.9<....k.*..............M..f....qV..W/...M\O.E:.u..@T..<..#..L.QS....#.e...G.T.2.~L..).e...G.R....2.@.9.{.e..Hs....=...]...z.!....(..C.w.&Q...2.~L..).e...G.R....2.@.9.{.e..Hs....=.....D..=..."y.Q.....@T.@...................?......
GET /offers/images/Theme7/button.png HTTP/1.1
Accept: */*
Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 07 Sep 2014 14:41:42 GMT
Content-Type: image/png
Content-Length: 1256
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 22 Oct 2012 15:36:14 GMT
ETag: "0eb27f86ab0cd1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Sun, 14 Sep 2014 14:41:42 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...|..."........9....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[_h[U....776M..[..-.u6...!.N.E.......V6A..^...=....^..S....Cp8..Nl..Z..-..g.L...m...&M.=.^...............{/y.~...{.9:..p...l....'./8...."N.G.@...."7sU.@. ....'z.....\"n8s...B....0..<....X...E,...f...-...$..R..9....(...E...._^.......u8...V....%.5zaA..T:.EC..\..\.j.@.....~p.^P2......f....(..]..1.zeq..H ..6ul..t=.Y#....(r.[.F.....P..c........Q....m.K...........t<.8.,^.EK./...5..(P#..P...f......).o..Lp.T..z...[[.{..:..z.....`...].P...@Q...>...z...K!.p......,.B..m.A..1..........|...9.c..............."..Ro.i.0..XD..-A.j.<...b..d....=.\..b.t.qK9.E.... H..pz.......rZ..5.c@.S...[... .FI...(`.....p...$.(....1.....!......(8.(#.Ig..-8......>..,.v.6...........L.L.../x.Hc#/..........9.../{5{..=|...C.J...h[a.n.b...-[A......{.3aYX.QK_.x.P..-....Ws.Xm....i_......f3...<...5..0y..GOf....:...u..3..klZ>.q.P(|#HKoV8..................<...-......[.Vr.w.)......f....e.S...k...Ax.?Hv...-..b..0..$.......l.Z....g.i<.9X.p.d..(r.k.2g..J.. ./!o#i.C...#...'.#.g.>...l..........J.w|8...8;...}..../n~..T.!7o_c..|.....9o...<..._.|;hqV Y7.6XX.....0.C.4.mV..!o.t.$$.?.......1...$.........<].s.|A9.}.........._Jb.\.2..q.|..Z1..Q..9..I.=..wO..s/......d'.......Pd..BN!..^.c.-...W........./I....IEND.B`...
<<< skipped >>>
GET /dc.js HTTP/1.1
Accept: */*
Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: stats.g.doubleclick.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 07 Sep 2014 13:38:22 GMT
Expires: Sun, 07 Sep 2014 15:38:22 GMT
Last-Modified: Wed, 27 Aug 2014 18:16:28 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15801
Cache-Control: public, max-age=7200
Age: 3800
Alternate-Protocol: 80:quic
...........}kW....w~.....;.$..&.Y@i....Z...].,CJp..pi......d.I.~.k...X...2..f.n<ND..&........2..H~.x.;......,..A...~~...2.....p............./..A$...M!....,.~.2..."..~%.p..e..'.....a..8.`8L.v.Aq....aC._.\\8l...0..5FH%...@^Ay.;..sUI....b...&p..I...s...N6....C.,.......s...~..`(.....<.b...t...p..;@\.2.. .G..=..b.3...X............3...@........~.....S.....P.`.8......aw...~...[>.C......X..".........b.p.0....c.7}h1..n....../.....2.....W........C.BH@..FK....y. M.Yl..!..R.i.Z.eo./>1.bR.............al...b.....b.........}1L..c...;........^.....T....xp..L...B..e..Tn?vk\.<...x..mU.g.{.=..;X4.^............M.."..mo.i.h0.j....w.V..t8N"w...t..........hx.zv.1.d.x.......b.z.'......[..v.R.......}w.YQ1..>........!.0.u..]x.:^.......{.$.eL...o.m>.&r...R.8)KF........1."....h....a?.e"..,....Z...y.sqA.........CTo...........n...1....W..v9r...:E.E..{....B............_..o....g...j..f..`...(...Q.....j.......w@.....^;.G<..;..>..L....[...fx....o...K...s..!......M...w0J.arkl.............._.3..T......N. ....I.....|..*...}.Zi.....Np^IP4`n*...Q..O.%4T ...;.....%J.........xKK.&..^I../{............8..83[X......p...c...3j%.....Z.....m"tf.Gm. .ZY.Y....T.._.lH.......A=1..N.....;..R ..{...(.RS..^...)...8em.e.EU...,...."I.L..C.....R......%...<$................L.,..^.R...l...[...n2.....6.v.Q..=....v.#.0.......g.5..z]__.a.j...fJh.....r.6a.6v3..!.}^0...,...I.w................Q..q ..c;2.p2 .%..;0..14....f....c.*Z..*..>..[v].....H...N...kVT.]....I ...._..........^]..e..]..wd.N.....9..u5.bZ`.*...i.`..V..l.{.*{..(.,2.nv. .......
<<< skipped >>>
Map
The MemScan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_944:
.text
.text
`.data
`.data
.idata
.idata
@.rsrc
@.rsrc
@.reloc
@.reloc
Invalid parameter passed to C runtime function.
Invalid parameter passed to C runtime function.
advapi32.dll
advapi32.dll
setupx.dll
setupx.dll
setupapi.dll
setupapi.dll
advpack.dll
advpack.dll
wininit.ini
wininit.ini
Software\Microsoft\Windows\CurrentVersion\App Paths
Software\Microsoft\Windows\CurrentVersion\App Paths
ADMQCMD
ADMQCMD
USRQCMD
USRQCMD
FINISHMSG
FINISHMSG
IXPd.TMP
IXPd.TMP
msdownld.tmp
msdownld.tmp
TMP4351$.TMP
TMP4351$.TMP
wextract.pdb
wextract.pdb
PSSSSSSh
PSSSSSSh
PSSShX
PSSShX
PSShX
PSShX
SShtL@
SShtL@
zcÃ
zcÃ
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
wextract_cleanup%d
wextract_cleanup%d
Command.com /c %s
Command.com /c %s
rundll32.exe %s,InstallHinfSection %s 128 %s
rundll32.exe %s,InstallHinfSection %s 128 %s
SHELL32.DLL
SHELL32.DLL
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\RunOnce
%s /D:%s
%s /D:%s
PendingFileRenameOperations
PendingFileRenameOperations
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
GDI32.dll
GDI32.dll
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
USER32.dll
USER32.dll
_amsg_exit
_amsg_exit
_acmdln
_acmdln
msvcrt.dll
msvcrt.dll
COMCTL32.dll
COMCTL32.dll
Cabinet.dll
Cabinet.dll
VERSION.dll
VERSION.dll
)%u]Q
)%u]Q
Bp.Dx
Bp.Dx
gA`0)%UJ
gA`0)%UJ
SETUP_~2.EXE
SETUP_~2.EXE
Setup.exe
Setup.exe
lW.Wi
lW.Wi
%XTIxs
%XTIxs
Bu.oU
Bu.oU
=G.oV
=G.oV
^}0
^}0
){%%d
){%%d
FtPq
:..ut
#.Ff$
{3I%s
-ky}Z
NrK%u
0w@%x
.rmf6w.
s%FZ]
.gl,K
VH;%F
N*sB.Jy
)F.Vd
4.ii.EfCKU
%SK85
ZZ-5}r
=eXEo
oh.bwR
A%CG`
2(^.EZ
Wl.Fz
&,[t|.RF4
:.cm=
'6.lp
DQ".MO
.YO{{
G.qGr
U.DY4
Q.NJe
.AJ(0A&U
.Nnee
%uE/rm
h}%CR
]:.fC'4
E.MxmO
.Yp]i
@%Dvr
.BWe@w
Gn .nHW;m
Y:\t4
.sp?!
7]%C,
s#O.mhO
.FZJ{
/.khh
b.IY,
|.drJ
e.TH]
.NK$Sb
.Wtp(0
.vY8!
W;;.eI6pa
*y%S)>
%SKebEs
,%%s]xcP
#H#Lx.ik
R.W%Xe
8.IAIS
U.NIg
E%uO~1%Sut]3'%x%F;s.UZJZ_-O}~12%XNj.tGz%%fg)xre.nRfq&(I}.gvcBJk.cR,tI%C'ANf.jB>P ;%Dl.WlJ-zs94%cAO#-E}%6 -@^//u_.RIg%XofB.Hx|CRT4F\.vu$M.TsB$^.yT1.FCXI~Y]K^&E.oeK.bp 'x%U,5q.zvN28FnP%fMy]v%FGQ\.Ty%xYcn%5uoQC(.SiAYZs%FD!$%cdsshMname="Microsoft.Windows.Common-Controls"version="6.0.0.0"publicKeyToken="6595b64144ccf1df"5&5,52585Kernel32.dllPlease read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.CFailed to get disk space information from: %s.System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?8Unable to retrieve operating system version information.!Memory allocation request failed.Filetable full.Ên not change to destination folder.Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to installCould not create folder '%s'To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.Error retrieving Windows folder$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application./C: -- Override Install Command defined by author.eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?Could not find the file: %s.:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)WEXTRACT.EXE .MUIWindows10.00.9200.16521Setup.exe_2372:!Require Windows.text`.rdata@.data.rsrcv%f=a"%s".Could not overwrite file "%s".Could not create file "%s".0xX.7-Zip: Internal error, code 0xX.7-Zip: Internal error, code %u.7-Zip: Unsupported method.Error during execution "%s"."setup.exe"Could not find "setup.exe".Could not find command for "%s".Could not delete file or folder "%s".Could not create folder "%s".Error in line %d of configuration data:Could not open archive file "%s".1.4.0-i386 alpha1.4.0-i386 alpha build 1501 (September 7, 2009)Supported methods and filters::Language:%u!Sorry, this program requires Microsoft Windows 2000 or later.KERNEL32.dllGetKeyStateUSER32.dllGDI32.dllShellExecuteWShellExecuteExWSHELL32.dllole32.dllOLEAUT32.dllCOMCTL32.dllmsvcrt.dll_acmdlnversion="1.4.0.1501"7ZSfxx.cmd7zSfxFolderdsetup.exe7ZipSfx.x@ (%u%s)3.4.5.6SETUP.exe_2396:.text`.rdata@.data.ndata.rsrcuDSSh.DEFAULT\Control Panel\InternationalSoftware\Microsoft\Windows\CurrentVersionGetWindowsDirectoryAKERNEL32.dllExitWindowsExUSER32.dllGDI32.dllSHFileOperationAShellExecuteASHELL32.dllRegEnumKeyARegCreateKeyExARegCloseKeyRegDeleteKeyARegOpenKeyExAADVAPI32.dllCOMCTL32.dllole32.dllVERSION.dllverifying installer: %d%%hXXp://nsis.sf.net/NSIS_Error... %d%%~nsu.tmp%u.%u%s%sRegDeleteKeyExA%s=%s*?|/":C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp/ins.exe /PID=4360 /SUBPID=0 /DISTID=19710 /VM=2 /NETWORDK=1 /CID=0 /PRODUCT_ID=18873 /RETURNING_USER_DAYS=2 /SERVER_URL=hXXp://installer.ppdownload.comC:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\Convert.dlloperatorGetProcessWindowStationportuguese-brazilianVisual C CRT: Not enough memory to complete call to strerror.Broken pipeInappropriate I/O control operationOperation not permittedGetCPInfoGetProcessHeapConvert.dllzcÃ=*>0>4>8>1*2024282>&>,>5>^>3 3$3(3,30383.mTl6FC:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp/ins.datTempins.dat:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\SETUP.exe" /S /NCRCC:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempC:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000SETUP.exeCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf2.tmpC:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmpC:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\SETUP.exealler.ppdow/PID=4360 /SUBPID=0 /DISTID=19710 /VM=2 /NETWORDK=1 /CID=0 /PRODUCT_ID=18873 /RETURNING_USER_DAYS=2 /SERVER_URL=hXXp://installer.ppdownload.comNullsoft Install System v2.46WUSER32.DLL1.0.0.1convert.dll1.0.0.2KERNEL32.DLLmscoree.dll- Attempt to initialize the CRT more than once.- CRT not initialized- floating point support not loadedins.exe_2420:.text`.rdata@.data.rsrc@.relocspKeyszKeykeyCurhKeycSubKeyscmdlineurlStrwurlbstrLicKeycchLicKeynMsgvurlbstrURLOutrtExecmdrtExeurlreportURLzErrMsgcompiledSqlsqliteCookieFileshtmlDecodedUrlValueendParamKeysdynamicProductKeyswUrlQSwUrlsqliteHistoryFilesreadDownloadUrl.hL3QsearchUrlfinishUrlForOuterInstallerreportUrlhttpResponsefullCmdsubkeyhostBrwCmdtyUrlbaseKeyscmdLineWcmdWexeUrlWurlWcmdLineexeUrlcbMaxSubKeyachKeyoffersMainUrlantivirusesRegKeys64ArrantivirusesRegKeys32Arrreg64KeypostExepreExeregKeyofferUrlregKey64cbSubKeyszMsgnCellKeynMaxKeynMinKeynKeyzErrmsgkeyInfoerrMsgt.hx3SosCmdfinalExePathurlCompszURLPathxSSShFTPjKSFtPj;SC.PjRVRegDeleteKeyExWRegDeleteKeyTransactedWRegCreateKeyTransactedWRegOpenKeyTransactedW.vector too long
X:X:X:X:X:X
\Google\Chrome\Application\chrome.exe
%d/%d/%d %d:%d:%d
3.7.16.2
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
\ob1hhelper.txt
Error %u in WinHttpQueryDataAvailable.
Error %u in WinHttpReadData.
Error %d has occurred.
F%D,3
Run-Time Check Failure #%d - %s
%s%s%s%s
%s%s%p%s%ld%s%d%s
Visual C CRT: Not enough memory to complete call to strerror.
RegCloseKey
RegOpenKeyExW
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
operator
GetProcessWindowStation
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpOpen
WinHttpQueryHeaders
WINHTTP.dll
PSAPI.DLL
GetProcessHeap
KERNEL32.dll
EnumChildWindows
CreateDialogIndirectParamW
USER32.dll
GDI32.dll
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
ole32.dll
OLEAUT32.dll
URLDownloadToFileW
urlmon.dll
IPHLPAPI.DLL
GetCPInfo
.?AV?$CAtlExeModuleT@VCSmartInstallerModule@@@ATL@@
SQLITE_
d-d-d d:d:d
d:d:d
d-d-d
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
922337203685477580
API call with %s database connection pointer
RowKey
OsError 0x%x (%u)
os_win.c:%d: (%d) %s(%s) - %s
delayed %dms for lock/sharing conflict
%s-shm
%s\etilqs_
%s\%s
Recovered %d frames from WAL file %s
cannot limit WAL size: %s
invalid page number %d
2nd reference to page %d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
failed to get page %d
freelist leaf count too big on page %d
Page %d:
unable to get the page. error code=%d
btreeInitPage() returns error code %d
On tree page %d cell %d:
On page %d at right child:
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Fragmentation of %d bytes reported as %d on page %d
Page %d is never used
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
unknown database %s
keyinfo(%d
%s(%d)
%s-mjXXXXXX9XXz
MJ delete: %s
MJ collide: %s
-mjX9X
foreign key constraint failed
unable to use function %s in the requested context
bind on a busy prepared statement: [%s]
zeroblob(%d)
abort at %d in [%s]: %s
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot release savepoint - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
database table is locked: %s
statement aborts at %d: [%s] %s
cannot open value of type %s
cannot open virtual table: %s
cannot open view: %s
no such column: "%s"
foreign key
indexed
cannot open %s column for writing
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
EXECUTE %s%s SUBQUERY %d
misuse of aggregate: %s()
%.*s"%w"%s
%s%.*s"%w"
sqlite_rename_table
sqlite_rename_trigger
sqlite_rename_parent
%s OR name=%Q
type='trigger' AND (%s)
sqlite_
table %s may not be altered
there is already another table or index with this name: %s
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_stat1
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE %s=%Q
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
sqlite_detach
sqlite_attach
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
sqlite_stat%d
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
sqlite_stat
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
a JOIN clause is required before %s
unable to identify the object to be reindexed
no such collation sequence: %s
table %s may not be modified
cannot modify %s because it is a view
sqlite_version
sqlite_source_id
sqlite_log
sqlite_compileoption_used
sqlite_compileoption_get
foreign key mismatch - "%w" referencing "%w"
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
%s.%s may not be NULL
constraint %s failed
PRIMARY KEY must be unique
sqlite3_extension_init
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
automatic extension loading failed: %s
foreign_keys
foreign_key_list
foreign_key_check
*** in database %s ***
unsupported encoding: %s
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
USE TEMP B-TREE FOR %s
COMPOUND SUBQUERIES %d AND %d %s(%s)
%s.%s
%s:%d
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
sqlite_subquery_%p_
too many references to "%s": max 65535
%s.%s.%s
no such table: %s
SCAN TABLE %s %s%s(~%d rows)
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
-- TRIGGER %s
no such column: %s
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
%s SUBQUERY %d
%s TABLE %s
%s AS %s
%s USING %s%sINDEX%s%s%s
%s USING INTEGER PRIMARY KEY
%s (rowid=?)
%s (rowid>? AND rowid)
%s (rowid>?)
%s (rowid)
%s VIRTUAL TABLE INDEX %d:%s
%s (~%lld rows)
at most %d tables in a join
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
SQL logic error or missing database
unknown operation
large file support is disabled
unknown database: %s
no such %s mode: %s
%s mode not allowed: %s
no such vfs: %s
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
.?AVCWebPage@@
zcÃ
{A0386B19-B7E7-4BE7-B567-ABF77CBB6E60} = s `ATLExeServer'
`ATLExeServer.EXE'
val AppID = s {A0386B19-B7E7-4BE7-B567-ABF77CBB6E60}
ForceRemove {FA20B59B-21AA-44FC-8A68-450979B7CC90} = s 'CBrowserExternals Class'
val ServerExecutable = s '%MODULE_RAW%'
TypeLib = s '{03771AEF-400D-4A13-B712-25878EC4A3F5}'
ForceRemove {622D38AD-B4A9-4170-8192-5B865C6A5DCE} = s 'CBrowserExternalImp Class'
ForceRemove {6D4506CE-F855-4657-AA38-DB6B1F733982} = s 'CBrowserExternal Class'
stdole2.tlbWWW
~cmdWd
OpenUrlW
urlWd
method OpenUrl
Created by MIDL version 7.00.0555 at Thu Mar 13 16:11:05 2014
Red
Green
Blue
3%3u3
=0>4>8>
9%9 9;9]9
6i6C6t9
2 2$2(2,202
?-?3?^?{?
5o6^6|6
4054585121)4 6$6(6,64>}>8Â8b8|8: :$:(:,:0,080@0\0|03$3,383\3|3HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_PERFORMANCE_DATAHKEY_DYN_DATAHKEY_CURRENT_CONFIGWAdvapi32.dllSERVER_URLEXE_URLEXE_CMDLINETHANKYOU_URLexeurlexecmdlineException opening/reading chrome cookiesException opening/reading opera cookiesa\Microsoft\Windows\Cookiesa\Mozilla\Firefox\Profiles\Mozilla\Firefox\Profilessqlitecookies.sqliteChrome_WidgetWin_1a\Opera\Opera\\..\Local\Google\Chrome\User Data\Default\\..\Local Settings\Application Data\Google\Chrome\User Data\Default\cookies4.datSELECT value,last_access_utc FROM cookies WHERE host_key LIKE '%Found cookie in Chrome!\..\..\Local Settings\Application Data\Opera\Opera\Found cookie in Opera!Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19OLEACC.DLLplaces.sqliteSELECT url FROM moz_places WHERE url LIKE '%Found history in Chrome!SELECT urls.url FROM urls WHERE urls.url LIKE '%\PreExe_ID_\default.htmlCHROMEVERSION&chromev=SOFTWARE\Microsoft\.NETFramework\policyfirefoxchromeoperaSoftware\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoiceChromeHTMLFirefoxHTMLIE.AssocFile.HTMOpera.HTMLhttp\shell\open\commandOpera.exeSafari.exe\PostCheck.exeSOFTWARE\Mozilla\Mozilla FireFoxSoftware\Mozilla\Mozilla FireFoxSOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}aSoftware\Mozilla\Mozilla Firefox*.txt@@exeurlOfferURLExeURLRegKeyReportNamePreExePostExeRegKey64AntivirusesRegKeysRegKey32Mscoree.dllOLEAUT32.DLL{A33DE4AA-9646-4E33-9E44-E472C6312E2F}8888166665544436666554443!6666554443virtualoffercmd:virtualoffercmd/REPORTURL=\ob1hhelper.txtuser32.dllmscoree.dllSKERNEL32.DLL- Attempt to initialize the CRT more than once.- CRT not initialized- floating point support not loadedMSPDB100.DLLADVAPI32.DLLWUSER32.DLLC:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe{8856F961-340A-11D0-A96B-00C04FD705A2}3.0.0.6sfile.exe3.0.0.4