Win32.Sality.3_ff64274d3c

Win32.Sality.3 (B) (Emsisoft), Win32.Sality.3 (AdAware), VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Worm, Virus, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

[^:]:%[^

[^:]:%[^

Protocol %s not supported or disabled in libcurl

Protocol %s not supported or disabled in libcurl

http_proxy

http_proxy

%5[^:@]:%5[^@]

%5[^:@]:%5[^@]

%5[^:]:%5[^

%5[^:]:%5[^

:%5[^@]

:%5[^@]

Port number too large: %lu

Port number too large: %lu

%s://%s%s%s:%d%s%s

%s://%s%s%s:%d%s%s

ftps

ftps

[%*39[0123456789abcdefABCDEF:.%]%c

[%*39[0123456789abcdefABCDEF:.%]%c

Couldn't find host %s in the _netrc file; using defaults

Couldn't find host %s in the _netrc file; using defaults

PTF@example.com

PTF@example.com

Couldn't resolve host '%s'

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

Couldn't resolve proxy '%s'

Connection #%d seems to be dead!

Connection #%d seems to be dead!

Connection (#%d) was killed to make room (holds %d)

Connection (#%d) was killed to make room (holds %d)

Re-using existing connection! (#%ld) with host %s

Re-using existing connection! (#%ld) with host %s

%s://%s

%s://%s

Connection #%ld to host %s left intact

Connection #%ld to host %s left intact

operation aborted by callback

operation aborted by callback

HTTP/

HTTP/

ioctl callback returned error %d

ioctl callback returned error %d

the ioctl callback returned %d

the ioctl callback returned %d

seek callback returned error %d

seek callback returned error %d

The requested URL returned error: %d

The requested URL returned error: %d

HTTP/1.0 connection set to keep alive!

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

HTTP 1.0, assume close after body

HTTP =

HTTP =

HTTP/%d.%d =

HTTP/%d.%d =

No URL set!

No URL set!

[^?&/:]://%c

[^?&/:]://%c

Violate RFC 2616/10.3.2 and switch from POST to GET

Violate RFC 2616/10.3.2 and switch from POST to GET

Disables POST, goes with %s

Disables POST, goes with %s

Issue another request to this URL: '%s'

Issue another request to this URL: '%s'

Maximum (%d) redirects followed

Maximum (%d) redirects followed

Received problem %d in the chunky parser

Received problem %d in the chunky parser

HTTP server doesn't seem to support byte ranges. Cannot resume.

HTTP server doesn't seem to support byte ranges. Cannot resume.

Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)

Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)

Leftovers after chunking. Rewinding %d bytes

Leftovers after chunking. Rewinding %d bytes

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

unspecified error %d

unspecified error %d

%s cookie %s="%s" for domain %s, path %s, expire %d

%s cookie %s="%s" for domain %s, path %s, expire %d

#HttpOnly_

#HttpOnly_

httponly

httponly

I99[^;

I99[^;

skipped cookie with bad tailmatch domain: %s

skipped cookie with bad tailmatch domain: %s

skipped cookie with illegal dotcount domain: %s

skipped cookie with illegal dotcount domain: %s

23[^;=]=I99[^;

23[^;=]=I99[^;

%s%s%s

%s%s%s

# Fatal libcurl error

# Fatal libcurl error

# Netscape HTTP Cookie File

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/rfc/cookie_spec.html

# hXXp://curl.haxx.se/rfc/cookie_spec.html

# This file was generated by libcurl! Edit at your own risk.

# This file was generated by libcurl! Edit at your own risk.

bind failure: %s

bind failure: %s

Local port: %d

Local port: %d

Bind to local port %d failed, trying next

Bind to local port %d failed, trying next

couldn't find my own IP address (%s)

couldn't find my own IP address (%s)

Bind local address to %s

Bind local address to %s

Couldn't bind to '%s'

Couldn't bind to '%s'

TCP_NODELAY set

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Could not set TCP_NODELAY: %s

Failed to connect to %s: %s

Failed to connect to %s: %s

Trying %s...

Trying %s...

Internal error removing splay node = %d

Internal error removing splay node = %d

Internal error clearing splay node = %d

Internal error clearing splay node = %d

Error in the SSH layer

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Illegal operation

TFTP: Access Violation

TFTP: Access Violation

TFTP: File Not Found

TFTP: File Not Found

Login denied

Login denied

Issuer check against peer certificate failed

Issuer check against peer certificate failed

Invalid LDAP URL

Invalid LDAP URL

Unrecognized HTTP Content-Encoding

Unrecognized HTTP Content-Encoding

Problem with the SSL CA cert (path? access rights?)

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with known CA certificates

Peer certificate cannot be authenticated with known CA certificates

Problem with the local SSL certificate

Problem with the local SSL certificate

SSL peer certificate or SSH md5 fingerprint was not OK

SSL peer certificate or SSH md5 fingerprint was not OK

A libcurl function was given a bad argument

A libcurl function was given a bad argument

Operation was aborted by an application callback

Operation was aborted by an application callback

FTP: command REST failed

FTP: command REST failed

FTP: command PORT failed

FTP: command PORT failed

HTTP response code said error

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

FTP: couldn't set file type

FTP: can't figure out the host in the PASV response

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: unknown PASS reply

FTP: weird server reply

FTP: weird server reply

URL using bad/illegal format or missing URL

URL using bad/illegal format or missing URL

Unsupported protocol

Unsupported protocol

Winsock version not supported

Winsock version not supported

Protocol family not supported

Protocol family not supported

Address family not supported

Address family not supported

Operation not supported

Operation not supported

Socket is unsupported

Socket is unsupported

Protocol is unsupported

Protocol is unsupported

Protocol option is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

Unknown error %d (%#x)

Resolving host timed out: %s

Resolving host timed out: %s

Could not resolve host: %s; %s

Could not resolve host: %s; %s

Could not resolve proxy: %s; %s

Could not resolve proxy: %s; %s

Could not resolve host: %s

Could not resolve host: %s

gethostbyname(2) failed for %s:%d; %s

gethostbyname(2) failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

init_resolve_thread() failed for %s; %s

TFTP

TFTP

set timeouts for state %d; Total %d, retry %d maxtry %d

set timeouts for state %d; Total %d, retry %d maxtry %d

tftp_rx: giving up waiting for block %d

tftp_rx: giving up waiting for block %d

Received unexpected DATA packet block %d

Received unexpected DATA packet block %d

Timeout waiting for block %d ACK. Retries = %d

Timeout waiting for block %d ACK. Retries = %d

tftp_rx: internal error

tftp_rx: internal error

tftp_tx: giving up waiting for block %d ack

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

Received ACK for block %d, expecting %d

tftp_tx: internal error

tftp_tx: internal error

bind() failed; %s

bind() failed; %s

tftp_send_first: internal error

tftp_send_first: internal error

%s%c%s%c

%s%c%s%c

TFTP finished

TFTP finished

Can't get the size of %s

Can't get the size of %s

Can't open %s for writing

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

Couldn't open file %s

There are more than %d entries

There are more than %d entries

LDAP remote: %s

LDAP remote: %s

LDAP local: ldap_simple_bind_s %s

LDAP local: ldap_simple_bind_s %s

LDAP local: Cannot connect to %s:%d

LDAP local: Cannot connect to %s:%d

LDAP local: trying to establish %s connection

LDAP local: trying to establish %s connection

LDAP local: %s

LDAP local: %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

CLIENT libcurl 7.19.0

CLIENT libcurl 7.19.0

MATCH %s %s %s

MATCH %s %s %s

DEFINE %s %s

DEFINE %s %s

insufficient winsock version to support telnet

insufficient winsock version to support telnet

WSAStartup failed (%d)

WSAStartup failed (%d)

%s %d %d

%s %d %d

%s %s %d

%s %s %d

%s %s %s

%s %s %s

%s IAC %d

%s IAC %d

%s IAC %s

%s IAC %s

Sending data failed (%d)

Sending data failed (%d)

%d (unknown)

%d (unknown)

%s (unsupported)

%s (unsupported)

%s IAC SB

%s IAC SB

Syntax error in telnet option: %s

Syntax error in telnet option: %s

Unknown telnet option %s

Unknown telnet option %s

7[^= ]%*[ =]%5s

7[^= ]%*[ =]%5s

USER,%s

USER,%s

%c%c%c%c%s%c%c

%c%c%c%c%s%c%c

%c%s%c%s

%c%s%c%s

7[^,],7s

7[^,],7s

%c%c%c%c

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSACloseEvent failed (%d)

WSACreateEvent failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

WS2_32.DLL

Excessive FTP response line length received, %zd bytes. Stripping

Excessive FTP response line length received, %zd bytes. Stripping

FTP response reading failed

FTP response reading failed

FTP response aborted due to select/poll error: %d

FTP response aborted due to select/poll error: %d

FTP response timeout

FTP response timeout

Failed FTP upload:

Failed FTP upload:

RETR response: d

RETR response: d

Connecting to %s (%s) port %d

Connecting to %s (%s) port %d

Uploading to a URL without a file name!

Uploading to a URL without a file name!

FTPS not supported!

FTPS not supported!

USER %s

USER %s

socket(2) failed (%s)

socket(2) failed (%s)

PORT %d,%d,%d,%d,%d,%d

PORT %d,%d,%d,%d,%d,%d

Telling server to connect to %d.%d.%d.%d:%d

Telling server to connect to %d.%d.%d.%d:%d

Failed to resolve host name %s

Failed to resolve host name %s

getsockname() failed: %s

getsockname() failed: %s

Connect data stream passively

Connect data stream passively

REST %d

REST %d

SIZE %s

SIZE %s

STOR %s

STOR %s

APPE %s

APPE %s

Bad PASV/EPSV response: d

Bad PASV/EPSV response: d

Can't resolve new host %s:%d

Can't resolve new host %s:%d

%d.%d.%d.%d

%d.%d.%d.%d

Skips %d.%d.%d.%d for data connection, uses %s instead

Skips %d.%d.%d.%d for data connection, uses %s instead

%d,%d,%d,%d,%d,%d

%d,%d,%d,%d,%d,%d

%c%c%c%u%c

%c%c%c%u%c

Failed to do PORT

Failed to do PORT

Got a d response code instead of the assumed 200

Got a d response code instead of the assumed 200

RETR %s

RETR %s

ftp server doesn't support SIZE

ftp server doesn't support SIZE

PBSZ %d

PBSZ %d

Access denied: d

Access denied: d

ACCT %s

ACCT %s

PASS %s

PASS %s

ACCT rejected by server: d

ACCT rejected by server: d

QUOT string not accepted: %s

QUOT string not accepted: %s

TYPE %c

TYPE %c

MDTM %s

MDTM %s

ddd d:d:d GMT

ddd d:d:d GMT

dddddd

dddddd

unsupported MDTM reply format

unsupported MDTM reply format

server did not report OK, got %d

server did not report OK, got %d

Remembering we are in dir "%s"

Remembering we are in dir "%s"

CWD %s

CWD %s

Failed to MKD dir: d

Failed to MKD dir: d

MKD %s

MKD %s

QUOT command failed with d

QUOT command failed with d

Entry path is '%s'

Entry path is '%s'

PROT %c

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

AUTH %s

AUTH %s

Got a d ftp-server response when 220 was expected

Got a d ftp-server response when 220 was expected

%sAuthorization: Basic %s

%sAuthorization: Basic %s

%s:%s

%s:%s

Server auth using %s with user '%s'

Server auth using %s with user '%s'

Proxy auth using %s with user '%s'

Proxy auth using %s with user '%s'

Failed sending HTTP POST request

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Internal HTTP POST error!

Failed sending HTTP request

Failed sending HTTP request

If-Unmodified-Since: %s

If-Unmodified-Since: %s

Last-Modified: %s

Last-Modified: %s

If-Modified-Since: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

%s, d %s M d:d:d GMT

%s%s=%s

%s%s=%s

%s %s%s HTTP/%s

%s %s%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

%s%s%s%s%s%s%s%s%s%s%s

Content-Range: bytes %s/%lld

Content-Range: bytes %s/%lld

Content-Range: bytes %s%lld/%lld

Content-Range: bytes %s%lld/%lld

Range: bytes=%s

Range: bytes=%s

;type=%c

;type=%c

ftps://

ftps://

PTF://

PTF://

Host: %s%s%s:%d

Host: %s%s%s:%d

Host: %s%s%s

Host: %s%s%s

Accept-Encoding: %s

Accept-Encoding: %s

Referer: %s

Referer: %s

Received HTTP code %d from proxy after CONNECT

Received HTTP code %d from proxy after CONNECT

%d bytes of chunk left

%d bytes of chunk left

HTTP/1.%d %d

HTTP/1.%d %d

Read %d bytes of chunk, continue

Read %d bytes of chunk, continue

CONNECT %s:%d HTTP/1.0

CONNECT %s:%d HTTP/1.0

%s%s%s%s

%s%s%s%s

Host: %s

Host: %s

Establish HTTP proxy tunnel to %s:%d

Establish HTTP proxy tunnel to %s:%d

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Failed to resolve "%s" for SOCKS4 connect.

Failed to resolve "%s" for SOCKS4 connect.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

User was rejected by the SOCKS5 server (%d %d).

SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]

SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]

--:--:--

--:--:--

= %s = %s = %s %s %s %s %s %s %s

= %s = %s = %s %s %s %s %s %s %s

password

password

login

login

Operation too slow. Less than %d bytes/sec transfered the last %d seconds

Operation too slow. Less than %d bytes/sec transfered the last %d seconds

%s, algorithm="%s"

%s, algorithm="%s"

%s, opaque="%s"

%s, opaque="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"

%s:%s:x:%s:%s:%s

%s:%s:x:%s:%s:%s

%s:%s:%s

%s:%s:%s

%5[^=]=23[^

%5[^=]=23[^

%5[^=]="23[^"]"

%5[^=]="23[^"]"

d:d:d

d:d:d

%c%c==

%c%c==

%c%c%c=

%c%c%c=

.html

.html

.jpeg

.jpeg

--%s--

--%s--

Content-Type: %s

Content-Type: %s

; filename="%s"

; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Type: multipart/mixed, boundary=%s

Content-Type: multipart/mixed, boundary=%s

%s; boundary=%s

%s; boundary=%s

()$^.* ?[]|\-{},:=!

()$^.* ?[]|\-{},:=!

:/-_.!~*'()

:/-_.!~*'()

xxxxx

xxxxx

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

GetProcessWindowStation

GetProcessWindowStation

portuguese-brazilian

portuguese-brazilian

operator

operator

()$^.* ?[]|\-{},:=!

()$^.* ?[]|\-{},:=!

Kernel32.DLL

Kernel32.DLL

invalid map key

invalid map key

User-Agent: %s

User-Agent: %s

http/

http/

NOINT_MSG

NOINT_MSG

urls_to_restore_on_startup

urls_to_restore_on_startup

startup_urls

startup_urls

search_url

search_url

keyword

keyword

zcÁ

zcÁ

.?AVHTTPClientImplementation@@

.?AVHTTPClientImplementation@@

.?AVHTTPClientInterface@@

.?AVHTTPClientInterface@@

.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@

.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@

.?AV?$TSpecificFunctor@VWindowsAPI@@@@

.?AV?$TSpecificFunctor@VWindowsAPI@@@@

.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@

.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@

.?AVChromeBrowserHandler@Browser@Lib@Softonic@@

.?AVChromeBrowserHandler@Browser@Lib@Softonic@@

.?AVWindowsAPI@@

.?AVWindowsAPI@@

.?AUDWebBrowserEvents2@@

.?AUDWebBrowserEvents2@@

.?AUIHttpNegotiate@@

.?AUIHttpNegotiate@@

.?AVCustomIHttpNegotiate@@

.?AVCustomIHttpNegotiate@@

.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@

.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@

.?AVCurlMultiDownloadJob@@

.?AVCurlMultiDownloadJob@@

c:\%original file name%.exe

c:\%original file name%.exe

GetCPInfo

GetCPInfo

GetProcessHeap

GetProcessHeap

PeekNamedPipe

PeekNamedPipe

RegCloseKey

RegCloseKey

RegEnumKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegOpenKeyExW

RegDeleteKeyW

RegDeleteKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

ShellExecuteW

ShellExecuteW

ShellExecuteExW

ShellExecuteExW

URLDownloadToFileW

URLDownloadToFileW

UrlMkGetSessionOption

UrlMkGetSessionOption

UrlMkSetSessionOption

UrlMkSetSessionOption

GetAsyncKeyState

GetAsyncKeyState

GetKeyState

GetKeyState

EnumChildWindows

EnumChildWindows

EnumDesktopWindows

EnumDesktopWindows

InternetOpenUrlA

InternetOpenUrlA

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

Universal Downloader Download Helper.

Universal Downloader Download Helper.

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

GDI32.dll

GDI32.dll

gdiplus.dll

gdiplus.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

PSAPI.DLL

PSAPI.DLL

RPCRT4.dll

RPCRT4.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

urlmon.dll

urlmon.dll

USER32.dll

USER32.dll

VERSION.dll

VERSION.dll

WININET.dll

WININET.dll

WLDAP32.dll

WLDAP32.dll

WSOCK32.dll

WSOCK32.dll

[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://fifa-online-2.sd.softonic.com/3332176/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No se ha detectado conexi

[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://fifa-online-2.sd.softonic.com/3332176/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No se ha detectado conexi

n a Internet[ENDVALUE][KEY]NOINT_MSG[VALUE]Se necesita conexi

n a Internet[ENDVALUE][KEY]NOINT_MSG[VALUE]Se necesita conexi

ntalo de nuevo. [ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[ENDVALUE][KEY]LOADING_DIALOG_TEXT[VALUE]Por favor, espere...[ENDVALUE][KEY]LOADING_DIALOG_TITLE[VALUE]Descarga e instalaci

ntalo de nuevo. [ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[ENDVALUE][KEY]LOADING_DIALOG_TEXT[VALUE]Por favor, espere...[ENDVALUE][KEY]LOADING_DIALOG_TITLE[VALUE]Descarga e instalaci

n de FIFA Online 2[ENDVALUE][KEY]MIN_BUTTON_SIZE_X[VALUE]18[ENDVALUE][KEY]MIN_BUTTON_SIZE_Y[VALUE]17[ENDVALUE][KEY]MIN_PROGRAM_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRAM_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_X[VALUE]222[ENDVALUE][KEY]MIN_PROGRESS_BAR_SI_

n de FIFA Online 2[ENDVALUE][KEY]MIN_BUTTON_SIZE_X[VALUE]18[ENDVALUE][KEY]MIN_BUTTON_SIZE_Y[VALUE]17[ENDVALUE][KEY]MIN_PROGRAM_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRAM_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_X[VALUE]222[ENDVALUE][KEY]MIN_PROGRESS_BAR_SI_

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

%original file name%.exe

%original file name%.exe

hXXp://mersinescortlari.com/logo.gif

hXXp://mersinescortlari.com/logo.gif

hXXp://VVV.plsexpress.com/images/logo.gif

hXXp://VVV.plsexpress.com/images/logo.gif

hXXp://paepailin.com/logo.gif

hXXp://paepailin.com/logo.gif

hXXp://deresut.com/logo.gif

hXXp://deresut.com/logo.gif

hXXp://smtrofeus.com.br/logo.gif

hXXp://smtrofeus.com.br/logo.gif

hXXp://nbfix.net/logo.gif

hXXp://nbfix.net/logo.gif

hXXp://refkajparis.fr/logo.gif

hXXp://refkajparis.fr/logo.gif

logo.gif

logo.gif

hXXp://wingmakershope.za.pl/images/button.gif

hXXp://wingmakershope.za.pl/images/button.gif

hXXp://wellssmall.com/images/logo.gif

hXXp://wellssmall.com/images/logo.gif

hXXp://VVV.uehsi.de/logo.gif

hXXp://VVV.uehsi.de/logo.gif

hXXp://hotelispb.hop.ru/image/logo.gif

hXXp://hotelispb.hop.ru/image/logo.gif

.info/J

.info/J

home.gifI888

home.gifI888

KERNEL32.dll

KERNEL32.dll

h.rata

h.rata

Bkrnl.exe?

Bkrnl.exe?

= =$=(=,=

= =$=(=,=

322%2`.50728)

322%2`.50728)

.klkjw:9fqwi

.klkjw:9fqwi

FamXf39.sys

FamXf39.sys

.pBTa8

.pBTa8

%s:*:

%s:*:

Bg.laXV

Bg.laXV

&?%x=

&?%x=

GUrlA'

GUrlA'

Web%w|nc

Web%w|nc

HTTP)

HTTP)

2GUARDCMD.

2GUARDCMD.

.ENHCDM

.ENHCDM

PL/KPCKwWEB

PL/KPCKwWEB

MM.PFW.

MM.PFW.

.bssf

.bssf

J:CRT

J:CRT

MSVCRT.dll

MSVCRT.dll

WS2_32.dll

WS2_32.dll

SHFileOperationA

SHFileOperationA

H[%s] %s

H[%s] %s

[%d][%s|%s][%s][%s]

[%d][%s|%s][%s][%s]

[%d][%s|%s][%s][%s][%s]

[%d][%s|%s][%s][%s][%s]

Glog.txt

Glog.txt

HKERNEL32.DLL

HKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

mscoree.dll

mscoree.dll

WUSER32.DLL

WUSER32.DLL

.temp

.temp

Ld-d-d

Ld-d-d

[%d] [%lld|%lld]

[%d] [%lld|%lld]

1.41.3

1.41.3

Got Elevation URL. [%s]

Got Elevation URL. [%s]

New URL was not valid.

New URL was not valid.

@Received message %s

@Received message %s

xxxxxxxxxxx

xxxxxxxxxxx

explorer.exe "

explorer.exe "

[%d %d]

[%d %d]

Hchrome

Hchrome

firefox

firefox

0.0.0.0

0.0.0.0

Web View

Web View

Web Host

Web Host

%d|%d|%d

%d|%d|%d

errorUrl

errorUrl

%s(%s)

%s(%s)

%s --> (%s)

%s --> (%s)

.swf?

.swf?

.jpg?

.jpg?

.gif?

.gif?

.png?

.png?

Value: %d

Value: %d

%s\*.*

%s\*.*

%s\%s

%s\%s

Proxy by URL are not supported.

Proxy by URL are not supported.

Automatic proxy discovery are not supported.

Automatic proxy discovery are not supported.

http=

http=

https=

https=

CPTF://

CPTF://

- URL:

- URL:

[%d] Starting thread...

[%d] Starting thread...

[%d] Thread Creation OK!

[%d] Thread Creation OK!

[%d] Error creating thread! trying again...

[%d] Error creating thread! trying again...

[%d] Thread started...

[%d] Thread started...

Bhttp/

Bhttp/

%d - [%d][%lld/%lld][%lld]

%d - [%d][%lld/%lld][%lld]

json_writer.cpp

json_writer.cpp

Hjson_value.cpp

Hjson_value.cpp

Software\Classes\http\shell\open\command\

Software\Classes\http\shell\open\command\

http\shell\open\command\

http\shell\open\command\

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\

chrome.exe

chrome.exe

iexplore.exe

iexplore.exe

firefox.exe

firefox.exe

opera.exe

opera.exe

opera

opera

safari.ex

safari.ex

browser.startup.homepage

browser.startup.homepage

browser.search.order.1

browser.search.order.1

browser.search.order.2

browser.search.order.2

browser.search.order.3

browser.search.order.3

prefs.js

prefs.js

\"(.)*.;

\"(.)*.;

browser.search.selectedEngine

browser.search.selectedEngine

browser.search.defaultenginename

browser.search.defaultenginename

browser.search.useDBForOrder

browser.search.useDBForOrder

user_pref("browser.search.useDBForOrder", "false");

user_pref("browser.search.useDBForOrder", "false");

browser.search.useDBForOrder", "false");

browser.search.useDBForOrder", "false");

browser.search.useDBForOrder.*

browser.search.useDBForOrder.*

%s*.*

%s*.*

Software\Mozilla\Mozilla Firefox\

Software\Mozilla\Mozilla Firefox\

\Google\Chrome

\Google\Chrome

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

SOFTWARE\Mozilla\Mozilla Firefox\

PathToExe

PathToExe

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

\Mozilla\Firefox\

\search-metadata.json

\search-metadata.json

ljson_reader.cpp

ljson_reader.cpp

log.txt

log.txt

Assertion failed: %s, file %s, line %d

Assertion failed: %s, file %s, line %d

1.41.3.5

1.41.3.5

SoftonicDownloader.exe

SoftonicDownloader.exe

%original file name%.exe_304_rwx_00401000_000F7000:

PSSSSSSh

PSSSSSSh

PSSSSh

PSSSSh

u.hL?L

u.hL?L

F><.tn>

F><.tn>

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

88888888888888888

88888888888888888

%u$Vj%

%u$Vj%

t.Gj:W

t.Gj:W

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

[%s %s %s]

[%s %s %s]

Send failure: %s

Send failure: %s

Failed writing body (%d != %d)

Failed writing body (%d != %d)

%s:%d

%s:%d

WARNING: failed to save cookies in %s

WARNING: failed to save cookies in %s

About to connect() to %s%s port %d (#%d)

About to connect() to %s%s port %d (#%d)

Connected to %s (%s) port %d (#%d)

Connected to %s (%s) port %d (#%d)

malformed

malformed

:]://%[^

:]://%[^

[^:]:%[^

[^:]:%[^

Protocol %s not supported or disabled in libcurl

Protocol %s not supported or disabled in libcurl

http_proxy

http_proxy

%5[^:@]:%5[^@]

%5[^:@]:%5[^@]

%5[^:]:%5[^

%5[^:]:%5[^

:%5[^@]

:%5[^@]

Port number too large: %lu

Port number too large: %lu

%s://%s%s%s:%d%s%s

%s://%s%s%s:%d%s%s

ftps

ftps

[%*39[0123456789abcdefABCDEF:.%]%c

[%*39[0123456789abcdefABCDEF:.%]%c

Couldn't find host %s in the _netrc file; using defaults

Couldn't find host %s in the _netrc file; using defaults

PTF@example.com

PTF@example.com

Couldn't resolve host '%s'

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

Couldn't resolve proxy '%s'

Connection #%d seems to be dead!

Connection #%d seems to be dead!

Connection (#%d) was killed to make room (holds %d)

Connection (#%d) was killed to make room (holds %d)

Re-using existing connection! (#%ld) with host %s

Re-using existing connection! (#%ld) with host %s

%s://%s

%s://%s

Connection #%ld to host %s left intact

Connection #%ld to host %s left intact

operation aborted by callback

operation aborted by callback

HTTP/

HTTP/

ioctl callback returned error %d

ioctl callback returned error %d

the ioctl callback returned %d

the ioctl callback returned %d

seek callback returned error %d

seek callback returned error %d

The requested URL returned error: %d

The requested URL returned error: %d

HTTP/1.0 connection set to keep alive!

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

HTTP 1.0, assume close after body

HTTP =

HTTP =

HTTP/%d.%d =

HTTP/%d.%d =

No URL set!

No URL set!

[^?&/:]://%c

[^?&/:]://%c

Violate RFC 2616/10.3.2 and switch from POST to GET

Violate RFC 2616/10.3.2 and switch from POST to GET

Disables POST, goes with %s

Disables POST, goes with %s

Issue another request to this URL: '%s'

Issue another request to this URL: '%s'

Maximum (%d) redirects followed

Maximum (%d) redirects followed

Received problem %d in the chunky parser

Received problem %d in the chunky parser

HTTP server doesn't seem to support byte ranges. Cannot resume.

HTTP server doesn't seem to support byte ranges. Cannot resume.

Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)

Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)

Leftovers after chunking. Rewinding %d bytes

Leftovers after chunking. Rewinding %d bytes

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

unspecified error %d

unspecified error %d

%s cookie %s="%s" for domain %s, path %s, expire %d

%s cookie %s="%s" for domain %s, path %s, expire %d

#HttpOnly_

#HttpOnly_

httponly

httponly

I99[^;

I99[^;

skipped cookie with bad tailmatch domain: %s

skipped cookie with bad tailmatch domain: %s

skipped cookie with illegal dotcount domain: %s

skipped cookie with illegal dotcount domain: %s

23[^;=]=I99[^;

23[^;=]=I99[^;

%s%s%s

%s%s%s

# Fatal libcurl error

# Fatal libcurl error

# Netscape HTTP Cookie File

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/rfc/cookie_spec.html

# hXXp://curl.haxx.se/rfc/cookie_spec.html

# This file was generated by libcurl! Edit at your own risk.

# This file was generated by libcurl! Edit at your own risk.

bind failure: %s

bind failure: %s

Local port: %d

Local port: %d

Bind to local port %d failed, trying next

Bind to local port %d failed, trying next

couldn't find my own IP address (%s)

couldn't find my own IP address (%s)

Bind local address to %s

Bind local address to %s

Couldn't bind to '%s'

Couldn't bind to '%s'

TCP_NODELAY set

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Could not set TCP_NODELAY: %s

Failed to connect to %s: %s

Failed to connect to %s: %s

Trying %s...

Trying %s...

Internal error removing splay node = %d

Internal error removing splay node = %d

Internal error clearing splay node = %d

Internal error clearing splay node = %d

Error in the SSH layer

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Illegal operation

TFTP: Access Violation

TFTP: Access Violation

TFTP: File Not Found

TFTP: File Not Found

Login denied

Login denied

Issuer check against peer certificate failed

Issuer check against peer certificate failed

Invalid LDAP URL

Invalid LDAP URL

Unrecognized HTTP Content-Encoding

Unrecognized HTTP Content-Encoding

Problem with the SSL CA cert (path? access rights?)

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with known CA certificates

Peer certificate cannot be authenticated with known CA certificates

Problem with the local SSL certificate

Problem with the local SSL certificate

SSL peer certificate or SSH md5 fingerprint was not OK

SSL peer certificate or SSH md5 fingerprint was not OK

A libcurl function was given a bad argument

A libcurl function was given a bad argument

Operation was aborted by an application callback

Operation was aborted by an application callback

FTP: command REST failed

FTP: command REST failed

FTP: command PORT failed

FTP: command PORT failed

HTTP response code said error

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

FTP: couldn't set file type

FTP: can't figure out the host in the PASV response

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: unknown PASS reply

FTP: weird server reply

FTP: weird server reply

URL using bad/illegal format or missing URL

URL using bad/illegal format or missing URL

Unsupported protocol

Unsupported protocol

Winsock version not supported

Winsock version not supported

Protocol family not supported

Protocol family not supported

Address family not supported

Address family not supported

Operation not supported

Operation not supported

Socket is unsupported

Socket is unsupported

Protocol is unsupported

Protocol is unsupported

Protocol option is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

Unknown error %d (%#x)

Resolving host timed out: %s

Resolving host timed out: %s

Could not resolve host: %s; %s

Could not resolve host: %s; %s

Could not resolve proxy: %s; %s

Could not resolve proxy: %s; %s

Could not resolve host: %s

Could not resolve host: %s

gethostbyname(2) failed for %s:%d; %s

gethostbyname(2) failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

init_resolve_thread() failed for %s; %s

TFTP

TFTP

set timeouts for state %d; Total %d, retry %d maxtry %d

set timeouts for state %d; Total %d, retry %d maxtry %d

tftp_rx: giving up waiting for block %d

tftp_rx: giving up waiting for block %d

Received unexpected DATA packet block %d

Received unexpected DATA packet block %d

Timeout waiting for block %d ACK. Retries = %d

Timeout waiting for block %d ACK. Retries = %d

tftp_rx: internal error

tftp_rx: internal error

tftp_tx: giving up waiting for block %d ack

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

Received ACK for block %d, expecting %d

tftp_tx: internal error

tftp_tx: internal error

bind() failed; %s

bind() failed; %s

tftp_send_first: internal error

tftp_send_first: internal error

%s%c%s%c

%s%c%s%c

TFTP finished

TFTP finished

Can't get the size of %s

Can't get the size of %s

Can't open %s for writing

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

Couldn't open file %s

There are more than %d entries

There are more than %d entries

LDAP remote: %s

LDAP remote: %s

LDAP local: ldap_simple_bind_s %s

LDAP local: ldap_simple_bind_s %s

LDAP local: Cannot connect to %s:%d

LDAP local: Cannot connect to %s:%d

LDAP local: trying to establish %s connection

LDAP local: trying to establish %s connection

LDAP local: %s

LDAP local: %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

CLIENT libcurl 7.19.0

CLIENT libcurl 7.19.0

MATCH %s %s %s

MATCH %s %s %s

DEFINE %s %s

DEFINE %s %s

insufficient winsock version to support telnet

insufficient winsock version to support telnet

WSAStartup failed (%d)

WSAStartup failed (%d)

%s %d %d

%s %d %d

%s %s %d

%s %s %d

%s %s %s

%s %s %s

%s IAC %d

%s IAC %d

%s IAC %s

%s IAC %s

Sending data failed (%d)

Sending data failed (%d)

%d (unknown)

%d (unknown)

%s (unsupported)

%s (unsupported)

%s IAC SB

%s IAC SB

Syntax error in telnet option: %s

Syntax error in telnet option: %s

Unknown telnet option %s

Unknown telnet option %s

7[^= ]%*[ =]%5s

7[^= ]%*[ =]%5s

USER,%s

USER,%s

%c%c%c%c%s%c%c

%c%c%c%c%s%c%c

%c%s%c%s

%c%s%c%s

7[^,],7s

7[^,],7s

%c%c%c%c

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSACloseEvent failed (%d)

WSACreateEvent failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

WS2_32.DLL

Excessive FTP response line length received, %zd bytes. Stripping

Excessive FTP response line length received, %zd bytes. Stripping

FTP response reading failed

FTP response reading failed

FTP response aborted due to select/poll error: %d

FTP response aborted due to select/poll error: %d

FTP response timeout

FTP response timeout

Failed FTP upload:

Failed FTP upload:

RETR response: d

RETR response: d

Connecting to %s (%s) port %d

Connecting to %s (%s) port %d

Uploading to a URL without a file name!

Uploading to a URL without a file name!

FTPS not supported!

FTPS not supported!

USER %s

USER %s

socket(2) failed (%s)

socket(2) failed (%s)

PORT %d,%d,%d,%d,%d,%d

PORT %d,%d,%d,%d,%d,%d

Telling server to connect to %d.%d.%d.%d:%d

Telling server to connect to %d.%d.%d.%d:%d

Failed to resolve host name %s

Failed to resolve host name %s

getsockname() failed: %s

getsockname() failed: %s

Connect data stream passively

Connect data stream passively

REST %d

REST %d

SIZE %s

SIZE %s

STOR %s

STOR %s

APPE %s

APPE %s

Bad PASV/EPSV response: d

Bad PASV/EPSV response: d

Can't resolve new host %s:%d

Can't resolve new host %s:%d

%d.%d.%d.%d

%d.%d.%d.%d

Skips %d.%d.%d.%d for data connection, uses %s instead

Skips %d.%d.%d.%d for data connection, uses %s instead

%d,%d,%d,%d,%d,%d

%d,%d,%d,%d,%d,%d

%c%c%c%u%c

%c%c%c%u%c

Failed to do PORT

Failed to do PORT

Got a d response code instead of the assumed 200

Got a d response code instead of the assumed 200

RETR %s

RETR %s

ftp server doesn't support SIZE

ftp server doesn't support SIZE

PBSZ %d

PBSZ %d

Access denied: d

Access denied: d

ACCT %s

ACCT %s

PASS %s

PASS %s

ACCT rejected by server: d

ACCT rejected by server: d

QUOT string not accepted: %s

QUOT string not accepted: %s

TYPE %c

TYPE %c

MDTM %s

MDTM %s

ddd d:d:d GMT

ddd d:d:d GMT

dddddd

dddddd

unsupported MDTM reply format

unsupported MDTM reply format

server did not report OK, got %d

server did not report OK, got %d

Remembering we are in dir "%s"

Remembering we are in dir "%s"

CWD %s

CWD %s

Failed to MKD dir: d

Failed to MKD dir: d

MKD %s

MKD %s

QUOT command failed with d

QUOT command failed with d

Entry path is '%s'

Entry path is '%s'

PROT %c

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

AUTH %s

AUTH %s

Got a d ftp-server response when 220 was expected

Got a d ftp-server response when 220 was expected

%sAuthorization: Basic %s

%sAuthorization: Basic %s

%s:%s

%s:%s

Server auth using %s with user '%s'

Server auth using %s with user '%s'

Proxy auth using %s with user '%s'

Proxy auth using %s with user '%s'

Failed sending HTTP POST request

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Internal HTTP POST error!

Failed sending HTTP request

Failed sending HTTP request

If-Unmodified-Since: %s

If-Unmodified-Since: %s

Last-Modified: %s

Last-Modified: %s

If-Modified-Since: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

%s, d %s M d:d:d GMT

%s%s=%s

%s%s=%s

%s %s%s HTTP/%s

%s %s%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

%s%s%s%s%s%s%s%s%s%s%s

Content-Range: bytes %s/%lld

Content-Range: bytes %s/%lld

Content-Range: bytes %s%lld/%lld

Content-Range: bytes %s%lld/%lld

Range: bytes=%s

Range: bytes=%s

;type=%c

;type=%c

ftps://

ftps://

PTF://

PTF://

Host: %s%s%s:%d

Host: %s%s%s:%d

Host: %s%s%s

Host: %s%s%s

Accept-Encoding: %s

Accept-Encoding: %s

Referer: %s

Referer: %s

Received HTTP code %d from proxy after CONNECT

Received HTTP code %d from proxy after CONNECT

%d bytes of chunk left

%d bytes of chunk left

HTTP/1.%d %d

HTTP/1.%d %d

Read %d bytes of chunk, continue

Read %d bytes of chunk, continue

CONNECT %s:%d HTTP/1.0

CONNECT %s:%d HTTP/1.0

%s%s%s%s

%s%s%s%s

Host: %s

Host: %s

Establish HTTP proxy tunnel to %s:%d

Establish HTTP proxy tunnel to %s:%d

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Failed to resolve "%s" for SOCKS4 connect.

Failed to resolve "%s" for SOCKS4 connect.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

User was rejected by the SOCKS5 server (%d %d).

SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]

SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]

--:--:--

--:--:--

= %s = %s = %s %s %s %s %s %s %s

= %s = %s = %s %s %s %s %s %s %s

password

password

login

login

Operation too slow. Less than %d bytes/sec transfered the last %d seconds

Operation too slow. Less than %d bytes/sec transfered the last %d seconds

%s, algorithm="%s"

%s, algorithm="%s"

%s, opaque="%s"

%s, opaque="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"

%s:%s:x:%s:%s:%s

%s:%s:x:%s:%s:%s

%s:%s:%s

%s:%s:%s

%5[^=]=23[^

%5[^=]=23[^

%5[^=]="23[^"]"

%5[^=]="23[^"]"

d:d:d

d:d:d

%c%c==

%c%c==

%c%c%c=

%c%c%c=

.html

.html

.jpeg

.jpeg

--%s--

--%s--

Content-Type: %s

Content-Type: %s

; filename="%s"

; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Type: multipart/mixed, boundary=%s

Content-Type: multipart/mixed, boundary=%s

%s; boundary=%s

%s; boundary=%s

()$^.* ?[]|\-{},:=!

()$^.* ?[]|\-{},:=!

:/-_.!~*'()

:/-_.!~*'()

xxxxx

xxxxx

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

GetProcessWindowStation

GetProcessWindowStation

portuguese-brazilian

portuguese-brazilian

operator

operator

()$^.* ?[]|\-{},:=!

()$^.* ?[]|\-{},:=!

Kernel32.DLL

Kernel32.DLL

invalid map key

invalid map key

User-Agent: %s

User-Agent: %s

http/

http/

NOINT_MSG

NOINT_MSG

urls_to_restore_on_startup

urls_to_restore_on_startup

startup_urls

startup_urls

search_url

search_url

keyword

keyword

zcÁ

zcÁ

.?AVHTTPClientImplementation@@

.?AVHTTPClientImplementation@@

.?AVHTTPClientInterface@@

.?AVHTTPClientInterface@@

.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@

.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@

.?AV?$TSpecificFunctor@VWindowsAPI@@@@

.?AV?$TSpecificFunctor@VWindowsAPI@@@@

.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@

.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@

.?AVChromeBrowserHandler@Browser@Lib@Softonic@@

.?AVChromeBrowserHandler@Browser@Lib@Softonic@@

.?AVWindowsAPI@@

.?AVWindowsAPI@@

.?AUDWebBrowserEvents2@@

.?AUDWebBrowserEvents2@@

.?AUIHttpNegotiate@@

.?AUIHttpNegotiate@@

.?AVCustomIHttpNegotiate@@

.?AVCustomIHttpNegotiate@@

.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@

.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@

.?AVCurlMultiDownloadJob@@

.?AVCurlMultiDownloadJob@@

c:\%original file name%.exe

c:\%original file name%.exe

GetCPInfo

GetCPInfo

GetProcessHeap

GetProcessHeap

PeekNamedPipe

PeekNamedPipe

RegCloseKey

RegCloseKey

RegEnumKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegOpenKeyExW

RegDeleteKeyW

RegDeleteKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

ShellExecuteW

ShellExecuteW

ShellExecuteExW

ShellExecuteExW

URLDownloadToFileW

URLDownloadToFileW

UrlMkGetSessionOption

UrlMkGetSessionOption

UrlMkSetSessionOption

UrlMkSetSessionOption

GetAsyncKeyState

GetAsyncKeyState

GetKeyState

GetKeyState

EnumChildWindows

EnumChildWindows

EnumDesktopWindows

EnumDesktopWindows

InternetOpenUrlA

InternetOpenUrlA

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

H[%s] %s

H[%s] %s

[%d][%s|%s][%s][%s]

[%d][%s|%s][%s][%s]

[%d][%s|%s][%s][%s][%s]

[%d][%s|%s][%s][%s][%s]

Glog.txt

Glog.txt

HKERNEL32.DLL

HKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

mscoree.dll

mscoree.dll

WUSER32.DLL

WUSER32.DLL

.temp

.temp

Ld-d-d

Ld-d-d

[%d] [%lld|%lld]

[%d] [%lld|%lld]

1.41.3

1.41.3

Got Elevation URL. [%s]

Got Elevation URL. [%s]

New URL was not valid.

New URL was not valid.

@Received message %s

@Received message %s

xxxxxxxxxxx

xxxxxxxxxxx

explorer.exe "

explorer.exe "

[%d %d]

[%d %d]

Hchrome

Hchrome

firefox

firefox

0.0.0.0

0.0.0.0

Web View

Web View

Web Host

Web Host

%d|%d|%d

%d|%d|%d

errorUrl

errorUrl

%s(%s)

%s(%s)

%s --> (%s)

%s --> (%s)

.swf?

.swf?

.jpg?

.jpg?

.gif?

.gif?

.png?

.png?

Value: %d

Value: %d

%s\*.*

%s\*.*

%s\%s

%s\%s

Proxy by URL are not supported.

Proxy by URL are not supported.

Automatic proxy discovery are not supported.

Automatic proxy discovery are not supported.

http=

http=

https=

https=

CPTF://

CPTF://

- URL:

- URL:

[%d] Starting thread...

[%d] Starting thread...

[%d] Thread Creation OK!

[%d] Thread Creation OK!

[%d] Error creating thread! trying again...

[%d] Error creating thread! trying again...

[%d] Thread started...

[%d] Thread started...

Bhttp/

Bhttp/

%d - [%d][%lld/%lld][%lld]

%d - [%d][%lld/%lld][%lld]

json_writer.cpp

json_writer.cpp

Hjson_value.cpp

Hjson_value.cpp

Software\Classes\http\shell\open\command\

Software\Classes\http\shell\open\command\

http\shell\open\command\

http\shell\open\command\

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\

chrome.exe

chrome.exe

iexplore.exe

iexplore.exe

firefox.exe

firefox.exe

opera.exe

opera.exe

opera

opera

safari.ex

safari.ex

browser.startup.homepage

browser.startup.homepage

browser.search.order.1

browser.search.order.1

browser.search.order.2

browser.search.order.2

browser.search.order.3

browser.search.order.3

prefs.js

prefs.js

\"(.)*.;

\"(.)*.;

browser.search.selectedEngine

browser.search.selectedEngine

browser.search.defaultenginename

browser.search.defaultenginename

browser.search.useDBForOrder

browser.search.useDBForOrder

user_pref("browser.search.useDBForOrder", "false");

user_pref("browser.search.useDBForOrder", "false");

browser.search.useDBForOrder", "false");

browser.search.useDBForOrder", "false");

browser.search.useDBForOrder.*

browser.search.useDBForOrder.*

%s*.*

%s*.*

Software\Mozilla\Mozilla Firefox\

Software\Mozilla\Mozilla Firefox\

\Google\Chrome

\Google\Chrome

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

SOFTWARE\Mozilla\Mozilla Firefox\

PathToExe

PathToExe

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

\Mozilla\Firefox\

\search-metadata.json

\search-metadata.json

ljson_reader.cpp

ljson_reader.cpp

log.txt

log.txt

Assertion failed: %s, file %s, line %d

Assertion failed: %s, file %s, line %d

%original file name%.exe_304_rwx_004FB000_00001000:

Universal Downloader Download Helper.

Universal Downloader Download Helper.

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

GDI32.dll

GDI32.dll

gdiplus.dll

gdiplus.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

PSAPI.DLL

PSAPI.DLL

RPCRT4.dll

RPCRT4.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

urlmon.dll

urlmon.dll

USER32.dll

USER32.dll

VERSION.dll

VERSION.dll

WININET.dll

WININET.dll

WLDAP32.dll

WLDAP32.dll

WSOCK32.dll

WSOCK32.dll

URLDownloadToFileW

URLDownloadToFileW

[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://fifa-online-2.sd.softonic.com/3332176/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No se ha detectado conexi

[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://fifa-online-2.sd.softonic.com/3332176/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No se ha detectado conexi

n a Internet[ENDVALUE][KEY]NOINT_MSG[VALUE]Se necesita conexi

n a Internet[ENDVALUE][KEY]NOINT_MSG[VALUE]Se necesita conexi

ntalo de nuevo. [ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[ENDVALUE][KEY]LOADING_DIALOG_TEXT[VALUE]Por favor, espere...[ENDVALUE][KEY]LOADING_DIALOG_TITLE[VALUE]Descarga e instalaci

ntalo de nuevo. [ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[ENDVALUE][KEY]LOADING_DIALOG_TEXT[VALUE]Por favor, espere...[ENDVALUE][KEY]LOADING_DIALOG_TITLE[VALUE]Descarga e instalaci

n de FIFA Online 2[ENDVALUE][KEY]MIN_BUTTON_SIZE_X[VALUE]18[ENDVALUE][KEY]MIN_BUTTON_SIZE_Y[VALUE]17[ENDVALUE][KEY]MIN_PROGRAM_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRAM_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_X[VALUE]222[ENDVALUE][KEY]MIN_PROGRESS_BAR_SI

n de FIFA Online 2[ENDVALUE][KEY]MIN_BUTTON_SIZE_X[VALUE]18[ENDVALUE][KEY]MIN_BUTTON_SIZE_Y[VALUE]17[ENDVALUE][KEY]MIN_PROGRAM_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRAM_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_X[VALUE]222[ENDVALUE][KEY]MIN_PROGRESS_BAR_SI

1.41.3.5

1.41.3.5

SoftonicDownloader.exe

SoftonicDownloader.exe

%original file name%.exe_304_rwx_004FD000_00010000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

%original file name%.exe

%original file name%.exe

.rsrc

.rsrc

c:\%original file name%.exe

c:\%original file name%.exe

hXXp://mersinescortlari.com/logo.gif

hXXp://mersinescortlari.com/logo.gif

hXXp://VVV.plsexpress.com/images/logo.gif

hXXp://VVV.plsexpress.com/images/logo.gif

hXXp://paepailin.com/logo.gif

hXXp://paepailin.com/logo.gif

hXXp://deresut.com/logo.gif

hXXp://deresut.com/logo.gif

hXXp://smtrofeus.com.br/logo.gif

hXXp://smtrofeus.com.br/logo.gif

hXXp://nbfix.net/logo.gif

hXXp://nbfix.net/logo.gif

hXXp://refkajparis.fr/logo.gif

hXXp://refkajparis.fr/logo.gif

logo.gif

logo.gif

hXXp://wingmakershope.za.pl/images/button.gif

hXXp://wingmakershope.za.pl/images/button.gif

hXXp://wellssmall.com/images/logo.gif

hXXp://wellssmall.com/images/logo.gif

hXXp://VVV.uehsi.de/logo.gif

hXXp://VVV.uehsi.de/logo.gif

hXXp://hotelispb.hop.ru/image/logo.gif

hXXp://hotelispb.hop.ru/image/logo.gif

.info/J

.info/J

home.gifI888

home.gifI888

.text

.text

KERNEL32.dll

KERNEL32.dll

h.rata

h.rata

Bkrnl.exe?

Bkrnl.exe?

= =$=(=,=

= =$=(=,=

322%2`.50728)

322%2`.50728)

.klkjw:9fqwi

.klkjw:9fqwi

FamXf39.sys

FamXf39.sys

.pBTa8

.pBTa8

%s:*:

%s:*:

Bg.laXV

Bg.laXV

&?%x=

&?%x=

GUrlA'

GUrlA'

Web%w|nc

Web%w|nc

HTTP)

HTTP)

2GUARDCMD.

2GUARDCMD.

.ENHCDM

.ENHCDM

PL/KPCKwWEB

PL/KPCKwWEB

MM.PFW.

MM.PFW.

.bssf

.bssf

J:CRT

J:CRT

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll

RegCloseKey

RegCloseKey

SHFileOperationA

SHFileOperationA

%original file name%.exe_304_rwx_00B10000_0108E000:

c:\windows

c:\windows

hXXp://mersinescortlari.com/logo.gif

hXXp://mersinescortlari.com/logo.gif

hXXp://VVV.plsexpress.com/images/logo.gif

hXXp://VVV.plsexpress.com/images/logo.gif

hXXp://paepailin.com/logo.gif

hXXp://paepailin.com/logo.gif

hXXp://deresut.com/logo.gif

hXXp://deresut.com/logo.gif

hXXp://smtrofeus.com.br/logo.gif

hXXp://smtrofeus.com.br/logo.gif

hXXp://nbfix.net/logo.gif

hXXp://nbfix.net/logo.gif

hXXp://refkajparis.fr/logo.gif

hXXp://refkajparis.fr/logo.gif

%System%\drivers\kkrmj.sys

%System%\drivers\kkrmj.sys

5243598142

5243598142

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.rsrc

.rsrc

hXXp://89.119.67.154/testo5/

hXXp://89.119.67.154/testo5/

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet987.info/home.gif

hXXp://kukutrustnet987.info/home.gif

.text

.text

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

h.rdata

h.rdata

H.data

H.data

.reloc

.reloc

ntoskrnl.exe

ntoskrnl.exe

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://kukutrustnet777888.info/

hXXp://kukutrustnet777888.info/

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\ShellNoRoam\MUICache

Software\Microsoft\Windows\ShellNoRoam\MUICache

%s:*:Enabled:ipsec

%s:*:Enabled:ipsec

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

GdiPlus.dll

GdiPlus.dll

hXXp://

hXXp://

ipfltdrv.sys

ipfltdrv.sys

VVV.microsoft.com

VVV.microsoft.com

?%x=%d

?%x=%d

&%x=%d

&%x=%d

SYSTEM.INI

SYSTEM.INI

USER32.DLL

USER32.DLL

.%c%s

.%c%s

\\.\amsint32

\\.\amsint32

NTDLL.DLL

NTDLL.DLL

autorun.inf

autorun.inf

ADVAPI32.DLL

ADVAPI32.DLL

win%s.exe

win%s.exe

%s.exe

%s.exe

WININET.DLL

WININET.DLL

InternetOpenUrlA

InternetOpenUrlA

avast! Web Scanner

avast! Web Scanner

Avira AntiVir Premium WebGuard

Avira AntiVir Premium WebGuard

cmdGuard

cmdGuard

cmdAgent

cmdAgent

Eset HTTP Server

Eset HTTP Server

ProtoPort Firewall service

ProtoPort Firewall service

SpIDer FS Monitor for Windows NT

SpIDer FS Monitor for Windows NT

Symantec Password Validation

Symantec Password Validation

WebrootDesktopFirewallDataService

WebrootDesktopFirewallDataService

WebrootFirewall

WebrootFirewall

%d%d.tmp

%d%d.tmp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

%s\%s

%s\%s

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Explorer.exe

Explorer.exe

A2CMD.

A2CMD.

ASHWEBSV.

ASHWEBSV.

AVGCC.AVGCHSVX.

AVGCC.AVGCHSVX.

DRWEB

DRWEB

DWEBLLIO

DWEBLLIO

DWEBIO

DWEBIO

FSGUIEXE.

FSGUIEXE.

MCVSSHLD.

MCVSSHLD.

NPFMSG.

NPFMSG.

SYMSPORT.

SYMSPORT.

WEBSCANX.

WEBSCANX.

.adata

.adata

M_%d_

M_%d_

%c%d_%d

%c%d_%d

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

GetProcessHeap

GetProcessHeap

GetWindowsDirectoryA

GetWindowsDirectoryA

RegEnumKeyExA

RegEnumKeyExA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyA

RegCreateKeyA

RegCloseKey

RegCloseKey

SHFileOperationA

SHFileOperationA

&3&3&3&389

&3&3&3&389

.rdata

.rdata

.data

.data

Bkrnl.exe?

Bkrnl.exe?

= =$=(=,=

= =$=(=,=

322%2`.50728)

322%2`.50728)

.klkjw:9fqwi

.klkjw:9fqwi

FamXf39.sys

FamXf39.sys

.pBTa8

.pBTa8

%s:*:

%s:*:

Bg.laXV

Bg.laXV

&?%x=

&?%x=

GUrlA'

GUrlA'

Web%w|nc

Web%w|nc

HTTP)

HTTP)

2GUARDCMD.

2GUARDCMD.

.ENHCDM

.ENHCDM

PL/KPCKwWEB

PL/KPCKwWEB

MM.PFW.

MM.PFW.

.bssf

.bssf

J:CRT

J:CRT

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

WS2_32.dll

WS2_32.dll

%original file name%.exe_304_rwx_025B0000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.rsrc

.rsrc

Explorer.EXE_1140_rwx_00FF0000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.rsrc

.rsrc

%original file name%.exe_304_rwx_026C0000_00001000:

|%original file name%.exeM_304_

|%original file name%.exeM_304_

Explorer.EXE_1140_rwx_01E00000_00001000:

|explorer.exeM_1140_

|explorer.exeM_1140_