MD5: 4af31187b699802b8dea8f9344a5b0e5
SHA1: d585b60f780e93ef6347bec72f76af3cf3892912
SHA256: 9137d23d29086180f74146d4aa998c4318e571cceb3a638c2d07d47c0cc4c634
SSDeep: 24576:nziCdxbABvLhbbRjpw xa14y78lvcAb HA:nWgxbQRbRdw xat8eAB
Size: 942592 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Installer. An installation package.

Payload

No specific payload has been found.

Process activity

The Installer creates the following process(es):

%original file name%.exe:3336

The Installer injects its code into the following process(es):

%original file name%.exe:2180

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2180 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\FR.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Color_Button_Hover.png (186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Close.png (562 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\4728696433_318161962e[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\images\progress-bg2.png (978 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\sponsored.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\JA.locale (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\BG.jpg (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\images\button-bg.png (131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Quick_Specs.png (221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\checkbox.css (190 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Grey_Button_Hover.png (184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Grey_Button.png (183 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\bootstrap_6173.html (156 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\csshover3.htc (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in1C2ACCFB\2AC937BC_stp.CIS (3820 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Progress.png (311 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051959.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\DE.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\browse.css (337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\ProgressBar.png (276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\images\progress-bg.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051B6C.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\ie6_main.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\PT.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\main.css (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\ES.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Pause_Button.png (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051B8B.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in1C2ACCFB\031F9572_stp.EXE.part (573 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\form.bmp.Mask (244 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in1C2ACCFB\031F9572_stp.EXE (26308 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in1C2ACCFB\2AC937BC_stp\asgnd.json (6341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\button.css (417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Loader.gif (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in1C2ACCFB\2AC937BC_stp.CIS.part (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Resume_Button.png (718 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Color_Button.png (186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\progress-bar.css (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\EN.locale (4 bytes)

The Installer deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051B6C.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\bootstrap_6173.html (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051959.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051B8B.log (0 bytes)

Registry activity

The process %original file name%.exe:2180 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\4af31187b699802b8dea8f9344a5b0e5_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKLM\SOFTWARE\Microsoft\Tracing\4af31187b699802b8dea8f9344a5b0e5_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\4af31187b699802b8dea8f9344a5b0e5_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\4af31187b699802b8dea8f9344a5b0e5_RASMANCS]
"EnableFileTracing" = "0"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\4af31187b699802b8dea8f9344a5b0e5_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\4af31187b699802b8dea8f9344a5b0e5_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\4af31187b699802b8dea8f9344a5b0e5_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: SecuredDownload
Product Name: Program Setup
Product Version: 1.0.5.a0.1_60370
Legal Copyright: SecuredDownload
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.5.a0.1_60370
File Description: Program Setup
Comments: This installation was built with Inno Setup.
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://info.dudaran2.com/?v=1.03&c=4cbbe5e2&at=1143412866&cntr=1	176.34.130.130
hxxp://info.dudaran2.com/?v=1.03&c=4cbbe5e2&at=1143412866&cntr=2	176.34.130.130
hxxp://download-1.com/softwares/2654/CcCleanerv4.0.4.exe	136.243.43.26
hxxp://download-1.com/system/softwares/files/000/002/654/original/ccsetup512_slim.exe	136.243.43.26
hxxp://rp.dudaran2.com/?v=2.0&subver=6.21&pcrc=1905451451	54.171.164.13
hxxp://os.dudaran2.com/SecuredDownload/?v=6.0&c=1008083027&t=348053	52.210.43.9
hxxp://download77.com/system/downloads/icons/000/056/144/original/4728696433_318161962e.jpg	136.243.40.69
hxxp://rp.dudaran2.com/?v=2.0&subver=6.21&pcrc=536178064	54.171.164.13
hxxp://rp.dudaran2.com/?v=2.0&subver=6.21&pcrc=24834374	54.171.164.13
hxxp://rp.dudaran2.com/?v=2.0&subver=6.21&pcrc=1513172402	54.171.164.13
hxxp://cdnus.secureddownloadcdn.com/ofr/Solululadul/asgnd.cis	199.201.110.78
dns.msftncsi.com	131.107.255.255
cdneu.secureddownloadcdn.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Win32/InstallCore Initial Install Activity 1

Traffic

GET /system/downloads/icons/000/056/144/original/4728696433_318161962e.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: download77.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 20 Aug 2017 05:30:00 GMT

Server: Apache/2.4.7 (Ubuntu)

Last-Modified: Wed, 17 Jun 2015 13:59:11 GMT

ETag: "c21-518b71868da88"

Accept-Ranges: bytes

Content-Length: 3105

Keep-Alive: timeout=5, max=1000

Connection: Keep-Alive

Content-Type: image/jpeg
......Exif..II*.................Ducky.......C.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:1C5CD7D421D011E290DE899618C8D10C" xmpMM:DocumentI
D="xmp.did:1C5CD7D521D011E290DE899618C8D10C"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:1C5CD7D221D011E290DE899618C8D10C" stRef:doc
umentID="xmp.did:1C5CD7D321D011E290DE899618C8D10C"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................P.<..............................................
...........................................!..1..AQa".2B#...q.Rbr..C..
.......................!1..A..Qaq.23.."b...B#................?....(...
...(......1..U..;6.).t...Nd.r5../.{.u82..n....h...w.U4'....Zo.@...T.N!
OL.........'au..x....X....o.^..8...D...)m...(K.q.l..$c..^.....EmX'..l.
^..S...L...<p..G3..Qe......;x.J..... q.....2z.!.cI\]...i-.Ym...V.-n
'...@.!..8.&T.y.`..[;T.MNJ.....0....n.....d`.. 6.O.FUQT.......ti.k
<<< skipped >>>

HEAD /softwares/2654/CcCleanerv4.0.4.exe HTTP/1.1

Accept: */*

Host: download-1.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 302 Found

Date: Sun, 20 Aug 2017 05:29:45 GMT

Server: Apache/2.4.7 (Ubuntu)

Cache-Control: no-cache

X-Request-Id: b4a4c3a86ae93273ac4aa76187c161fd

X-UA-Compatible: IE=Edge,chrome=1

X-Runtime: 0.010347

X-Powered-By: Phusion Passenger 5.0.10

Transfer-Encoding: chunked

Location: hXXp://download-1.com/system/softwares/files/000/002/654/original/ccsetup512_slim.exe

Status: 302 Found

Keep-Alive: timeout=1, max=400

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

POST /?v=2.0&subver=6.21&pcrc=536178064 HTTP/1.1

Accept: */*

Host: rp.dudaran2.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 2800

Cache-Control: no-cache

....V.....2$.....QT....M.=.p.[Es..2`}..39h....... ...Q.::..MZl...80.......lp

..5S*eA...aO.....;Q..Km..G.*..w..".#}..[..u..)/}...[5?..Jq..Y.q...a1[......X.o..a../i.X.... .jW...Q...k^...O.....Jh.

.p..
...#...........A'2.O.......9.>

i./e=4O..L...l...s>(.y.....P_.K..........y.)........s......n....U..Jrq....g.=H,p......]..uS.=xg.'...NWtG..C &....z.^..pVG...]....H.C ..M..
..,.....W.....C...4...3.8....D...F3.0Z........

~.G..#.....~...../}....l.CE%`..`j|... ...P.gL...-...=]D...r..)L..oz%_........\.C.D$..

.O./.......\...=(.
)Z..L-f...z-Q.........y.x.S.2;uyY.@..j.E..l8.X.#.*..S..........D."......:.....x<I7;2*.K..k.0.q....sZ!...tov...N...I-.D.].,I..Vy...A.(.U..r.&.SXe..uh.z.....,..I..h.]....V.5..z....>t...$...x.i.`.s.&..Z4g..P...2..T..E2..g!fR.[@..S/.....e......yX......@.d...Q7Sa......7.fcI...
...ly.W`..e{dyla1...\.....c......;|.....Q..g.R

....[!.g...[nq.u6R..R.5k.....,....<..0)....L...@d.hR[...|...IH.r.......
Pe.b.p.aH.}...@....}.%.....R}........g'...5..{D...C.8....F2M
w.........>..t)7...T..P.^Sh2:uZ. .L..N.....>.<.iH...3.h.N)%jz......Q..gL&...X.U.
......|
0L%.d.5..T...~..lF..u..j.......3A.C..A...'.a5......X.S.op.A9,...7.j,....[..RK...0Yu.7"....j..3.l.l..4^..\,.>.&.;......V.....G...Q.........O.k.]..b..HI..\.........up.A.e.....R.m.^.O.c..r... A..Ax6."..#!..[..9....=U..|.'nc.HL
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sun, 20 Aug 2017 05:30:12 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Sun
, 20 Aug 2017 05:30:12 GMT..Content-Length: 4..Connection: keep-alive.
.DONE....


POST /?v=2.0&subver=6.21&pcrc=24834374 HTTP/1.1

Accept: */*

Host: rp.dudaran2.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 2752

Cache-Control: no-cache

I'.........a.o.~.]5.g...v.a->.........>7U.....&.........s.....V.@A..b\.<Kv.kA.x.@...f.@WP....?...!..........Os0...<..b........{.W...U....Y.A....e.Z8.. ....
.....h(.. Mmb...kS.r..L.....U.G.
..\!....$...*....r.Q.Sf........pH9....{..QG..c;.c..4xMa...r...4"...22_..f*..^..Y*. $.....~#`j.m......d.Q%.N..g.r.u.....*d.......).}.S..~-.<L..W.....g.....b...7g..{.0......5 E>..(......G.lx.x.y>?.ozJUV....W.%.d...f.X.9..>=....z.*...Uv..c.~.....[....*r.gc..-....I(
..$7..$X/...K.>.e....?.}.".C- ...LQ_3..(:c...U..rVsZ.C.f,..Cf.{E..;....5u`q..7U...".-.."LuJ..5.U.....5.eZ..u/^...#t.j.<!e..j..1..UNKh73.....@f....`.d.i..n.... P.o.....yL....0....t<i.o............Q%.x.m.^bU.2......pU=.,.$[..x.,.q...D.........D......P.58....!.......PI.X.y.7[.W......YF.-'...;..2n.L..c.R&{...o...@...#r......p5...-.o$.g4:O./sM....6`.,|>.^'..\..G.

.j.'{!.....6.<.:...^.rD5.OID...P.Qo...U.CYqL}].P<... ..S#..\......D.@.....?&.1..Oq.pN,.'^..m.z'.l..T
?..nm. mKV...f.....

2..-..6.....@...

-.CB..A.....-3.wN..Z.C..t.a`.j".7n#....LH..o....0....2..b..^...g".> .M..X..$>.m...y...H..."..../H...q.~...}...v....o.W.Y...Q.....d...I..9.I...#.......S_4hq[..8..5-..a..IM.`....[....1......D.X.1..H...e..g
...;'fR\|.t..n..9...0.T.... .L]_v..}IE(.B 4..B.:WX.*...5.......'..E.g.Q.uc...#.......".<.F.......r...S...k..Mh
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sun, 20 Aug 2017 05:30:15 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Sun
, 20 Aug 2017 05:30:15 GMT..Content-Length: 4..Connection: keep-alive.
.DONE....


POST /?v=2.0&subver=6.21&pcrc=1513172402 HTTP/1.1

Accept: */*

Host: rp.dudaran2.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 2800

Cache-Control: no-cache

W..$...1.:.A].PPlE..I..^.8......,..v>(.5....|..'Y...f....VE..M;...*C..E.l.......G.X

o...w ...

......!._x.....I.)....w....S.o'......bT$.y...J..;......u...U...h^....
.{.e...m.....

...j.f.P..nrT...<.....1.' ]s....O...=)]...4.....^i..?;.8..7...<.d...T..U....Z.[....}{......6......T.P....>..
...\.J.7.L...>U..:..-r2>.....K......... "."...&;.....6..o..J{D....~QZ...mj_!x.J..\}M......7....E...
.7..........K.....-.........>...z.l.:..J.?..'4.`.L=)B..[0E.2.e..z.E@O.....Y.".c.u.wH:. .....m...{...?....|..c..`h...m.... ...k.....V..W|0.l..1T......o..1Ly..:..ivT.3._. @]{n...~.V
.L..`./...#.f..ZVP..v....Q: ...Q^.bg......N.....fS...........hs,.{..M......j.f(...p......m.....e.Jx..vz.)k...j.%{e.......Z._
....1..w.P.M.e,.....M.SN8..B....o... 46h..[.b...e....7 ..A.......Q/...e[*Kk.@k^.R.o.#4.Q....a...:.[.qT.b%.C.^<....@..z..g... Q.(]j.r..-..Q'A.WJI......!.^.

.j%H..[...h....U./-...,...'.&..f<p....Cg....{.- ....$.;..R.......P........}...j..........?...MF%P=.>...\.........PV ?) Q5k2WL6.z..p.rnT!t.........bY.Y][ ..<Xn.`..6.....9.._.:.q...,..r.%.c{...r.h..%FL..... .i`s...b.......0p.]q..D..b.....j.C@.
...B_......4Ve..A`.T..ne.y._c)...ks.e..Y...@.J.* .23.m.M....Q%o#....S[..:'..rG...n.F.K..]-.g...1...W.R..7N.....".]d..g...j._.w....:..-..}Mj.....g.M..g=.

.c...2..j....n.e.{ ....F.1e.....Z
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sun, 20 Aug 2017 05:30:15 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Sun
, 20 Aug 2017 05:30:15 GMT..Content-Length: 4..Connection: keep-alive.
.DONE..

HEAD /system/softwares/files/000/002/654/original/ccsetup512_slim.exe HTTP/1.1

Accept: */*

Host: download-1.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 20 Aug 2017 05:29:45 GMT

Server: Apache/2.4.7 (Ubuntu)

Last-Modified: Thu, 14 Jan 2016 16:46:40 GMT

ETag: "54ebc8-5294e07ec7bd1"

Accept-Ranges: bytes

Content-Length: 5565384

Keep-Alive: timeout=1, max=400

Connection: Keep-Alive

Content-Type: application/x-msdos-program
HTTP/1.1 200 OK..Date: Sun, 20 Aug 2017 05:29:45 GMT..Server: Apache/2
.4.7 (Ubuntu)..Last-Modified: Thu, 14 Jan 2016 16:46:40 GMT..ETag: "54
ebc8-5294e07ec7bd1"..Accept-Ranges: bytes..Content-Length: 5565384..Ke
ep-Alive: timeout=1, max=400..Connection: Keep-Alive..Content-Type: ap
plication/x-msdos-program......


GET /system/softwares/files/000/002/654/original/ccsetup512_slim.exe HTTP/1.1

Range: bytes=0-5565383

Accept: */*

Host: download-1.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Date: Sun, 20 Aug 2017 05:29:45 GMT

Server: Apache/2.4.7 (Ubuntu)

Last-Modified: Thu, 14 Jan 2016 16:46:40 GMT

ETag: "54ebc8-5294e07ec7bd1"

Accept-Ranges: bytes

Content-Length: 5565384

Content-Range: bytes 0-5565383/5565384

Keep-Alive: timeout=1, max=399

Connection: Keep-Alive

Content-Type: application/x-msdos-program
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8
...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8.......
.PE..L.....GO.................p.......B...9............@..............
.............4.......U...@.................................d.........4
.hz.......... .T......................................................
........................................text....o.......p.............
..... ..`.rdata...*.......,...t..............@..@.data....~...........
...............@....ndata....,..0...........................rsrc...hz.
...4..|..................@..@.reloc........4.....................@..B.
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....-G..H.P.u..u..u.....@..K...SV.5.-G.W.E.P.u.....@..e...E..E.P.u...
..@..}..e....D.@........FR..VV..U... M..........M........E...FQ.....NU
..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.
P.u.....@..u....E..9}...n....~X.te.v4..L.@..E...tU.}.j.W.E......E.....
..P.@..vXW..T.@..u..5X.@.W..h ....E..E.Pj.h..F.W....@..u.W...u....E.P.
u.....@._^3.[.....L$...-G...i. @...T.....tUVW.q.3.;5.-G.sD..i. @...D..
S.....t.G.....t...O..t .....u...3....3...F. @..;5.-G.r.[_^...U..QQ
<<< skipped >>>

POST /?v=1.03&c=4cbbe5e2&at=1143412866&cntr=2 HTTP/1.1

Accept: */*

Host: info.dudaran2.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 172

Cache-Control: no-cache

6l7GU7LYt04pVHc/00d7JmqAAA1KP1cezVqHcpuYFY ZRlVAjlr0OFvcVvf/u8cJQtVRMPxVv5PWAj2IV9d9ofvFBtz4AB ErCGwx4/iKzucoxXeHzM8toPTDNpGWwBW5kMW2YC/8DqYQIpgU9/kxPjG4PhXwOWBTHH9Q0w05j8=
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: text/plain; charset=utf-8

Date: Sun, 20 Aug 2017 05:29:44 GMT

Content-Length: 1560

Connection: keep-alive
wGYuWIiU76twT5ay4Ke7SGMnLp0 /zWKbiDcJbB5qTqokIynQI8et1vRVXirhRjMnIOj1R
piMKtiyq6GQVgfuNd9WeXLJ0qNDfqNgCL8l5pBzK0MIrfB7bBIbLPCq8pce5pLP BnTjuc
LeXIn3e962EXq7rlsvQin6EiNmzdXcX2YDjLpGqTMxK iLZ8uLo4rtTuPmR3YbT8Qc4AYw
B0Hz8RYuRQKXbd/q QNmxAu0ECFWD8g/sMbBOMT7lHHXoMGw9dO93UM8Ouxur4URvgf/uo
HBxdG3yyrXXkRU38spJ4Tl/SwMnWnJvN73CuUqSIbkZ6tI/jpDGhhLZS qIY4N5qHV7S6z
sZ4/RE1V3CYQ Ax0PttVi IGRb0KVGA0nit3OE/zjGkyHNwg2XvCBltyk/rlFGF6/m8VUk
lCz8TviDa /LWA6NghBXiNGmoaNZYGvHdHUEjjiwNl 3ZX3PZERcAmvsRZtMtiGIVTwk5Z
WM6wCIzPZRTmyS20hmaNehyZnHvOHZV8j IXwkLUNrDTlGqznZPvi1A8p5IYPpD6bcwBpo
34IDi/U/VPGAZHeIRdVCFQj9eKRMcAQNKsPd hY2UbP/ZMVIIik doktWprIOEK8/B0BcR
5CkiFPhxnlsr3dCPVhW26V/PqtFe2X6hdFlmjPT9Pw/gWIP1UTQICzS3T2qmYL5X8QBhja
y5tIb7TfZAQ3A/O1Gr9iUbNYC6kQErrND0eYtGm50HExuMaerZcavg7DLmS3eAhSyWAC79
u3KgL8S3ymWQboCcW7dGWPx6ou2YRE9plseP407gPpDHipERxaDOs7bvzeLsOB7ovgEoVg
J/HtGy7X8RrYYiSwfG3RU/F3DrdB6aIt89EKxEyEYB0i5c8CSIVjEw9ZQHsZYRvGEoTgP5
l5ePZ x7gHTHSxZPYZL2b7YDyYAIWILU3Ut aR/LhT8jJbzUDp0S9wZUh2EWXAKXuQhMsM
 emZ8TNK zg/MidbCNMvJakjB7/L9qei9u0j6zKNioLu8VO7g29 L8IBSwKeilq/qLjC0H
bd6hfYrfTmCgn8t83TRt341OZHhDM3UqcVKDMbr2MdaJOH2  9xC8wbWoY b2B2zKPA fL
yxY8CQGDXnZba1s1Z30mVLkKejMNyHFQb2zc/cropxOBski 6tcQw7CqJ6bP6W7nuXcE V
1BiH4dwXuuaq5f/VbLWs/RBg kX5MpSQyMbi7v QWinRAYQYOMhHl8Jd0hij7/e0ZSpyx/
3CjcCcToAwROP/djrFPxnoHv2renyPhrHCyvbrQuiVpqoGCdaeEklQyFT3E/JAau6WyupI
dCxP/TfKcZ8fXpy74OyvhYIWhg8z6JY0S oMghMtYYvH31yVR856kclGoiUQhNetjdWQzs
5UI eAuZZCUTl4XuA9VguXc3KDzqL6L4xyKOUjjvBxFkEdp0 fCqlBvKrU HavTY8XhsQT
GbCPKPEnFU1ZKXrtXUGP1E Ze/RaeNJh/UK8nfiLCp2TE55/Pi6rEvPZct8QhsIDHe
<<< skipped >>>

POST /?v=1.03&c=4cbbe5e2&at=1143412866&cntr=1 HTTP/1.1

Accept: */*

Host: info.dudaran2.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 172

Cache-Control: no-cache

6l7GU7LYt04pVHc/00d7JmqAAA1KP1cezVqHcpuYFY ZRlVAjlr0OFvcVvf/u8cJQtVRMPxVv5PWAj2IV9d9ofvFBtz4AB ErCGwx4/iKzucoxXeHzM8toPTDNpGWwBW5kMW2YC/8DqYQIpgU9/kxPjG4PhXwOWBTHH9Q0w05j8=
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: text/plain; charset=utf-8

Date: Sun, 20 Aug 2017 05:29:44 GMT

Content-Length: 1560

Connection: keep-alive
hTDmvfNcrunQThWQ8IRbtifBAcNKs8tKQj1sodT3Uy7g4iykHImlC5CsXIHvH6lcAbtzwT
BphVCr5nzkywp1ZCbhBFbEnLPoz/TuxjqhZNeUf37tbAjM/5riR9aD3bwZQM6J5Dwf5Y7v
r3/l5zkDXTgPc7VYmG2liD Zr6qbdgXDYaAX7tQCo0Od cP2flK8A6sOmp9bCIPtad ySA
qOcfjTTcUW6me4/YbO3ZEdSC2wo6ME305UiH8Dr4 86SpNFAT0o1b4hNzDSWo4CMsOu6K/
INB6G2AheVHhY33x7eT1H fFxCOPTwnBShSTG/5CJ2n1/TB1iiq9M7NKO/QbbvZqh3yp6K
hhOSraVQF9Bg5ni09cHNSANYS/Gs621ysjkZrO6rxBOAi3XTL2VqmqYHcB4GE6T7RJLYlC
9VufagBhhM2pgDN8SuXKYYcCBXAoeYfw6s3mq V7NEcLfiOo3JBFP8060JF944urgWNNlZ
slwIP0W9 rX9ENNZY5ymtFKEIQSep6RN8fyY3ZXh HUyMaTToloJxX3rELMWPl7zSmgmUh
BTeH zWQ3yDJ h/NpwOR9nUg7avFVf4L3rTERH/h/EKrAq5VVdeAWI0oLVNn6ctClwhcT8
U89lt Do/fyiPoVV1583xp9wjSXZjP1l8cXCippmrusnn0/qjxPyyp9s2cVuG8mtUfiH n
1DoW3tV4FW2u8nbZ45Dw /lpVOmvBDRfcqPXQYsDn7SlnakXo69Lh11E4kxOLTSLdvBL3c
 lCBo1UIaX85iAwkkq/yEyBAoxsLim4lhV3wPwXJX5dFLa1u9qpqTLwRAlEKZsGKnjCqLn
ztCPzLSY54Zvms7LwQfH4EZ8slP3WfeXMLhL87UYS2gBZPJRLDeFUV/Gnhld9w2ZGjA26j
32WlrB2jfksljVSa5yVpJFXxGGuVW9yukvUPMxf3MbQVjb9cAVh/ZzOuvCwv 8VedzoxL5
xyeqq1VQYwcBvzlCq5rmk3M7D/RbvrUYMDtE/2kcTvDAbOrtJo/RPMRYqol4JcaSicGk6R
fjnWYR5zRKbSc4hEuCci15rtKNrW5ETkzSjd4kwHLptZ63Rbv4UtSN/NhwGAALleLKCN75
s8WNIsHXesIe28Y5TNgt5pEJnvU5xafcHg3tHvg6dab8wV7PVsgN545exvCPkfPhwLvAFz
i3pqrvrLXVcT1kpjfS6QciYoLYZE6sadyQzqTueeX3WPC3ReVfFMms55cLxwnidx9YY4a1
A4NmlVYMfUthgv/zh1DlwgQKb1nvwXePZ0PqJ7QcYZ9runavsw5rV3qRVrpJP0jZTMVJfM
hNW6Q5SLdjoIcZoqKtvMdwYZWJ qucYkGiFRxL3houAcgntvrQEUTGW6R7L9bDjeK1tg9i
wUjLJ8s2mK6WKtyPFqgw0b4bvR8aUMyqAcoDfvHMwjDCNei7o 9Kg4b2pRkJ35nyDxbS9K
kk/erIxmzrledWBTCPQkbCq6v1h7WYw CzAJQ7lP4UhnKqa53SrIIWpWtYM1HVCTuy
<<< skipped >>>

POST /?v=2.0&subver=6.21&pcrc=1905451451 HTTP/1.1

Accept: */*

Host: rp.dudaran2.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1968

Cache-Control: no-cache

Connection: Keep-Alive

...3E.Q)_l.y...K4......g\.....Z

z...D.3..P.........t./..g...-..|..7. 7.o|Km..g.l{.m ...L.....~.....{..............u.".W..S.|{n........ <0I.E....<...<N..c1..s@ .4.a.g)X.....m@.[mZw.|
...*..a..)...M.o:....B.dXn..}.=j_H..M..{..c)R./;._.]j..0..u..p...BV...3.b
.z..I".a.......I.=...n.....?pD.....%>?6...1... .)....&.p...C..3..........'......9._......Y..k...*

.J3f.#Gj1
...Co.X................c?a.~k...Q..YL.}$j^.]O.

......2..@..0....y1P.............M..........G.Nq..Z......*.............s... ..^...TU=-..}w...o......4...4.......n...,..LR.>.-...Z..S.x.k.#...4..k.Uk5...6x4d(...(..e....@w.............p5].$z.......b.. $...}>
/..tO.$..3pi..D:...)Y.^...E...CK..q..#i..z.C.......'....'...ro.#)&..y4<.........l.......F...'..4.."..7....H.l.t.gr....@H!,a.w;..$..5..X...W.M...%...
...0.VUB........}.$....|-$\.Bm..d-..eg..L.:..Vy.a ..N..cq..IC..[..y.P.r....C.0.#.\...x...........U....B.i..1h..&B.T..f#.D..E.`^.$......L.0a....`.{.....>x.a?f.'..r..>.......e...:.}~|L(,......0vO:G..>a.`..y.'...u6.?../R.EG..#.....5..=".0q......4....y.H..S.u@1...C.Y..d-k....3.q ...
......6..0O..2...2......*7&.$[..f[%..S'....].Kw...o."3......xSV$....G.....=..Y...........m..hS...D........u{Y.

.m"o

...^...!mo...\_..[{..>w.K|...N
1..t........',..6R..v....O...L..4..J.OB..U......F
...-..
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sun, 20 Aug 2017 05:29:51 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 400 BAD_REQUEST..Content-Length: 0..Connection: Close..

POST /SecuredDownload/?v=6.0&c=1008083027&t=348053 HTTP/1.1

Accept: */*

Host: os.dudaran2.com

User-Agent: ICAS

Content-Length: 1392

Cache-Control: no-cache

Connection: Keep-Alive

...4.....>.K..~....=l...6......K2.;O...f...> .....hr8V.......m.|d......>..s".;....P#.........H8..s...Ap5.a2.b4....B Et.d....D!...D..K&g#|..`.A<g.}.*x...Pc.....>"....ko-..].G..8
...Y;. .9R.DL_....... ....86...o..;iO..Q..<.^.).....i...m..6 ...GxG.Fe.*.....>..,...t.~...L.....V..

...(.#....kQ.F.a.....r....._.9...p......w}..3...c>...#O..n..-....zxw..3..d.f..C....y.C.....r....(<<.&.E....U..lFz.y....^.s.#.'..^z. .2...........S.p'[.{..H......`b.i.s.C..G..A..V.%....tN}.....k..y..N3Z&}..T.d.......p...~.\z..>..V.<

.ag..@.i..N......rk.r.._.....8.a.y.R...3..L.......r.f....v.{..C..........K94...1.m.........c.v/.10...WQ._}.,....R<...,..p.........<U..&y(.HS..X...n@m...3.o.h..3H..lv..A..
....nj.%...~.........) P...\..T.(.aC.Vt.....6. |..
......@.....o..e&.X..n..o.q....R.y..cVL...[#(..!K.W1.f.w

..'A.\.....y...K...>..z..<-T.......%."..f.e...0........c..1....... U..q..x.*../.n#....s...U.7..xkf.....Zoi..zB:.......w.......P.m......

.i....Q......'.p.aE.7e....w....i)....kV....#....*.;...U.R....};... ..B...\.).#0.....S)........s.z.F.....o....^........S...uE.m.n.zz..G.....z..6\G.6.....k.G...N|3<.}......L....9....#w..{..q...F.v.6.F........xt...w...o"..bsd.9,...E.,4...E.Q .E.........e...a....].L........&.:..H-..h.....um...D....J.a].......P..4~....g.J....m.N8.....eZ!C......E9....c.N......:....(,..
HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/plain

Date: Sun, 20 Aug 2017 05:30:00 GMT

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Server: nginx

X-ICSCT-CC: UA

X-ICSCT-GICSET: 13716

X-ICSCT-IP: 194.242.96.218

X-ICSCT-ISP: Pitline Ltd

X-ICSCT-ORGANIZATION: Pitline Ltd

X-ICSCT-SERVER-NAME: ads-slave-173-production-eu-west-1-i-0298a885e96094a16

X-ICSCT-TIMESTAMP: 20170820003000671

X-ICSCT-VERSION: v1.7.3

X-ICSCT-XC: 1f3cfb072bc5ded412eb0f20eaa0b3fa349c056a

X-ICSCT-XS: 91bba9083b637bbb85f2bc525458ea3d2e0cb405

X-Powered-By: PHP/5.5.38

X-Robots-Tag: none

transfer-encoding: chunked

Connection: keep-alive
30fb5..$.gR;.oR;....g...3./M.z..)6.*Pm. X;.).\ ..M.....yls...nd5....%.
1..N.1?..k.,\DD7....X.7.HF......o....T.....o....o.i......@........R.$E
d....V.l.....il......$...../nN...@........;.....x.h.X..Z"...q.....g#..
..*s.5..v'.....#..y{.G.d.............T....`._@...6..,...&....P.G.....T
."...G*.h....9fRR......J2.......dr E".. ....KB<.K.(.UW..........X..
dI.....6..15H.Qt....6.....PJF...ZT......AA.3.....o.D.aWk....e...=.....
..R....N.!(b.[...'.....d.*`x..o.......G`q,.p:a.7uUn.E.-.....t..uY.H..!
..OM?...pw.Ht.9...Z..p0.....7......|.:.......h.......n...Iy....d.t....
W..}T@.B.I........`..2...Tp.........@*.N.)......6)~......[W..y....Q...
..6*...T..>%....j...W`............t"..g.Lu..r...,......HP.....&...?
/.....x...Iai..!`./...............j...?A)......:Tbc.!..._.....).|G..u.
..\M..[.....}Y:.~.r< ..V.....WhT.s.....mk7."...U.../&YlU.......q...
...r.(.....5.=.u9..K8..b.... .b..x.Q...6L.....l.~..t..z..VU.[.....k*..
..0...U.h..9.0.w):F8..G$.2.._3.b..M.w..&.v....|..oS......p.ZK.j/...d$G
...>@.S. .9o.B......m...NLr.<.........c.......91..../..?.M#..}..
...r...<.....S.......g.a...\...J,.....`..3......c7...!..c`..._<r
...8.........a._.E.Q.|f*s..#.)a..(.V{r....B..Z."...E.e....U....Z?..n.B
..K.6..\\4.`,S.a.Y.f..}M..j*.;..NP.U.......,C....y.~u..D..Jlr,..}?I.1.
.....wQ.....W"d...E.N....C...jXU.....=.?...6...}.K:.%,..yp....M.......
G.`..m.^/,......?q......1Q)...v.".Sn..6.|#<...js...VN.G....$..B.b\.
).....h?.G..._.>7.....x#...G.2G.d.9U I..i......B.3...3...4v.0..6.(o
....rjGt.Z....:.{...:...|../...N.'.......xE4...lNr......N...la.ry.
<<< skipped >>>

GET /ofr/Solululadul/asgnd.cis HTTP/1.1

Range: bytes=1048576--9223372036853727234

Accept: */*

Host: cdnus.secureddownloadcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 416 Requested Range Not Satisfiable

Server: nginx/1.10.2

Date: Sun, 20 Aug 2017 05:30:21 GMT

Content-Type: text/html

Content-Length: 615

Connection: keep-alive

x-amz-id-2: 3aHJ3oXBJH/HLXF61tXp6BSAv4KSEU8OGKiq36lgzZli2KIVXiU5BsppSL6S5mWH94Q6ONlsmvI=

x-amz-request-id: 26A7769F73936611

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

Content-Range: bytes */101029
<html>..<head><title>416 Requested Range Not Satisfi
able</title></head>..<body bgcolor="white">..<cen
ter><h1>416 Requested Range Not Satisfiable</h1></ce
nter>..<hr><center>nginx/1.10.2</center>..</bo
dy>..</html>..<!-- a padding to disable MSIE and Chrome fr
iendly error page -->..<!-- a padding to disable MSIE and Chrome
 friendly error page -->..<!-- a padding to disable MSIE and Chr
ome friendly error page -->..<!-- a padding to disable MSIE and 
Chrome friendly error page -->..<!-- a padding to disable MSIE a
nd Chrome friendly error page -->..<!-- a padding to disable MSI
E and Chrome friendly error page -->..HTTP/1.1 416 Requested Range 
Not Satisfiable..Server: nginx/1.10.2..Date: Sun, 20 Aug 2017 05:30:21
 GMT..Content-Type: text/html..Content-Length: 615..Connection: keep-a
live..x-amz-id-2: 3aHJ3oXBJH/HLXF61tXp6BSAv4KSEU8OGKiq36lgzZli2KIVXiU5
BsppSL6S5mWH94Q6ONlsmvI=..x-amz-request-id: 26A7769F73936611..x-amz-ve
rsion-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3..x-amz-meta-cb-modifiedtime
: Wed, 20 Jan 2016 14:37:36 GMT..Content-Range: bytes */101029..<ht
ml>..<head><title>416 Requested Range Not Satisfiable&l
t;/title></head>..<body bgcolor="white">..<center>
;<h1>416 Requested Range Not Satisfiable</h1></center&g
t;..<hr><center>nginx/1.10.2</center>..</body>
..</html>..<!-- a padding to disable MSIE and Chrome frie
<<< skipped >>>

GET /ofr/Solululadul/asgnd.cis HTTP/1.1

Accept: */*

Host: cdnus.secureddownloadcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.10.2

Date: Sun, 20 Aug 2017 05:30:26 GMT

Content-Type: application/octet-stream

Content-Length: 101029

Connection: keep-alive

x-amz-id-2: 3aHJ3oXBJH/HLXF61tXp6BSAv4KSEU8OGKiq36lgzZli2KIVXiU5BsppSL6S5mWH94Q6ONlsmvI=

x-amz-request-id: 26A7769F73936611

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT

ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"

Accept-Ranges: bytes
CIS................?...............P..............M.U....$..q.X]....9u
..9u...#a!.s..2.....{8.u..i3.\...Q.....X..}.E..c.).........&`.......B&
gt;Zr..|...E....=..>.o.u..........=|....:._-@.6.d.b.......F'/.C^..t
...e%.s^.3..4..&..o)Y....UrU.R@.........i.%?...lW.-..g.'..KC...'..0E.m
.d.....x.#]...y..u...?.x.V[....o5.x..MQ\....nX.@.9r..iJ.8...L.E...c.4.
.6.x..@'..[..C(4.&.../A..i........e...`T..H. ........)....9(!.D..m...0
..e.,...~..<. ..L.}...................../...sC..#..}.... .......9.9
.....Ji..Xb.Yjk.../...6.@b...i..&....F....M..a....u..B..~_2....h.:nu..
..-..QiL.P|.LB.).....X..v5Z.$aP.".*...z.b5J..z....h.a>?n~h.$..;.V.'
i...2......Y..q^Z4..\....=`....o.M....~.....:u..^.....A@......k..b...Z
<.!..;......&y..!4...#..S.p;wb....@a...._.......At.5..pz........t.5
H.. 8.-..7...{.P.a;..ia..@.Ac.1.....T...,dmoE's;....5...B.7.vQ$9......
y{.j...F....|...9.u....M......1./.-t....dI#d..C9..Lg...../. .v.......1
T..60.2........#..B..............8.....y#~5A...~t...K...{a.|.z....~.*.
.b*.49k.2....>..]s...W...B.n....zK.,..Vk.....h...........w...".....
.I..XW[..}W...y0f..k.~..O6.97#Gk8.5(....Y.W..k...Lz....6fz.....)|.}../
h(8....0dzx.\........._..b...'..Y..w/*H..\.B...\.......1&..Vg..[..N(.Z
I.......G..[.x....0:.eJ.J~..)o..,....T...i..Z.Q......P!.J......_...F.1
er.8...#d...).......Z..im..F.i....%".o.....F.z.V..Q..K....R..W ./.".E.
.dR...y......'Tu....9U..$4."..wP...d9.....x$...W`....8....#u...1..\,.S
.:.kdU..[...,.a"....". P....!.V.K.Q"M.G.e....w!C..../..... m9J1..&I..z
&.2.I..-B.......{.=Ftm....6....A...3..=@t..67.-M.U.Z/..c..^W/Wo .h
<<< skipped >>>

The Installer connects to the servers at the folowing location(s):

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

LzmaDecode failed (%d)

shell32.dll

/SUPPRESSMSGBOXES

/PASSWORD=password

Specifies the password to use.

For more detailed information, please visit hXXp://VVV.jrsoftware.org/ishelp/index.php?topic=setupcmdline

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.6)

Inno Setup Messages (5.5.3)

mu2.iu

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

1.0.5.a0.1_60370

%original file name%.exe_2180_rwx_01270000_000E7000:

.rsrc

kernel32.dllwGetLongPa

ORT_(_.SCK_LINES

.jJ`l

wpi%X

Keyw|a

-Ak}K

P0%CJ7

%s[%d]

%s_%d

 gO"%F

.FDiag

@14. _@*

7E(AL("%s",4),"

$$((,,(}

.mC:)

u...CXR

=q.tGP

i1.oO'

xRZ .pX

GHotkeysK<B

C.sd0

$H%D:

%x@`0

 &%uG

tLcibD.ZP

jn^Io.ye

ToiZc.Xhj

I.cG_

.DZOLdyE

RM.IGisr

@L1%u

)l.vwL(

Gcl.sp

\webqskv`T-Y

#%FZ>Ub

.YfS1

-X.Eo_u

xs:.LGw

.XQFU

*ox,.ok&zs.f,jD%B

].jl_

tMuYvT.whxi

1.2.3

THttp

,M.DJ

.FJn`w

RhwbG.xy"

ic6.fA

FRI.AT

mw.ll

d.vLO0

hfkeyoy>,,M<

n*9.FwE

25.Cp

L.xeiDb

6/.wwj

.bCgM*J

5*.ep

R.spk

JD[&.Xt

.ddh~0

If.VG

3?:96=>?59:;.ZQ

.tmGj

'/.Sx

kzQaaF0Z.ip

xTc.Uv

F0.OF

AEil.Ep&>

j-1,@bnfoa.nvQ

w]H.if

)hix.CBO6

S%sui

`to0.H,.Pma

.oj0jDlej8

?CJ[hx.Xo

NAER_[URNDT].Lw/

k.sbafc

zhg7(.nx

H0C/.SwA

LJ_.ge

\ym^rk.Um_gt

x.pp/!o

Dlb.vo_D

.hPrm

?.SuspD1

N.fLl

Í<D*

sqLn

IWeb

TUrlH 

fKey?q

{D%cS

'%s' (

rMsg

VVV."

Z>ftp:

FIT%XC0

.AdviE

*m%d;k

.1..WAHO9[Z

B0h.he

,,Kkv6.uw

WfG,.oqv

RDD%f

J.oQ?

>.uhh

D.zgYZ

`w.eOicTjjw

yhe.aO

BLOKPERHCV.Zblf)kq

Ei.Tc/hEdegZz&

VT*.lJ,e?

!LMSG_

(@28,.ch `;

CMD\x

e.HvwVty]ja9

dh@E.oZh

r.vY?

.dwKyl.@

T.Vhll

%5xPW xi&EL

mjC.Oon1I

?gZY*rf.ae RK

or]lw.ad^ ME

.qB/hkk[lfqd.@ UY

PIPE_DATA'

LNYCD_^.eJFLKPV.c,S

qyv,.mjlL

B.uyjB

a5(.oG

o\v=.vNW/pT

.rC'NOT2

cwp.pk`us

.VF[C

bo\hfm.cV

xEXE&0

/_.uR

m-G.fO

4,<-.Sg

twzfc.bzG\

Zu-f.woar

,i]no^dun.Vx

fjp.Exb

,.wvhB

M@VNJPu.Ig

Thh.tzIl

Qi.qpL<

.wixdj ,*m*hn

k-P.VOx

y]s.ZR

OfE'.rj

5.MEO

&.jvB

.jBw*

[akVG.bI

X_ñ

[i%x1H

wQW%U@

ms.Virtua

Key#T'%#

"$ %),'8

H.JXA

 /*-( ,'.-!

*/.)*72-7)

#-**(-#,

.PMDF<7I

GP.re

KERNEL32.DLL

advapi32.dll

comctl32.dll

comdlg32.dll

gdi32.dll

mpr.dll

ole32.dll

oleaut32.dll

shell32.dll

URLMON.DLL

user32.dll

version.dll

HtmlUIInstallerSADLL.dll

u.TW3

1i.kg bPUMt

R.ccnM

f.VnC

fH:.BD

k.$%X

T-rJ7X}

}.nd:C

p%DPfL

Fz.uh

kR^@%D

h%.f6

_.oqW

U%ujf

.dj@uM}

cu%DMk

hO.zNI

.lXJd

.P.viZt

2/k|mD.xy

ex..%f

U:\ul

8wJ%u

.zC a

7.Jzy

6h.Gm\

U:]%u|

%original file name%.exe_2180_rwx_01361000_0015B000:

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDownx

OnKeyPress8

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

A`bng`@ikc-4,uUxlxs-4,Ht.HA

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

TThreadExecuter

TScanAllWindowsCallBackData

Portuguese

ZkkdDocjn^g-4,o.ye

^ioM-3,iiziGmwItI.cG

\h-2,Jfal\`dgxj-4.DZ

,-\ T,/.Om

hcl.sf

webqskv`T-Y

oj-2,`ac<<*kcb.jo

AogbGsgzcVyaicx-2,ou,  S,zOo-2,*ox,.ok-0,zs.f,j

ak-2,`ob<< T,jcb.je

IN]JVN]K]KJ]B]F^UF@@]\v-2,ujbRBjazsnc^s`lkr-1,`-1,].jl

7Teah P,Ckh`-3,fkgo-2,7*NNYO.uh

1.2.3

THttpTimeOutThread

THttpCallBackShell

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

Jmvgknm Q,2,,<,./accwcxgeni5 W,O_GB R,=>)27,.Pkbjhu-4-.,IV,,8)37,.Spejblx Q,2,,< W.g W

Ecezcb-4 S,Tmeic6.fA

Bc/K-33,`-1.jG

Jbhblnrefc V,H-0,bv-1,li.AT

Uju-0,c-2 W,Ht-2,h-4.Rq

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

ebP-3,dLfnda`-4,`yj-4.PL

Vbksg*gr R,da Q,qe-0,sao,.vk-3,f Q,pk`fg*-2,trzasv*hnp*mnldkbvcao,.*-3,haagoe*aog*yhvbatv TN-W

,,jcwxfl`,,lk T,hfkeyoy>,,M<

@m`efazbll,.yfcmcff,.jm R,ogqgooz R,jdtlbdbfko S,af-3,mi R  ,`c`hfnbbme,. S.9 S

A`qmj-4,g-1,`m R,aslpbdyrgkn R,mjglkf-2,kakz,.,.bfk`b)va U,jc`fln,.jgg,.,-.]-J

Ia`h W,ah,-h-01--,uk-4,xb-2,z-3 W,o-1,h W-3,o-3,tg`j W,g`,-W-1,au-3-.,Cbck,. PW-203,wkmyn`i,-n`oonbgy-3-.,zb W,jazibalc,.h-4,hc,.nr-11,hiz,.-3,b-1,xhu R .,yuwgc`,.ochzfhu,.FHFJ,.-4,b-40,htz,.yh,.cllk,.-3,r-1,k S.Yb

Vdzsmdxd` Q,Mnjukop,,Zxtd,.ia`jdv;,. ND

`y*,-,-yw`-43,joj*`nxdweb-2,m/ C-b

F`e`, ecyemcoo Q,xfydmj, h-4-.,i`oe, uc,.ghjk, )mh-4,d-3-.,jq-3,v U.g K

,-a-0 TQ ,,kbxb-1,ib-0,f,-nmfnh`dhi R.SH

Nodo S,jbvmbb`g,.yiqkle S,g-3 Q,lhkh`glmow,-rwonj/,.-3,ub-1,yhmi,-dnk-4,ff`nx S,oonqz S,/,- M.^

Mkf`kg-1,gaj(zgimj S,k-2,z RT,oagjo,.zk(havkk S,gda-2,a(gz TP.c,N

, ,. W .,^-1,k-2,1,..bf

[vgfzom`,.ekr`mpJov/ W-1,gm`k< S,sn

 PP,*-00,ucan,,khhed/hj-3,j-0-,,ycliz Q.uD

Nmeoh`geck, xei, hb-0,e`bmo RSR.FH

Foch`babki,-bv,.cdr,.ndh-3,anqk S.8`

Yj-10,d-2,fal/-0,gn/k`-1,ac`jkj-2- ,i-2,`f/_n-31,j/f`kj U.zv

Qqfy T,p-3,evfn*mm*Ilvdaw S,Gkt S,ncbeox T,exei S-3,ba S,edap*zvl-1,c`fn VT,jmdkqcdc S-3,ba S,Ibqmay T,Nkz> S-_,4

JO)`bk-2 R.DR

)/_-1,i5*.ep

 V,7,,nnb,,oj,,olc`ii/cbav,,j-4,`a,,`neb,-kc-0,cccmi/c-3--,n-11--0,d-3,hnh,-.WJ

 S ,-2,dui4,-.YJ

, ,.fip4(.Cb

Uk-41,c-1--,xc-22,eh-2,h*tocmc,.hrekhnu,.ybc,.fdiyc*eac-3,c`y*jkcmrf6*eocicbachi,--3,nk,-ii`coezdeh P-b.a

Emogcau`il Q,`u R,n-1,r R,no V,oddipx),.at-0,tgo-2,< R-F V

/L WS,/ol`-2,zgah P.yj

Av`ba@mmH``obd-1-.,`ymkuugak Q,lk`o,.mdtifq;,..i E

]DKizHi-4,exc-1,Hc`hk-3.GI

L_LCUNTF, KHC.op

0.0.0.0

3?:96=>?59:;.ZQ

6?0N2=.Lq

;768>1-80

cabinet.dll

\fgejnhg,.Dhr,.f-3- ,z`b, -2,gbyz,..8y

Huvpdca U,]chu)`jimcw U,`u U,lg V,pvl V,g-1,)gkj-2,n`w)vwjjcvv UV,qwpokb)gkj-2,n`w)ik`),.dq-2,chu-2,< U,Ui

Gbg P,[hjb-4,h-0,t)@fil Q,)jfdgj)yf,-mheh-2,h)yah)yl`y,-obeil-4 WSW.TT

000000000000

\kuh-1,z U,tkkht,.zj W,lk U,ko-1,bb-1-.,qoo` U,ukmjjckkckj) W,mok W,fouwk` U,h`b-1 W,a` U,t-3,kfnob U,hmovna`v<,.\`wM`q=,.u.i

 ;7.Q,>N-Y,[ T,Tc.Uv

^dk T,xi-3,kxx,.bkeban,-,.L-3,x-3,Vo-4,4 T,N.E

GGR U,bgm` T,gr U,pan U,fgf U,bas U,M`L`ias-1 T,kyqvobqmao U ,,025IL() T,inlji Q,qk,.d-2,p-1,`fp,.giez Q,cmbd U,pa Q,qlk Q,am-2,j) T,ou? T,Q._

Y]H.if

d-3,tdcQqdc.Lb

TUninstallExecuter

)hix.CB

Vgg`p-2,obo)g`p-210,`-2,gamz,.hl-0-.,osy,.`bdk4 S.i-H

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

 T,Juep/[mhzh6 T.Ho

TPipeServer

TPipeObject

TPipeServerListener,x@

TPipeClientU

isrPipe

Oa`nbdkh,,xu/obh-4,`hqj,-.pW

CJ[hx.Xu

_.Wo*BC-T5p7d.V-b,

NAER_[URNDT].Lw

Ifccmglj*Gl-33,onao-1 R,Ckcg,-xksxo-2,v,--2,oq,-nkldoj R,i-4,k R,ye,.nlie R,bl,.R-4,cxkaoig,-Gafh T.Me

Kgfcofij(Ndngziy(Af`m/uhyzb-31,/pl-0,/chffbi(krh(-0,h,-dndf(`a,-X-2,n-0,acbjm/Jblj).Rs

LJ_.ge

fxk S,Cym^rk.Um

ole32.dll

olepro32.dll

IWebBrowser

IWebBrowserAppt

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizable

OnWindowSetLeftH

OnWindowSetTop

OnWindowSetWidth

OnWindowSetHeight

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPathl

OnTranslateUrl

OnCommandExec

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

OnKeyDown

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

hXXp://

hXXps://

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

OnKeyPress

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

Aiinm-4 S-4,w-0,f, oeg, K-2,fez, mjcn S,hoemdz, an,.nn-0,zr S,xzyjeix9, -h.9

MAPI32.DLL

LeftPopup

/Bvxjdzmk=,.QV^W U,BJ S,LKSF@5JC2\T-C4

Gd-4,k S,lx,.jk-2,oolo4.f,S

,,Kkv6.uw

,.oqvax S,vocpaj VS,sg-3,k T,copwomf T,4*C-c

YR-0,xh]izn.cQ

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

\fab/kg`khz,,f-3,2,,.CZ

-0,cnyzgcEi.Tc

https

Sf[.t,T*.lJ,e

:,.jiek3 V,i.\

@in,.Aimk,,eaobalj,,rf4,,.d,l

Hnd,-e`-3--,xgez, -0,bh, _xbl-2,o-3,x/lbyb*-3,baih, f-3,*x/kayjkir/xxeaccl Q.Uv

Ekgge T,zf R,wffu T,zag T,^-0,mc-1,lqw,.omvc W-S,B

MSGALL

Dl-2,`)aajmd`l)k-1,dd,-hbeh,.ch-3-.,mhdbnm Q .,m`ak1).9T

irsoMsgDialog

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoGetRegKeyInfo

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoExecuteDllInProcess

irsoSaveExecuteUsingCMD

irsoIsMutexExists

irsoCreatePipeServer

irsoStopPipeServer

irsoSendDataToPipeServer

irsoSetDebugLogUrl

irsoGetDebugLogUrl

irsoGetWebBrowserHandle

irsoGetCurExeCheckSum

irsoGetExeInjection

TExecArgs@

iubnyybRolkanldf.RW

b-1,[-1,e.Hv

.html

H-4,njBdi-2,o-4,r.vY

Z-2,n`h,.ck-41,nmnzbj/cbzgac,.,-gu-2,`\biF-2,F-34,Gi-20,okbjj U.bj

-4,fhxXahcxgw.rg

gghYcjrf.ae

jehGbeags.qB

PIPE_DATA

PIPE

LNYCD_^.eP

HMVH9>.PE

Qcj-1,`, f-2 U,j/-1,`lf-2,qyv,.mjle U-4,`,.uyjx`e-0-.,M-4,bbPB/Lwdx-2,`y/agajmq,,-1-.,LN8,.cjcbgjle UV,/hdbcka, -0,a U,yjcj-2,j,.l-4,/ V,M@JWZG@MDGPCDHGGKN VP.j0

 P ,,f`cxw-2,m-1 T,ie`a5,,.oG

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

Hbdkkg,-sa S-3,fxf,-sff,-ealytzqlw,.edkk9,--2,>

THtmlUIExeAppU

HtmlUIExeApp

Tfxk T,lgcinfj T,zfej`-4,`>/.co

Rfxj R,T.sm

=,,@cs,,uit-1,hbti W,jh-3,j,,hxoiu,,nbtxfbdi=,,.BB

Cmfzjf-0-.,kmzzcmjk R,jg,.VF[CKMHZG S,zzcdl,.kp)mwq-0,klwew R,q-1,`ljgi,. S,jalw``wjgi,,,-.d,2

^bra,.xgvxnp T,ZBOAJ, MQZ, ,. T,mjl S,z, faznpigeg T,gm R,pfnpa)x R,e`dvlky R,m`xve`hg T-13,ljgee*,.hmjzblqgee* P,B.9

ung`.Nr

HtmlUiExeApp

gbo`dhfm.cV

irsoExecutePackage

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

irsoReportPackageInfo

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoGetPackageExecResult

irsoGetPackageDwnldUrls

irsoSetPackageRelProgressShare

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetOperaVer

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoReportStart

irsoReportInfo

irsoSetExclusiveExec

isroSetReportUrl

-11,jycmjaOaahDgvyc-11.Pg

Xfm,-xozjiz(kc-1,(l,,-2,`b-3,zkxx,.a-3-,,`gy,,kpd-4,z2,-.Sg

Xy`mmx-1,]kja,.LI/m`jaimo/zg, ykzxfaf1/.j3

Jfa-0,klv]dhk,.CK U,mohkibm U,zh)skuzlai3 U.`-L

zfc.bz

]no^dun.Vx

,. P.tb

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\GCAPMA][.oj

TcUlue.PL

W`mmqzeon,.wvamaff P,4.]

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

e-1,f.Cw

-0,ilCcbd.LG

)h-4,k.bR

Ukszv.ra

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

FbghLbtaYhe.AU

1.2.1

inflate 1.2.1 Copyright 1995-2003 Mark Adler

deflate 1.2.1 Copyright 1995-2003 Jean-loup Gailly

?456789:;<=

!"#$%&'()* ,-./0123

1iu2.iu

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

5.MEO

&.jvB

.jBw*

o/%D.

wJ.Gr

[i%x1H

ty.Tx

wQW%U@

GetProcessHeap

GetCPInfo

RegQueryInfoKeyA

RegOpenKeyExA

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCloseKey

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

GetKeyboardType

"$ %),'8

38000=344

4? 3!0 3!6

&W!%D)*

H.JXA

1 0 .'7(2':

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

&)"%&$&'&",,/- '

944(@32%2u8

.PMDF<7I

2222444424

.idata

.edata

P.reloc

P.rsrc

GP.re

SOFTWARE\Microsoft\Windows NT\CurrentVersion

errorUrl

\bin\SubWCRev.exe

Please login as administrator and try again.

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Clipboard does not support Icons/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot open file %s

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid GUID value

I/O error %d

Integer overflow Invalid floating point operation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:3336

2. Delete the original Installer file.
   
3. Delete or disinfect the following files created/modified by the Installer:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\FR.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Color_Button_Hover.png (186 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Close.png (562 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\4728696433_318161962e[1].jpg (3 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\images\progress-bg2.png (978 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\sponsored.png (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\JA.locale (5 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\BG.jpg (13 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\images\button-bg.png (131 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Quick_Specs.png (221 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\checkbox.css (190 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Grey_Button_Hover.png (184 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Grey_Button.png (183 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\bootstrap_6173.html (156 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\csshover3.htc (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in1C2ACCFB\2AC937BC_stp.CIS (3820 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Progress.png (311 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051959.log (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\DE.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\browse.css (337 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\ProgressBar.png (276 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\images\progress-bg.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051B6C.log (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\ie6_main.css (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\PT.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\main.css (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\ES.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Pause_Button.png (577 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051B8B.log (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in1C2ACCFB\031F9572_stp.EXE.part (573 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\form.bmp.Mask (244 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in1C2ACCFB\2AC937BC_stp\asgnd.json (6341 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\button.css (417 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Loader.gif (10 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in1C2ACCFB\2AC937BC_stp.CIS.part (819 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Resume_Button.png (718 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\images\Color_Button.png (186 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\css\sdk-ui\progress-bar.css (506 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33416957429\locale\EN.locale (4 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.