MD5: 8ed3243981cc3f080d363fc603714518
SHA1: ff52b2cb74a8577f4cc29ec7936154518ad8a545
SHA256: 55c05f15c1c3ef6e56b316778be5d295d51f094eb0853dfa7e3598f1ed78fda5
SSDeep: 24576:UnFuvKWiGH4IyFn09BBvTueRwACHChJmqk7mQouxd1DGoETAwqDxhiH48mFs6tkW:UFjGH4ID/u9AthA6tuxrWDqDPO2V
Size: 1523048 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, UPolyXv05_v6
Company: Xacti, LLC
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Installer. An installation package.

Payload

No specific payload has been found.

Process activity

The Installer creates the following process(es):
No processes have been created.
The Installer injects its code into the following process(es):

%original file name%.exe:2448

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2448 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\SV.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\ID.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Color_Button_Hover.png (255 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\KO.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Grey_Button.png (341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\browse.css (337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\progress-bar.css (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Icon_Generic.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\NL.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\EL.locale (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\images\progress-bg.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Loader.gif (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\FR.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\ZH.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\IT.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in15C103BA\0119C0E2_stp.EXE (25194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\BGD.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\mainDlm.css (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Quick_Specs.png (221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\form.bmp.Mask (244 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\ProgressD.png (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\TR.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\EN.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\DA.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\images\button-bg.png (131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\PL.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\NO.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\CS.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\DE.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Close.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\JA.locale (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\PT.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\hdplayer_32[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Close_Hover.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\ES.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\ProgressBarD.png (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\csshover3.htc (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Resume_Button.png (718 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\bootstrap_39678.html (156 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Color_Button.png (341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\004D61C0.log (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\images\progress-bg2.png (978 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\RU.locale (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\ie6_Dlm_main.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in15C103BA\0119C0E2_stp.EXE.part (1278 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Pause_Button.png (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\sponsored.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\button.css (417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Grey_Button_Hover.png (255 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\checkbox.css (190 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\004D60F5.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\FI.locale (4 bytes)

The Installer deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\bootstrap_39678.html (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\004D61C0.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\004D60F5.log (0 bytes)

Registry activity

The process %original file name%.exe:2448 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\8ed3243981cc3f080d363fc603714518_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKLM\SOFTWARE\Microsoft\Tracing\8ed3243981cc3f080d363fc603714518_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"
"EnableFileTracing" = "0"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\8ed3243981cc3f080d363fc603714518_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\8ed3243981cc3f080d363fc603714518_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\8ed3243981cc3f080d363fc603714518_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\8ed3243981cc3f080d363fc603714518_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Tracing\8ed3243981cc3f080d363fc603714518_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: Tanekemo
Product Version: 3.8.2
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.6.4.1
File Description: Tanekemo Setup
Comments: This installation was built with Inno Setup.
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 19
8c21d4dc68df74c6e5454ae35d4a5056
4bbecfcb71e410a7bff0e9fda0a3363f
c124cdf2a66cbbcd2441979098182e9d
2d68b1b5ae374c3217993e2fc749af8b
3c286dec9f8a7fd22dd0b905cecf2912
c41295c851f1a21c8f5232312299c7f8
9d2b79009f7db742324e9d2d0573a601
ca9d85988590b55a995b58e93fe2aef7
a1136fff7e096f2dc588daf0b79f5d70
0cec8b53c0140b79b8f2d1e19ac0bb6e
8e29baab18cc6d1a931fb0d65ad52a2e
46f2dafceb628717d16a8ef99222e8fb
126935fc3c235f08d45cdb0fbe070de1
64315a878391cdc634f97b223fbe0a0d
883fa136d935e4136fc13a24185882f9
8be0d4da9e6beb0925d11761a02b0200
3720819750c442b43571cc89a9b2a0b2
384f2f30330ec8ea9c2f4f41b1ceac86
10a8133b6949ea13cb4a658dfa3743ef

URLs

URL	IP
hxxp://rp.boyoboyobob.com/?v=2.0&subver=6.21&pcrc=262241384	54.76.13.179
hxxp://info.boyoboyobob.com/?v=1.03&c=a6a2c7b3&at=2017740064&cntr=0	54.154.81.16
hxxp://rp.boyoboyobob.com/?v=2.0&subver=6.21&pcrc=196546332	54.76.13.179
hxxp://s3-1-w.amazonaws.com/Logos/hdplayer_32.png
hxxp://os.boyoboyobob.com/Boboy/?v=6.0&c=455137849&t=5072185	52.48.96.210
hxxp://cdn.bridgeaccesspoint.com/HD_Player_Setup.exe	104.27.185.79
cdn.installationsafe.net.s3.amazonaws.com	54.231.41.75

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET MALWARE Win32/InstallCore Initial Install Activity 1
ET POLICY PE EXE or DLL Windows file download HTTP
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected

Traffic

HEAD /HD_Player_Setup.exe HTTP/1.1

Accept: */*

Host: cdn.bridgeaccesspoint.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Tue, 03 Apr 2018 16:12:35 GMT

Content-Type: application/octet-stream

Content-Length: 30510920

Connection: keep-alive

Set-Cookie: __cfduid=d39388333becaf4c8f7d0ca2722dfd6e81522771954; expires=Wed, 03-Apr-19 16:12:34 GMT; path=/; domain=.bridgeaccesspoint.com; HttpOnly

Last-Modified: Mon, 08 Feb 2016 15:35:58 GMT

ETag: "083f9678662d11:0"

X-Powered-By: ASP.NET

CF-Cache-Status: HIT

Expires: Fri, 06 Apr 2018 16:12:35 GMT

Cache-Control: public, max-age=259200

Accept-Ranges: bytes

Server: cloudflare

CF-RAY: 405cd14da3d68243-KBP
....


GET /HD_Player_Setup.exe HTTP/1.1

Range: bytes=0-30510919

Accept: */*

Host: cdn.bridgeaccesspoint.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Date: Tue, 03 Apr 2018 16:12:35 GMT

Content-Type: application/octet-stream

Content-Length: 30510920

Connection: keep-alive

Set-Cookie: __cfduid=dd049fec8a0b8f57870c3a1b5ae20f40e1522771955; expires=Wed, 03-Apr-19 16:12:35 GMT; path=/; domain=.bridgeaccesspoint.com; HttpOnly

Last-Modified: Mon, 08 Feb 2016 15:35:58 GMT

ETag: "083f9678662d11:0"

X-Powered-By: ASP.NET

CF-Cache-Status: HIT

Expires: Fri, 06 Apr 2018 16:12:35 GMT

Cache-Control: public, max-age=259200

Content-Range: bytes 0-30510919/30510920

Server: cloudflare

CF-RAY: 405cd14fb4478243-KBP
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L...n..V
............................]C............@...........................
.......t........ ......................................p..Pk..........
.q....................................................................
...........................text............................... .0`.dat
a...............................@.`..rdata...i.......j................
..@.`@.bss......... ........................`..idata..................
............@.0..ndata..............................@.`..rsrc...Pk...p
...l..................@.0.............................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U..WVS.......U..E....t...F
..........B..H...H.......E..5 .B..D$..E...$....B.SS...E..E......D$..E.
..$....B..E.WW.E......E..}.9}........E.)..E..FT.........FP.....E.....}
.........FT.......FP..E.....}.......FT..........FP........E.....}.....
.....E..M...$..`.B.R...E...D$..E...$.D$.....B.....<$..h.B..E..Q.H..
..~X........F4..$..d.B...W..........$.E......E......D$.......x.B.RR.FX
..$.D$...|.B.QQ.5p.B...$.|$....E.R.E.R..$.D$. ....D$..D$......D$...B..
...B..U......$.T$...QQ.<$..h.B.S.E..D$..E...$....B.PP1....D$..E
<<< skipped >>>

GET /HD_Player_Setup.exe HTTP/1.1

Range: bytes=19660800-30510919

Accept: */*

Host: cdn.bridgeaccesspoint.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Date: Tue, 03 Apr 2018 16:12:36 GMT

Content-Type: application/octet-stream

Content-Length: 10850120

Connection: keep-alive

Set-Cookie: __cfduid=df03d32049aaf37e4c0f59ec9518acff01522771956; expires=Wed, 03-Apr-19 16:12:36 GMT; path=/; domain=.bridgeaccesspoint.com; HttpOnly

Last-Modified: Mon, 08 Feb 2016 15:35:58 GMT

ETag: "083f9678662d11:0"

X-Powered-By: ASP.NET

CF-Cache-Status: HIT

Expires: Fri, 06 Apr 2018 16:12:36 GMT

Cache-Control: public, max-age=259200

Content-Range: bytes 19660800-30510919/30510920

Server: cloudflare

CF-RAY: 405cd156e5d28243-KBP
....C.5.0...e...F.#.[C0Mh2.. &..3!.f....R)..6(..D...S.2.... "..&......
E..0/. .......?.....R,2.#..RE.@.O....q.A.|g.`...[....=.8.d{-\D........
V..NKD.[.v2.{..3.,Cy... .....6...'......dm.`.#E....x...x....*R.5{...#.
...%.....L.. ..&...........^.eq...*SI.1..........~v...k...(......?.N..
 ......v.....=b.g..<*.....b.6....=.dO5......... .......<....g...
.Y..%....\....#.&.=...G.3.....:.............o.DW?.%7...'%..,4.s...H..B
..'". T....A..C..b{.*(4v.|.W..B.:.6.....,.... .......x.......R-....%A.
...........$...m....G....,.......&..F).g..d...EKF..:f......3O..u...)&g
t;.._..........Rx,....d..].'8=...^94...p...#.vcNC..p?...$k.M._.@D.9..\
.l2V'%m.U..Q..~..3.F..RM:..~.N.:..........T..%...A......&.".V{p...P.v.
.....G...Y>.T$....qD......}.> .w..*Plr..E....-w.gq....'..7...H..
...*cK..5Je..#g.Z.n..Ie2.w.b%.........t..h.i3.o..:$).o..S..#..CE..s.o.
.9Om.l....).AOr.&.../..3...h....B-.....{Y`..Ev ."..\.....C(f........g&
lt;L..P.2....A...i.&6......J...G}..gKK..zNV....N...q4...iI.l...S..Q.R,
...f.2BR....ND..O...%..9.._(.L5%..I.kP...=.X......p y.<.......$.M.Y
...t.......l.4.G.C;"...%*sV....r..............."t....,.py.UM......m...
....a...r.......G.e..j<....f..zn."-.......?....T0....]<....~..;m
.WSR..........{#..u..y...>r.m.AQ...d).V.it.._../C......z.J...@..p.j
....ZW|o}il.(..hY.....>1.R....S.H.....`....OV.9b.P..r...?.....u..b.
6.Q..r...7......!.wQ...u...f......7....*q .O;$.i...<..!..<GO=...
.v..X...E.9.%.C..:]...!k._.E...e..".:^zd..d.(>.)..r.\0'....T.\.or..
J.. X.....3[.....A.x."eI....9....U..<...t....... ..e.....F.#.Mz
<<< skipped >>>

POST /Boboy/?v=6.0&c=455137849&t=5072185 HTTP/1.1

Accept: */*

Host: os.boyoboyobob.com

User-Agent: ICAS

Content-Length: 1392

Cache-Control: no-cache

.I..~...$$..........$.lq..l .7x.HJB..Q..H......af.....}.k.b..l....Z}....d~.c....j..........pU.r>.X..o..M..tt.~u....=.......9.v...9I........J.G~3..7..[......#

D......$...s....F.7`E.:..Y(. .j%'d....8X(.J.......@Zt.6..g.y\.|.l. .g"G.....Th|..H..U.NB...1.(E.0?j.E....F#... ..M. V....[..6TD.2...xJ......E....J.....X...-...0.u...89.o...r.!......k..b..:..'..EM..&...J.$k.^.........R.T5.B...%..fu......u.5....N.'..........<jM....,...$1.........L.BJ2..c...U..cc.!..1.C...HQ...K.E....?~.T.C..l......d/...w4....$...2....;.7..L.....`|...uE..5.L...$Kl.=....-'...._T...P........j...........!.,....a.(...e....b..f.\%\...s.[Z_.... ...../)....]
.....1".|`.I....Bk...r^v.<..........e_.u.1@s.. .[J..
.....\.Xg;y......1.....D.E....o.....C1.....I......}.l1>:.4[_*.0H}..'.....4..3.9..A.WA...IB.....WJ.E.s :.PG8S....Z..Q......!*e...F...>4.K.F.'...I.b.E...R.J...cm...%........-H....;7A.....i.....,.<.$.

.YT..
.Mn...}I.....WZ6.._W..:R.p~..`.n...._.(K..U.. .C..>..&....;%.1.0........{o.G.=.)[xvo.M..~y.fb....W.W@.e [8t.-..p. v...R....i[.{:k.V...i!....zU.8\..r..\_'IU...vB.`..`.qk..?....,..t2..*  .J...k
......o...w].a5..t..8.N>Z.Ur.....y.R.....en.>.j...5Lm....m.].J=t@@V..Q.3.K..#.2.?..m..`6T...PN.O.......m..Es.....D&.S.I&.0P.U.72UC.37.Z.O.[?.`t.44SZ..........h7..O6(....9}

.@.V.p.GJ.Uf..8....x..m<0z.l.QK.^J. ?..R.......@......6../......d..F...Q86.l<........Z.&
HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/plain

Date: Tue, 03 Apr 2018 16:12:33 GMT

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Server: nginx

X-ICSCT-CC: UA

X-ICSCT-GICSET: 36hotfix540

X-ICSCT-IP: 194.242.96.226

X-ICSCT-ISP: Pitline Ltd

X-ICSCT-ORGANIZATION: Pitline Ltd

X-ICSCT-SERVER-NAME: ads-slave-1123-production-eu-west-1-i-02909a0d63e24924c

X-ICSCT-TIMESTAMP: 20180403111233122

X-ICSCT-VERSION: 1.12.3

X-ICSCT-XC: 1f3cfb072bc5ded412eb0f20eaa0b3fa349c056a

X-ICSCT-XS: 4eb2a71f144207bedf4780e5a4e4f0d4c17ad472

X-Powered-By: PHP/5.5.38

X-Robots-Tag: none

transfer-encoding: chunked

Connection: keep-alive
3606..qZc.n.k.n..H3.H|.............\i....Th...]....?...pi.N.q...A.YV.V
....M. . ..?...2uGt...JL.g...%.z.....n..Eb.........Z../P....9.7,...t..
=..m.....8.gM8.g..f_...>..4....w<.y...iX)(........... PNp.?N%:T6
...7...^...........\7J....U...<.....k..'..Y......K........i..N....P
;%[./.).a.......g.........!.8..y~fZ.m^G.."...`..4....^..0.c..?.r.[.UW.
..V.....`..K*<?X..|b.6...:...W..._..............."...B....K....).v.
.#.o..P....AX....%....ya>..B..y#@...&.`j.....^6.P........8... tK1..
..$...Q....,..2~=......./..0.<...=.......k.}..f...Y.zO.....e&m.3W.Z
.N.5..B_#q(=r..{.Wh..6n... &."....IF...I.~..W....wR..Kq*.b...}....,We.
..6...s..0.aEv.#e.E.....8.y......#.m7...V.....<.G...b.b....h.3..0..
...1.j.m...vt.v.$..."...L.v.B.....z\..R.........V.....Ufi[.......[{..1
....5.ity...{.*{}/.1..l_..EC).,.......jE..T.En...i...r..-.9._....`.ja.
.jc..i#....pla.I...n....H.5......ne..3....21.c....U[..V....V)[.. ..X..
...Y........B.-<..n.D.(.J.......Ga....2sMQ/.J...I.......[......X.D 
.J....J/.J.&;O...iq....6.I.@.....B.F.T.Y.f.....V...2.....*.....j..}..H
.......F.-.J.....Z.I.....?T?.,.K...j.b... ...N...!.O.....2.H.....v.I.n
.r.....2.4.o.7.......rN/$J........h .I...J....v.k..."..2...'.8a..( .D.
.r.^. .Ja.......H..C.-.bjR...i.2.W.....V.YP..9.....V...J...>p..s.j.
........r..e..N.D1/...2.....R...ZQ/\J.&.I..Y....2.%R. .e.... ....`.o..
Bt..e....]..h..]>..$....Q.....NU..P.s.*.Ng..j.8E.[.(...,...........
~.O.q........3..0.0-..g..7.p..$.....c.f...B..a"N.w...........N.d.T.8$.
5._%..a.(pcb%.m.  U.....y'Q...JFM...........b.k....0......47.?..w(
<<< skipped >>>

GET /Logos/hdplayer_32.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: cdn.installationsafe.net.s3.amazonaws.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: 2 Ar0agYCre1hS7qijy0NFsVD6noa5x3H4F3hyDRAqbj6LsRmIH88EWkKaVNusPRusgGIhmAchU=

x-amz-request-id: A3E72E90FCA76982

Date: Tue, 03 Apr 2018 16:12:34 GMT

Last-Modified: Fri, 05 Jun 2015 21:55:01 GMT

ETag: "3f0966bf89aaa37f4cf4b098eb6382a8"

x-amz-meta-cb-modifiedtime: Fri, 05 Jun 2015 21:53:49 GMT

Accept-Ranges: bytes

Content-Type: image/png

Content-Length: 1508

Server: AmazonS3
.PNG........IHDR... ... .............pHYs.................tIME.....51~
 ......IDATH.M...mW...c.u........Z...... A.....V.. .6.Q.i.[.Q..M .I...
H...}...w..k.a..~Z.......s|L.{. DdI.. Z.`. A.. .h~.. Q.pR..@E.5.j=....
i._..Z..........V.....e.  ..Az..D..@....(v.4..B.....jNLZD..P"........T
2.q.@.ruX..im..RzrL3n[.$4.[.....X.&.YMl.........t..^z.`..m_..x..x.c.$D
.2[....B..^<..~.H.le\8..G_..O..U.'W.._.......45..g..$I..0..?.o...(.
.q...._.5.....5...#zH.D....D..N"...X<.z.5.7n...D........S.....C%!..
. .)H.1<8.......h.j.=.Y.%.......!.."..E.'..6.f.22D..~..1j.nn...X.dG
4u..g......r.YJ.,.`......'1B.G.. dlE0..,;h..q^...X.YQ.....8%.....8xz..
q..'! 5gV.S.X.M.!.... L....'S|..}...}Ak...<*.,.$......77....c..vu.R
..NI.......O.'...!AA"...bs.....}.c.Vj{.65.9.H9..7...N'...Mch.- . ..KD.
.J..90..8......Z...........nV...O......4b.._h......Z.....aP..zZ...?p..
L...#. .|.$6..1h...d....)....q.".?..7..&";VA.....H....j..X.1.X..A.h...
.....ZP%.]....S..[.d..GJX.....5S:Tb*....~{~..Z.....E..j)S....C...z.x..
.....'..N.P..O.......NK.L.V6/.vA.b...p..j.I..yL....&Y.}}......K....G.w
.2....^..Gf...q..)..4..%..HN....w~....._.~....../u..*.bp.-S.%.,..../.j
.>.3.YKe...7?......w.U........y....s.I...g...K........i.W...J..?wZs
>\.w...../^.Dns..x[.H...Yi..&..P&F%"Gi)..:..^{.u>.x.......o.%.S-
..ViH.......G%.*....(......\......k.........?...o._N..D.....F"..&.z.g0
-...FY....8...]...h.{.:..;..Z..*..-......,vU.5...k.p[R.............Q.)
zU3j.a.....O..l..asV.-;G..,..of....6.o......x..]..f..m..........[J%.d.
.lb.{.:D.K......:..}...}..Y.S.....,....V..b8.F"....IEND.B`...
<<< skipped >>>

POST /?v=1.03&c=a6a2c7b3&at=2017740064&cntr=0 HTTP/1.1

Accept: */*

Host: info.boyoboyobob.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 172

Cache-Control: no-cache

6l7GU7LYt04pVHc/00d7JszCZa0UZ/qb5E5l9BLo4bUPb5bOfhJNwYc8XVZ GxaWEG650M4VjF8LDjBAzKWMFHHB3j SA8Z1/X6D8MxLk2ZhICf6AeI0d iSOEtM3RFEvK3FxCS0wVz/wo5Or9PdyOeoHf15QOFdQBUT8fpzFEo=
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: text/plain; charset=utf-8

Date: Tue, 03 Apr 2018 16:12:32 GMT

Content-Length: 2008

Connection: keep-alive
 rc4ZdYQ2RL8K8oY5sLHRTFQ8TVNdGb5GaMsfTGACY asAiuAMlyBv2 DQdPBaaFUHJT/W
bB0pNjHwI0eW2rnaH19wGcgM/grBBrgIo2mzBsSilZjlmaUiISCIrp8SHHWgTbV01QVYMQ
6cAtoeTuxzCGf5UtNnTQF8cYhrsWO4UBUkUZoNsrZb9ihTQCJSbLbjnjMOFpD9B6RS2FTQ
Hsb8aV5sTHJrN65WiK plwzSqYQv7QzG PSMi2ja0M79z1rS3X80PSxquyzAwzkjVc1/KG
nQuCTQoxG6R8ctb/li6Bg90fTHkbXPXg/RBDZqvhBG9uodZcNdv0P5mSh4/1G5XvpWcZod
icbSqiVyHA9CJZXfA25Ql 3nMo782a7Bir6uCio7S8nhxeIVkvftcKYnqa7z/KofJFrBy3
suX/n9rQ1ePfYKqQxkZ6rjgpMFNQYub1MRiQ8gN988hCGhzhYVEMTETgZmMOWmDD6oEj83
ZcVgF/1/w6sP322B2nOCPUHbeOnz3akczGtB7BJ7JBk6A0zmHWvPdZK6zHfqezJJWDwlCs
w52DsQeYHwBI4WlR8cH7tBpw/XauCUCsxAUKW3lW tR4MsLqNKYSTskdWdDkf4NviwurQm
RHLCHoEjr6fso6XHXUJkQhcfyqJ8AT1vRmyJE8kclWTGl1DvqtTqQjPA2NMkIpq0fmEJ4S
lKDptq3/dsZqdmrjVtbEwjNbvYl1BGXzONdxZxuRnNg5MIJGK9cWe5jxcQxFLCW04aHMhc
63muqFae6wGXMwGKd9KYXjBQt gZ9vlOokMJWXz45IW4Jr9 R9wVCmfYO63cDfCSE5sYXP
Nq8sex 0C/ciJE9DYHCRT63UapVgtyZkRm7L6rdWC/gEvg4s2Q7udabT/4lm8j1dMm7Wbu
c58jLPzACjQgQV/Zvy0GuDI//839jw 94UGV a1CBaHX0i5LCMJ O OfUOxRXyqqomldTA
Gxn 6zYDnZPeeif6kRIoi0sB OzijdydlAGvnz XpsXi544894eoyte9W/tau6D65ahN4m
/FfHbyE8UwqaABlzHkjpf37YZtX2jjHMVCLx husCrxwrXZrln8bX/6hlHQTVwT/Wkcgw0
nLHC5kYuzxI2YVWPmIActCWsSjJyJobCGUFhV j6Vs 4jqIS0h0keytcPNmQXWoBXRXC/C
GPn Ay7Tkxj  tLp mABWNC/67UCIb3WKFKRJ/Iy45kd76E2masP8aTYRMP6a/q0/jdExM
GZAVr7G6Id49wRnrm58CQcldOQttyRyROMZ7I4WdAmiEZR9Ksxvy4BRAknuVgTFvf05x8p
u6nQRupgGmIeiI900mPtVBb9I1JIOdqbgRFDPMovWbTI/YWD5F54zzB9veK9tDkM88z4pO
pLHoYYLm4h58BqamMB/Gx Q2C6pY/POS9C4R2mIWYlYo9WKhfvlgTSrQJNx14OTCbl4Cem
DKgPLSK2yCe6Waqppz4/F6TJdamzbxZB/OJ9ZcoovzkIdoVzDd4SIqqsq39HxICqHt
<<< skipped >>>

POST /?v=2.0&subver=6.21&pcrc=262241384 HTTP/1.1

Accept: */*

Host: rp.boyoboyobob.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1952

Cache-Control: no-cache

...3E.Q)_l.y...K.............f..0..<.........7.....a..B'PU..d&.........7..<.C..i...t...^.z....1H...I6./L..-....!J.S.5.....i..........{.u..
u.....@..H.....,...4.U.I.....p..Z..O)..w...7....G...4..b.....`.08....w......l.%...`
..i.M..K..b.Y=.o.=X..".r....

_........k<.TG.-..t....9...VM..g.}.5mGS.:.. ..a:#:.S......]...|N$.
#.mk.>P..K..........f9.....{~MXTb...#........f.o.Y..k.....!.H-....R..*...}{BU........./...'.D.m...?....HX.
Q.....%v?....2..

....I
 9..9...A.6..on.H..._.w.uj^..D...>..5.i~.9.V
.......x.Y.&. .=.r....z.......).5...BJ..x.....T..cAU...
.k..*..p!.t.K...[........a....[7...CzH^....tkNC_....g......n...g.S.[6M.i..B....-B] ..nS.9..}...|'.G...<....^{.SV"....Q.z.....\."2.t..x...N..>z.^m..z..LiF.*cc.._..qS;P.@Dx)..#..3.dI..!.T k.p
2.H.)....C....
:..'.X....D^.)C...{K){...Z[f3.m.a.M....n..f.v.....)qR.......bK...<...[..qO..>v........7.......,S......7..Jm.......Pi1.&<:...R.=m...Q
v....[~L..

UlT..rr..u...E_...L.1..]....y..4&aL\....~.....m..E.1...X~..L.$6..<|.$....K.Z..5Ux.n...1/.......-....G:.......$......G..6..}-....uN....... .C...........B@.0.2......c...lz..e.........k..?....0...Q....p.1...U...:p(.
..$

..f$..d...c.s...cx

...5.) K. ..e.-..d.7..>;....6..,.
.P.C.....r.V..9s>.(.b........Dc..`.8T..u..7...&.BS...&.{.@..bC....$(..N...R......%..~E....c..z...u.G.
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 03 Apr 2018 16:12:32 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue
, 03 Apr 2018 16:12:32 GMT..Content-Length: 4..Connection: keep-alive.
.DONE....


POST /?v=2.0&subver=6.21&pcrc=196546332 HTTP/1.1

Accept: */*

Host: rp.boyoboyobob.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 2432

Cache-Control: no-cache

...4.....>.K..~._....^B2.M.W.S.....(st....~y.7<......[.S....L..<xk.[....[.\.s.OM...MO.....$.N.]..... 60-...:.\...l...U.....cO=FM.. IC.

..c...X..pu.......|/.V.....!.. {....n4i.].A...?q<.e...@......V%.
.[.X..9G..[.].^.c...nx........?F.8Sn.&.Y..1?F,3...5LJu..!...TMh.....|.."3g.q....t~....?.?w.L.3..?..?..z.9....t
?\..

.=..M..e...U.0.H...#..;:...R.]1C$8..#\..*...........
W.\.-t.{..t.2....9...yEt((.4....@y..7Z......!]8B$D.4n.;....M^'.t....C..,.l.-'(......$s?...v...t..|...

X...........b...P...V.Iu....<s...e........N...\...y.[b..)./K.n;Q.Qg8.....

m.........h.....{RO-.. ...{.. ..O...C.i.6G...F.;uI:.l......,k....{........s.b.~{h....r..A.....m.-.i.e...EBy.....j....~ow.F..X]h....%....k.$@.TVv!e|.z|.A..!..*b.......=..`..%jF.I.m....d8*...`i..Z J.R.WV...
v..~.....mc....<yE....|........t;k...._.....h..r....v.P,o.=...~.,.KI..7]........w. .X....3Q....0l
3.Z....G....Zz...W..G{.....f...I5.c.c..".H.7....<.=...8..

...-......T

t.x^...bH9A...o.e>.lu..r.X^..P...4X..#...$.*k..../.....{?[..........k.p./..._... ,.%..).sv../..ymn..{....

Yj>.ij.i./..z...6n*$G.EXVe..^xj...........%q...I.SmS....E...NK.?g..#"qxP... ......i.$7_..nI.....Y.p.....%..M/....~/(......BU...T..(.;.uAi.zt....g......j..]..
......U......oT.;S.....?.I_......43.....^.l..L]..wb..G

....P..1..L..k.K.....!_..n..!.ao.D@.R(.....
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 03 Apr 2018 16:12:32 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue
, 03 Apr 2018 16:12:32 GMT..Content-Length: 4..Connection: keep-alive.
.DONE..

The Installer connects to the servers at the folowing location(s):

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

LzmaDecode failed (%d)

shell32.dll

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.0)

Inno Setup Messages (5.5.0)

mu2.iu

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

3.6.4.1

3.8.2

%original file name%.exe_2448_rwx_00530000_000BC000:

.rE$h

F8MsG

X%xo"

:H.Vk

0*,%X

HUrl

^n.Va

t%dTB

W?D%c

D.YMY

.PnOH

%dN8T

8.Zhh

2,eXE

TE.qA

y\K%S

/.ET>&

V}.Xh

%ug5zR

td.kT

G\F.Yh

9.nz!e

key6$

R.Nn#_

.kE}/

5Éji u

:%dR_

WQq%u

0H.ZZ

x-u}J6

2.VDEIww

%U.#,"

dS6Q[.Mo

Kc.Tlp

Nsz%D

=.tS{

\%UP'%,P

BD_.rAy

9!.VJ

uP^%C

.dP`.

%2XhL

_%Cts1

lg.TG

.Ua*C

V.UpvL

n.UY9c

%u {'

~n%s  

%F"~8

 F.dS

:-b}uF^

5i:.aEy <

JÍ_,Q

W%c|&

y{u:.Fv

%original file name%.exe_2448_rwx_012F0000_000C8000:

Y1

-t%F>

Hw8p%.C

%up(&

 <%xol

N.FWS'

.%F(K8Q

W_,d%sr

.Dt9b

:2%UA

.YIc&

]%D-v

.QNkb~

w.HIsnpk

.YI>[

.EHAt

YG.EI

3LJ%Cs

l.XH"

h[m%D{

.fs;7

QJ%U#

Kd3@d.Yd

B).Jz?

My.OH

.nY5N

z.Gi3

.YT|#

e}.d%U

ZqP%u

>A].NM

nOO.aV

lw.dQcXWf

-y}gIa-

'%xx^

%XV2`

N.wqL

`Z.zo`gaG

pXT%s

jGZ0/.vJ

;.jPLR

y-h}-

.yOJC"

.jj`h

Mg%4u

R .ZT

.RriM

T%Xv#

.GkZ>

{[vcD.KI

N.kHZ

U-dcz}

.BDde

d.EDH3`s>

hp .Pre

.mM4d

_'.Gt

Pw.TFhb

.vxO*f

~p.SM

\Ftp-

bWeB@A&

`%x2q

.tx;0

%original file name%.exe_2448_rwx_013C0000_000C7000:

%XKo|

-.WM7

x5.yz

wEb:e

b.EME

.JyCHj}x

.xaI:

Q)Mg%c

%Lw.%c

A}$.Fb

F-ŸU9

::kG.(%d

.utCn

6%Fo)N@

.KmI~^R]!w%

:p'[7.BAi

"'x%X

B%CnYD

F\[%FO

sJ.kT

m;.vd

'&.Xt

s @.TVJ

.FpCx

-mz}m

.uWjh

gK.Ju

hW%Xo

:..zy7

.DqY=

xQ.Aol

;NY|l%f

.ZUE&I

-p.XF

z.HSe

qJ.lb

O/?V!1.KJ0

g$@&V%f

_%X\\

$%sk`

.vcSP

 .aL5

Z.pg"*

"Ïq

V?%C$

ZQ.UM

e3BS.ti

F.jBG

.nb9[p

'^.aD

%x=E>rz

%ULpW

Ww}%u'e

5%*.oM

@a8f%cO

%sv#K

qa2.cU

O?.QK

L$5\.cX

@M.mA

xi.Eb

%dSpG

N%xBmV

*.CiL

ÀNPz

:.Ehz.

aQ.jY

5Y %SL

.Gb:x.e

B/\*%f

r%c Z

%original file name%.exe_2448_rwx_01721000_00180000:

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys

AutoHotkeys\

Uh.fv

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState@

OnKeyDown

OnKeyPressx

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

A`bng`@ikc-4,uUxlxs-4,Ht.HA

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

Portuguese

ZkkdDocjn^g-4,o.ye

^ioM-3,iiziGmwItI.cG

\h-2,Jfal\`dgxj-4.DZ

,-\ T,/.Om

hcl.sf

webqskv`T-Y

oj-2,`ac<<*kcb.jo

ak-2,`ob<< T,jcb.je

Mmed]ugkf-3,ffgvllCi-2,`ah QQ .,h`l`, -2,(cmgiiim(zc)x-1,cjm-24,)x-1,i-4,aayzdw,,x-2,kyll,.al-1,fcm-0 R ,,fzji-0,(mc-1,dj,,km,.h`-01,yy-1,kh W->.I

IN]JVN]K]KJ]B]F^UF@@]\v-2,ujbRBjazsnc^s`lkr-1,`-1,].jl

7Teah P,Ckh`-3,fkgo-2,7*NNYO.uh

1.2.3

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

Jmvgknm Q,2,,<,./accwcxgeni5 W,O_GB R,=>)27,.Pkbjhu-4-.,IV,,8)37,.Spejblx Q,2,,< W.g W

Ecezcb-4 S,Tmeic6.fA

Bc/K-33,`-1.jG

Jbhblnrefc V,H-0,bv-1,li.AT

Uju-0,c-2 W,Ht-2,h-4.Rq

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

ebP-3,dLfnda`-4,`yj-4.PL

,.djxzheo,.bb, jhbj-0,ap1,.-i.Y

Fb`b(bh W,gx-1 W,zh-4,rm-3,zt(l-1,b(-2,ot-0,d``(d` W,X-4,a-4,q,-Chlh,.*(-30,txhmsaci W,acoeaagsq,-zh(iapfaafl,-hug`,.d-241,bfy,.tm-4,xbz Q .,sztgio,-oigyfbz,-FBII,.um-10,b-0,y,.sg,-cfch,.t-24,k)-3.S

Zm`vk U,dvk U,kk,.hjvk U,vk-0,wfa-2 U,fe-3,dghk U,jb,.ajs`ijejlkc RU,cegilji U,qlk U,akykikoa, E^

Cjf`,.o`y`g`oj, -0,f-1,nnj,.xjkcx/za, mk,.m-2,atna,. V,f`-1,k, -0,foe/.j9

f-1 TP  -1,ymy-0,dbl/nc-3,ayhdxc R.Hv

Eoe)r,.-32,c,.-4,fc,.fov R  ,jgzj,.ban-2,h)-4-.,ko-4,mn P.fa

Ja-0,hbamb,.fmu,.Hmobkh*,.K-3,tMahc4,.l.i

,..XN

@ojjcj S,qtgwc V,zl V,g,.eojk/ V,q-1,jrrkm< V,c.a

Ffzfn)-1,(vgum U,g-1,(kkhiqgym),.-2,mvk-0,aki/-1,j,.umwa/ UU,zgav,.lik,.cmdj/fjy/-1,j,.mia,.-0,`l`h-0- D.`

Ql-14,d,--0,ipxl-4,u,-`kob-0,ie Q,)-4,d-44,is-3,)-0,hyacty)DUYY,,Slgkd,-zyq-2,f-3,u,--3,ema)o`xzi Q,if-0,oafme,--0,iryh-3,u S.DL

Vrzvoii R,rok R,bhyljhofcu,.khsa R,Vf-0,qc W,cmbb P .,v

Gl-2,elsktfa,.`jikhbhk V,jk,.Ekp`mp U,Cgs),.dvq,.rk`,.`jik V,mjz V,f-2,guwv,.,  S,lihlwkb S -,nS

 W.OC

Co-2,(Makfkmqaa` U,Zo`bm,.yd-0-.2,`-1-.,zj(-:.i

YV`vk T,lp-1,k-0 R,jql R,zk)k`w-1,dhmjkkj-2 R,jmzi,.wycma UR,aje-0,4 T,)N

[ofdbd W,ra Q,ptgub V,zn W,`gmb*,.hkjkffj,.gnjkofkk; W,g N

[zomm-14,h-2,c,,-1,mke-1,mlx,.fzalm-2,6,..gs

Rhyzd-4- 4,dhf-4 Q,yd,,ch, cty, cg,-xis-0,bod,- S.FL

Jblalnvffc R.mT

 P .,G-43,Mmii4 R.Mg

/ W.Wz

Hkog]kyg,.wmgvrfazgg R,mjblig/ R,ang R,xcowk8 SS .

Kwz,-kd,.`aoa-42 R,yeal,.Khw-2,emli,-gm`caazdkl,.ievo QT,ok` T,pk-1,qg-2,yaf4,-.Y T

XvfjoiNalt S,jsef-44,ola, dfje V,`n-3,ak-0,1 V.n,k

GyohgObgNooedks T,fvbaszhkm,.caf` Q,gb-0,flw4 Q,A.^

]DKizHi-4,exc-1,Hc`hk-3.GI

L_LCUNTF, KHC.op

0.0.0.0

3?:96=>?59:;.ZQ

6?0N2=.Lq

;768>1-80

cabinet.dll

\fgejnhg,.Dhr,.f-3- ,z`b, -2,gbyz,..8y

000000000000

 ;7.Q,>N-Y,[ T,Tc.Uv

 P .,o-1,^ku-4,c`ujZojfh4 V.qg

Cnxn=/.wr

 Q -,Gxy-2,Lcih5,,.JX

Bm-0,l<,,.ZA

Hvp-4,lmp,-H-1,vb-4,4 T,nl` S,y,-hkxcj T-3,b-0,vnh,.bdak>,-.Oh

BmfzBhkk T,vf-2 T,d-4,zv`dzae W,hvnj,.GHT RT,sb-2,qms4.b D

Gabva`x R,kh,,DhoxDmbi R,so-4 R,avxpemxg`,.xm>,.,,._

Y]H.if

d-3,tdcQqdc.Lb

)hix.CB

,.kb`,.new-3,fm-2-.,dmik0,,L-c

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

,.qn`-0,b2.J-3

,.Hzdz,-Tlbxg7,..MY

/x`azk<.Lj

 V,H-3,dr,-Pljxc7 V.QQ

Ovnl-4,znLgj1/Ovb-0,Iaoj0,..ve

CJ[hx.Xu

G`pa-1,`eh,.hemb-0,va4,.D.i

 WP,/koecd`k/yfi/d`-40,lb`j-4 P.ZI

_.Wo*BC-T5p7d.V-b,

Gjufbmg W,cqosgtbuz T,Ar``ob,.vft-3,kmtk T  ,n`bl=,.sN

NAER_[URNDT].Lw

[h-3,f-0,y,.dhd`)yl-1,hd7,.-S.T

Deib`dfk W,^LX W-4,m-2,rh-0,x W,zi-4 W,imbnhl,,cxm,,sb(`fnc,,hk(\ud-3,ekhoi W,@ghb S.CR

LJ_.ge

fxk S,Cym^rk.Um

ole32.dll

Uh-R}

olepro32.dll

IWebBrowser

IWebBrowserApp0

IWebBrowser2h

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizable

OnWindowSetLeft

OnWindowSetTop<

OnWindowSetWidthx

OnWindowSetHeight

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPath(

OnTranslateUrlP

OnCommandExec\

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

hXXp://

hXXps://

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

OnKeyPress

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

C^,-j-4,hc-0,)nlceollb,-hwlnx-0,l,--30,h-4,y5).xT

RZ-3,i-1,/ImznQ.Hy

MAPI32.DLL

LeftPopup

,.Ojjzj?E,.

Fliof S,ganjlgib-3,gemy,.ll-4,`n S,ygd`o,.fbyz*`ecgj-3,zog*o-3 S,xk-1,jygem.e,:

YR-0,xh]izn.cQ

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

Azhi\G U,w-1,`klgi U,lg,.UW@XLILI@ZDAA@ W,U.d

-0,cnyzgcEi.Tc

https

Iii W,vc-1,q`t,.Rwj,.nv V,gisgbna<,.-3,e

Sf[.t,T*.lJ,e

^g`hdli,,Ami,,ym,.xeg,.jbnbczk`k,-W-1,`7 R.I.-

Kma,.Ovr-3 W,pc-4,rguz W,jg-2 W,vocbf V,arv(.a W

Aa`da,.-2,e V-2,aeq,.-2,bc,.Yxii-0,ou-2,)li-1,d T-^.a

M`-0,b, l-0,jj-0,lk1.tv

MSGALL

Afye,,keohndi,,axaa W,lg`b*fmt*hmnfkh, *heko,.bh-3-.,jh-4,`h=*.e-1

irsoMsgDialog

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoGetRegKeyInfo

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoExecuteDllInProcess

irsoSaveExecuteUsingCMD

irsoIsMutexExists

irsoCreatePipeServer

irsoStopPipeServer

irsoSendDataToPipeServer

irsoSetDebugLogUrl

irsoGetDebugLogUrl

irsoGetWebBrowserHandle

irsoGetCurExeCheckSum

irsoGetExeInjection

iubnyybRolkanldf.RW

b-1,[-1,e.Hv

.html

H-4,njBdi-2,o-4,r.vY

-4,fhxXahcxgw.rg

gghYcjrf.ae

jehGbeags.qB

PIPE_DATA

PIPE

LNYCD_^.eP

HMVH9>.PE

Ykifxz-1,v, k`-0,yw,.-2,ncaynj4/Czcc^G,.Myay-1,n-1-.,`idkl-4,)-2,/BK9/mobciomd, -2040,a-10- ,g-2,/eay/n`omgkj Q.yf

Cpcb^M,.Lyky-2,nv,.ainkm-4 S-2-.,BA9,.mebbieme, eb-1,nejw, `g-2,jfbko*.i,K

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

NK Q,RblCwhyr`u,.ejd\dkcCnab4 Q,Q.b

 V ,,dck,,kb-0-,,Ad-1,mgajE@:Imionon S.PJ

<,.Mcr,.giu-2,kkc,.l-3,ic*mha-3,dc-1,*eh-23,mhmo6 V.Ea

8 W,Iav W,ckqtoig W,h-1,mj,.olhzfgu,.gltzoldk4 R.i,r

^lvn,.fifcdho,.ph``jqe4 U.1,^

Eaz QP,MAOVG@TG,,,.bmcc`lj,.gpac Q,dg-1,rv,.-3,smmkrq R .,ujg-2 Q,r-1,abg-22 Q,ugbm R,maovg`tg,.-1,tl`goe N.]

\g`c,.dnuc R,ebhctkz R,qn-3,g Q,sgodc,.mts RR,bf` U,u W,jgub-1,ohik R,ha,.vib-1,g V,t,.cohzjdu,.kotzcodk R,sr`lhiiq,.

ung`.Nr

Jdn W-1,msrgzgt,.ifjgfktzzcsg-3,g W-3,zkqgdg`k-0 R,sa(pr`r-C

gbo`dhfm.cV

Ul-2,uf-0,z@tHjlng4 Q,RHM Q,nz,.enzocklj,- W,h-2,rrdgo`)-3,shjkrt)f`t)oej`` Q,w-0,gwnekfbz RQ,df`ung-0,d W-3,guof-0,u W-0,krsh-1,ungi/ N-L

Loaeoj(-2,e,.zlga-3,l*z`l*,,Rfdk V,@nkf-2,chalx,,(Hfz[-2,xkid-M.e

\iwqo-3,pD-2,M`hgb> U,\iwqo-3,p U-2,ygfki`),.xvd`-4,b`-1,ejb,.okkz-3,ki,.xk U,zda U,`is U-33,kfk-4,w U,ob` U,zivhgbeqgbc U,zdmv,.cj` P,T.I

irsoExecutePackage

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

irsoReportPackageInfo

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoGetPackageExecResult

irsoGetPackageDwnldUrls

irsoSetPackageRelProgressShare

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetOperaVer

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoReportStart

irsoReportInfo

irsoSetExclusiveExec

isroSetReportUrl

-11,jycmjaOaahDgvyc-11.Pg

zfc.bz

]no^dun.Vx

Fe`jlm,.cso-13,lnk,,uk-1,mhy,.ebda-3,`n R ,,fxm?7*cevgoxfb,. T,s.I-Z

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\GCAPMA][.oj

TcUlue.PL

W`mmqzeon,.wvamaff P,4.]

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

e-1,f.Cw

-0,ilCcbd.LG

)h-4,k.bR

Un-4,ojjy,,q-0,j-3,vjo R.Fm

Yozmfk-1-.,ha-0,`j,.o,.-31,albkc R .,l-0,z,.mo`)z,.-1,k-3,a-1,z,. S .,k-22,k`zgob,.-1,k-3,a-1,z,.jozo,.g-2-.,cg-22,g`i P.ii

Ukszv.ra

MNWEZZWHWAE@@5 T,ed-1,mcb/ V.Op

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

FbghLbtaYhe.AU

1.2.1

inflate 1.2.1 Copyright 1995-2003 Mark Adler

deflate 1.2.1 Copyright 1995-2003 Jean-loup Gailly

?456789:;<=

!"#$%&'()* ,-./0123

1iu2.iu

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

WC.mB

.Yl.~(

*%FPg

%DmJEa

M;%xF

TS~%c]p

".XEI

\.UK-

.IU<D

Ï=V

Ml.ZF

=%d_IU

OFM%s#

(Hft.lW

*C.wL

lo$d.kF

.kpWU

t w.fr

5|.lG

@I.RJ

:_,b.IC

GetProcessHeap

GetCPInfo

RegQueryInfoKeyA

RegOpenKeyExA

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCloseKey

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

GetKeyboardType

"$ %),'8

38000=344

4? 3!0 3!6

&W!%D)*

H.JXA

1 0 .'7(2':

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

&)"%&$&'&",,/- '

944(@32%2u8

.PMDF<7I

2222444424

.idata

.edata

P.reloc

P.rsrc

<%X |

#-**(-#,

SOFTWARE\Microsoft\Windows NT\CurrentVersion

errorUrl

\bin\SubWCRev.exe

Please login as administrator and try again.

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Clipboard does not support Icons/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot open file %s

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid GUID value

I/O error %d

Integer overflow Invalid floating point operation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Installer file.
   
3. Delete or disinfect the following files created/modified by the Installer:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\SV.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\ID.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Color_Button_Hover.png (255 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\KO.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Grey_Button.png (341 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\browse.css (337 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\progress-bar.css (506 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Icon_Generic.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\NL.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\EL.locale (6 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\images\progress-bg.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Loader.gif (10 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\FR.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\ZH.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\IT.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in15C103BA\0119C0E2_stp.EXE (25194 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\BGD.png (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\mainDlm.css (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Quick_Specs.png (221 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\form.bmp.Mask (244 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\ProgressD.png (104 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\TR.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\EN.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\DA.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\images\button-bg.png (131 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\PL.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\NO.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\CS.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\DE.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Close.png (207 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\JA.locale (5 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\PT.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\hdplayer_32[1].png (3 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Close_Hover.png (207 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\ES.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\ProgressBarD.png (812 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\csshover3.htc (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Resume_Button.png (718 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\bootstrap_39678.html (156 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Color_Button.png (341 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\004D61C0.log (16 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\images\progress-bg2.png (978 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\RU.locale (6 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\ie6_Dlm_main.css (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in15C103BA\0119C0E2_stp.EXE.part (1278 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Pause_Button.png (577 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\sponsored.png (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\button.css (417 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\images\Grey_Button_Hover.png (255 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\css\sdk-ui\checkbox.css (190 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\004D60F5.log (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH50710933324\locale\DLM\FI.locale (4 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.