MD5: 6fb4d71212033e6f1980c09e8d68d829
SHA1: 5b24bbc56bb31104bc511cb676c404fc5ecedc8a
SHA256: 7f4f9138d49a10f32c8cb1aa0d54e946252d07da4ad96223ed4b54ab42ec88bd
SSDeep: 24576:igIkb7xH5w UbKzg11GrxKsJSSDNU95dexu:0Y7xZo2k1QnJc95d1
Size: 998568 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The MemScan creates the following process(es):

%original file name%.exe:1612
wmic.exe:1700
1_Offer_3.exe:580

The MemScan injects its code into the following process(es):

f.exe:1604
6_Offer_11.exe:1272

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1612 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\f.exe (148472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsAVG3rs.dat (27625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv7E.tmp\Convert.dll (3005 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsv7E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf7D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsAVG3rs.dat (0 bytes)

The process f.exe:1604 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\jquery.min[1].js (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6_Offer_11.exe (858796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\dc[1].js (1657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\jquery-ui-1.8.19.custom[1].css (5521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\DynamicOfferScreen[1].htm (1140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\AVChecker19-6[1].exe (11154 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\Setup_product_4031[1].exe (1365779 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\DynamicOfferScreen[1].htm (850 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1_Offer_3.exe (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\jquery-ui.min[1].js (10441 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (0 bytes)

The process wmic.exe:1700 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (238 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (0 bytes)

The process 1_Offer_3.exe:580 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\Registry.dll (25 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\NSISdl.dll (0 bytes)
C:\ping.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst7F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\Registry.dll (0 bytes)

Registry activity

The process %original file name%.exe:1612 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 7B 2E 8A 1C E5 CB 0A 17 EC A2 D9 B3 EB BF 30"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process f.exe:1604 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014111920141120]
"CacheLimit" = "8192"
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014111920141120]
"CachePrefix" = ":2014111920141120:"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014111920141120]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014111920141120\"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014111920141120]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 81 46 B4 90 37 7E C0 08 03 21 5B E3 F0 BB 72"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The MemScan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013030120130302]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021120130218]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021820130225]

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wmic.exe:1700 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 4D BE 9D 1E 42 19 E3 EA 3F 04 13 FC 1F 89 E6"

The process 1_Offer_3.exe:580 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 49 74 0B 00 A0 18 75 F2 E1 D8 39 8C D7 C7 FE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsj80.tmp\Registry.dll,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 6_Offer_11.exe:1272 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 B8 32 62 09 DC 26 F7 1D 1C 1F 65 62 A7 3C 19"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: Free EPS Viewer
Product Version: 3.0
Legal Copyright: Free EPS Viewer
Legal Trademarks: Free EPS Viewer
Original Filename:
Internal Name:
File Version:
File Description: Free EPS Viewer
Comments: setup Installer
Language: English

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 51
74456cb71d2eb9920578ebca2d37fcac
4dd77fdbabe4f48f715f082d7d78d398
f3d700837f49459fdf0e010cff2bf270
f12b3ccd1cfaf555f36b9775fc8b1c10
971baf15538d2332a9dde086bea3f43c
2571c15e7c714f080e569bf65c460295
d13af9456cb439115ed7b0dc722b4460
c6c6b85b4eb92d1d369667fe857157e9
f589650579070c81f3e2c5201e697d65
938ab6b8f75e486a42ac15b506e7b5e4
3dcd6f1c69fcf2c3f4cacf13e5d4bb06
1421856bb70a44eb4c9db014f32bb0cf
7b27cd0cb3bccfca345811b6d1f8b461
888c495c20e3366d3479d31a00e41315
79e6cd4e65e2b5ba7a9e0cd862744cec
777127e2b2ed1e867db21248de6f9bef
91a5ff02b550418e7529758f18bdc62f
fd5dd6efda8498847f7f224b2bb745d1
64ce102a347e4884ac9dbe87784acf1e
32a513a63570b079b3937a666ea23a14
988a4de244bf4fb45c88e60e0a9bee76
10c3829a4005b921348b6fb858edc94c
6aa1cfcefb224b400ed3cf351483eb8d
05fdc704e8d62a4c8868439c38a585f5
4b5673bcf415ec0c4dba4d6c0f21f17d

URLs

URL	IP
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1	50.17.229.113
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/Files//Setup_product_4031.exe
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&	50.17.229.113
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.5/jquery.min.js
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js
hxxp://64.233.171.154/dc.js
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bgImg.jpg
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bottomLine.jpg
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Track?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&reqid=164520114&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=4031&offerscreenid=&offerorder=11&downloadduration=6250&installduration=265	50.17.229.113
hxxp://smartinstaller.elasticbeanstalk.com/Installer/TrackFinish?reqid=164520114&x=y&clickid=	50.17.229.113
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/Trackers/AVChecker19-6.exe
hxxp://smartinstaller.elasticbeanstalk.com/installer/GetTrackAVs?avs=0&reqid=164520114	50.17.229.113
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&	50.17.229.113
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topLine.jpg
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topComp.png
hxxp://smartinstaller.elasticbeanstalk.com/installer/thankyou?productid=4031&pubid=707&distid=4235&countryid=71&reqid=164520114&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0	50.17.229.113
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bodyImg.png
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/nextCase.jpg
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button_over.png
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button.png
hxxp://smartinstaller.elasticbeanstalk.com/installer/ThankYouInner?productid=4031&productname=Free EPS Viewer	50.17.229.113
hxxp://n20.adshostnet.com/js/show_ads.js	212.124.112.251
hxxp://n20.adshostnet.com/ads?v=1&key=6c2c19aff050b202bf7c7970cb59cde3&ch=&click=&tz=2&t=1416402832199&scrWidth=1024&scrHeight=768	212.124.112.251
hxxp://n20.adshostnet.com/impression.gif?b=22&p=11&ch=&ap=&cps=&c=21&l=CA&h=f9fbd1ed42595ac2ffa20c9cbb973f78&t=1416402832793&s=8c3775c9dd22ebc22c4d271ffd13b295	212.124.112.251
hxxp://installer.apps-track.com/Installer/TrackFinish?reqid=164520114&x=y&clickid=	107.21.209.254
hxxp://static.revenyou.com/offers/images/Theme8/button.png	198.232.124.224
hxxp://installer.apps-track.com/installer/thankyou?productid=4031&pubid=707&distid=4235&countryid=71&reqid=164520114&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0	107.21.209.254
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png	64.233.171.95
hxxp://installer.apps-track.com/Installer/Flow?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1	107.21.209.254
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css	64.233.171.95
hxxp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css	198.232.124.224
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&	107.21.209.254
hxxp://installer.apps-track.com/installer/ThankYouInner?productid=4031&productname=Free EPS Viewer	107.21.209.254
hxxp://stats.g.doubleclick.net/dc.js
hxxp://static.revenyou.com/offers/images/Theme8/button_over.png	198.232.124.224
hxxp://dl.revenyou.com/Files//Setup_product_4031.exe	198.232.124.224
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js	64.233.171.95
hxxp://cdn.download4desktop.com/Trackers/AVChecker19-6.exe	198.232.124.192
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&	107.21.209.254
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js	64.233.171.95
hxxp://static.revenyou.com/offers/images/Theme8/bgImg.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/topLine.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/bottomLine.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/bodyImg.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/topComp.png	198.232.124.224
hxxp://installer.apps-track.com/Installer/Track?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&reqid=164520114&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=4031&offerscreenid=&offerorder=11&downloadduration=6250&installduration=265	107.21.209.254
hxxp://static.revenyou.com/offers/images/Theme8/nextCase.jpg	198.232.124.224
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png	64.233.171.95
adservingsolutionsinc.adk2.co	23.209.65.31

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
SURICATA STREAM ESTABLISHED packet out of window
SURICATA STREAM Packet with invalid ack
SURICATA STREAM ESTABLISHED invalid ack
SURICATA STREAM FIN out of window
SURICATA STREAM SHUTDOWN RST invalid ack

Traffic

GET /dc.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stats.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 19 Nov 2014 17:15:10 GMT

Expires: Wed, 19 Nov 2014 19:15:10 GMT

Last-Modified: Thu, 13 Nov 2014 21:10:00 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15853

Age: 3921

Cache-Control: public, max-age=7200

Alternate-Protocol: 80:quic,p=0.01
...........={_.:...)....'.$..&.......-..Ms..e9..'...B.g.3#..........3z
?F........z....n.h..@&b.....v.W.A"...<8H.^.....A*......3....~..X?8.
...<..t..)d.......Hf.Q...._. .,`.....a....>...?...v.Aq.G........
.p.........a$y&.....sX7p........ ..M.d..l.K.....t...8..i6....C..XO....
.@....!.....RG.l .}....b$c..B|8..C}!.8..=.e.K....{..K.9..a..nx......%.
.;..F...J...v..n!.L.....g.C@...~..|...=....q.9n_...P.....Tw.o.........
..k.....^:.....O!..b......=...B..,..j8......k.b./.Y..JE...({k.........
(.L..@. ...b;...s.f...k../--..\..A.M..he.q..u.u.$..<.....$......eBf
....,...r{.[.....h....Tup..$?F?2.... .qk...x..;.......}.Y.[)jL........
.}.4.'..Z_...bms.._..I4.r=...f....U}...|......].FG..\.[9...hp......"..
L..J...a..l.=.C..c.............i..2&.......{....T*w..%#ey....A..`.T..Q
.w.....f2...,....J...y.qqA.........BTo....5.W..9]...]b$K%Z.V..b..x1t..
..]..&.P.Qo.A?..W.R..l.........'".. ..D. ..EA.......$US.t...w?.u*rn.:.
.....?...a,.(..0....`.GL....Z...j[8.[.2k8N...4(.x..4j&..V..p.N)0.;k...
....C..= .].;M.|..&..;........M'....Vy.6*..[J.7`n*...Q..O.%4T ...;....
.'J.........xKK.&..^A...;...........a<.783[X......p...c...3j$.....Z
....c.D.....BW................*.1]KQ].zb.... .?~....V>&."..Q$.....&
.sS..Kq........).....{y.V....T...L.09.-.KK:..yH.....4./..Ni.oaM..X..X.
R...l...[...n2.....6.v.Q.......v.C.0........55..z]__.a.j...fJh.....r.6
a.6v3..!.}^0...,...I.w........i.......Q..q ..c;2.p2 .%..:0..14....z...
.b.*Z..*..>...v].....H...V...kVT.]....I ...._..}.f.....^U..a.V]..wd
.N.....9....n1-0..`...B..Q.MB...7...%.!.L~.."H..xNV`?||.H.........
<<< skipped >>>

GET /dc.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

If-Modified-Since: Thu, 13 Nov 2014 21:10:00 GMT; length=40298

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stats.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 304 Not Modified

Date: Wed, 19 Nov 2014 17:15:10 GMT

Expires: Wed, 19 Nov 2014 19:15:10 GMT

Age: 3933

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.01

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 19 Nov 2014 18:20:31 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>....
<<< skipped >>>

GET /Installer/Flow?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

GET /Installer/Flow?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.1 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 19 Nov 2014 18:20:25 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 19176

Connection: keep-alive
..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"8 $.Fmkcsez_oajgRvjdo
"8.*(, ./!("P`_F^w.4!.HI@QZEM@;K[M?>@DGC.Mnbtu\j`UZJcbnoq
j^oUZTcm`ounTW<soldjtT`jnbmkV[QngikoZjiV[Oe_m[cIplnd_tz.t.AIBS^HOA&
lt;[email protected]>LDX\Q`Ym\fMlnpeaot.u.EEDU_APJM>LQYTOEP.Kj_rt[
qa\ZN]\kaeJqktc^l.% O_fGew1,.3 .BJAY]GG>:J\G@?HGI=.Lmcnv]rcWTHbaoir
kfrWTRblaivo\Z>mmkcknUarqdgiUZRhhjsr\dgUZP_`ncfKjjmc`n{.|.CC@R]IIB=
L]H9>AGK?.OODOO<KCYVRaap^`Kkmq_bp|.w.CDCVYBQRP@FOXSP?Q.SmalrZpbV
[Oe_m[cIplnd_t '.M^nllsJak`.5.Qb[q_hNmgo^aqCL.Rcb.'.NoicqcrD&l
t;.30.-2., <drZwpIebep.2 % FmV]irAgmBlpn`hl 5)'.Cu_TNL 5.cmrm4.
 dj,&_hukmdnvcm )\mj)Hjsr\dg^p,Md]racHmhrb]sCel`jd\-P_`ncfKjjmc`n^
-6/,&`qc.&!AxcPJG  7.gptn5'*]j.(ckwln]moco--_ok*Ailr^fkar-
N]\kaeJqktc^lB^lblh_/Q`Ym\fMlnpeaoW,//.(dte '.>hkj[m`Lgi].3 .&#
39;b]rpd]mXrvjd9crd\.&a^lqeepZa_6AQ-2-95. .&ni[sboph5\ej.'
rpapoh\`c:nqqe.(\`__rfsoe_m[c6rood.-jj[\e;bh,qs..'>MGA7BP31,12,
1.&!Kfd`jPKJ.4!dtrk2*(bfld_t,o``&_mjr)tp\[f'alg. oda]ml-As
m]mg^Ga_coMbneci7j_dblh`=0- !ipl^t_tg_5-*10,%`iqoa_62/-4"lc\\k62-
-0"cmpfokwf^<31$nqn[gq72.&baZ8)$e\<1&gnYb`;- uarqdg
i62  %axr`jiZj:*!("P\l`.8*  .Ab_aobmk[k@ar\.5. ).@jtgqamnqbmQagI`
qn.8.. .P_tgpm 7'0("Ca^`\rfpd.: ,$.IplgnpimiJ\mc.4,-, ?an\pbj
`jcwMYo^ 7'0("Qg]`i?cndnIlnl\ej.41,0. $.Ogont]lMa^`kAlgl]nbGa
i^ 7hthl*.;\gPrh@oCf`[f[mu.9prs`$.KskCm=gem]nlgs_Hjsr\dg^p.4!-"*.
JpgGkLdcuj\jDgqq[khep.2.* z&[email protected]!., Kj`>vb.9."*
<<< skipped >>>

GET /Installer/Track?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&reqid=164520114&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=4031&offerscreenid=&offerorder=11&downloadduration=6250&installduration=265 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

GET /Installer/Track?pubid=707&distid=4235&productid=4031&subpubid=0&campaignid=0&networkid=1&reqid=164520114&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:64:A0:20&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=5&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=4031&offerscreenid=&offerorder=11&downloadduration=6250&installduration=265 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 19 Nov 2014 18:20:44 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive
..OK......


GET /Installer/TrackFinish?reqid=164520114&x=y&clickid= HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 19 Nov 2014 18:20:38 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive
..OK..HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html
; charset=utf-8..Date: Wed, 19 Nov 2014 18:20:38 GMT..Server: Microsof
t-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Po
wered-By: ASP.NET..Content-Length: 8..Connection: keep-alive....OK....

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 19 Nov 2014 18:20:31 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>....
<<< skipped >>>

GET /ajax/libs/jquery/1.5/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT

Date: Wed, 19 Nov 2014 17:20:54 GMT

Expires: Wed, 19 Nov 2014 18:20:54 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 29947

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 3572

Alternate-Protocol: 80:quic,p=0.01
...............F....>..R..1.d...j0!^[email protected]........
....@0.....$..}9[.......O....f.O.......6......6...W.?..!.t............
C...r....'.}.Y..J5.....?g.|...n.Ec...j.....Q.m..Y..w...m..?}...l.....3
.o.>mp..t.g..w.tq;.v...o.-..l...q.lg:z..w..W....zM.....d.9[d.IOU...
.T#^....;..1..,..o.o.m.......g...}.m5.._u........*ES~.....5.....m.....
.v..%_..w......Z..w.6Y.E.....l......gw.C....l...a..X.:F...o&...a...z.D
#...Zq.{...x..V.wk.K..O^..(i.......f.SR/io...c..=.,.^x..*...~..4...:.{
=n(J.z(..t(.q..i.p...Y.N.tD..J.=........vXn.K..e.-xH..i..F.1..f.....e.
o?..\ew....>~...c2........z..............Gj.zB.;:....2..M.sF.s../..
*8..o....x.;....>& n.... [email protected]/.h...?U.....=T.
EE.N.i..DMU.e.E....j..Q6...B-.J....>M....:.MZ-.4.Z..._..i.%..m..]..
........o.........~.......3...HN..t.................E/[....-..vq..y...
.-....j......0.xO..U4W..&Jx.ktt.<..u.6oNK..x..h....p.Oh.......P...6
...R.C..\.n..m..?..W....6..G.....hn..h.o......!.ep6...T..N..$.......5.
)P...3.V......_.O...5..gl.5........c......6.m...^..b...c.y.r..$.....L.
.p...o.................(,uB..T.2_28....d..us.f1.L..=..&..bV..m<..=.
.......3D..\.Y..r3....A_.Y.G.%.....7|.$t.Z.k..C..\.8?.h...q....naF.i-.
......B..`6t.._..h12n....v..".pq..C.h.......x...N.L...p..............f
`[email protected].]  h........v..(i....|mv....7.......t......j..j...c.K
2...;.4.$;Ve...-o4.~.;..h.M...(*N....m0T.G]5.......K`#.&..Z.V...3.....
.m2.Z.hJ;..F...`Q.QM.?.,..E........@......=.b.........._.Fi.h6........
l....2.}$...>.=.N.M)....$eP..]..p%M....|.e......&jJ...x.u...:..
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 19 Nov 2014 17:20:44 GMT

Expires: Wed, 19 Nov 2014 18:20:44 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 88

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 3587

Alternate-Protocol: 80:quic,p=0.01
.PNG........IHDR.......d.....G,Z`....IDAT..c.....&.....G0..ed.......w.
..........IEND.B`.....

GET /ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/css; charset=UTF-8

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 19 Nov 2014 17:48:32 GMT

Expires: Wed, 19 Nov 2014 18:48:32 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 6091

X-XSS-Protection: 1; mode=block

Age: 1914

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Alternate-Protocol: 80:quic,p=0.01
[email protected]..~...e.#K.$.#A..=.!%J|iz...
;@Z.:...y..}..........X.H~{G...O~......-.M^[email protected]........
....!/.Ms.\\...'t.&qy..........hN.,fE..r*.V.f..O.>.."...G._.... s.W
O8f....v...dJ>O...H ..o..>..! v.o~y...gg.....#.D.,?BwgQ...&.,B.h
.%. .'.d.1...R...&.M...1..l.3.?.u..t.B.u...F....e....&q..7.bq.bv| ....
....... V..z;.j.A_.kr.I.J...e.z..A.yV0........0..5i.C.%,. .L..iY4Q.}..
.t......y..U.q.h.f..-K.....3.6...H..Y..|..u.....\d[T.........>.....
.|...Y...T.*...<..X..F.S.:.4..G.<.r`k.&?........0.p.w gEcN..=.'8
a...E......~...$OXJOy.s)...ud..\tQ.Z$$;..|.}[email protected]^...S2.gn.h......;V.
yy.!...{4..U%D>x....{...2.SV....!Y<....3..e...cMTb.5.,f...r..$Or
..%X...78.I.>[email protected].<.W 
EY.h.<.U.l2c.....V.J..T.^...owo.....(...|...Sh..~x..l..ovyY.7...M..
. ..v2.%.j....Np1_....4...M...9.~.,y.V..b.-...i.&i.q...W7......*1.QP.k
:C..^.k6..T.\.u,..LW.(S<)5.............X...ZW...#.UC*.:nT;.....\<
;._.. J.YK.:9.H}3....U.B..$..W..f$l]^[email protected].,(."
......l.%........:.A..y.'n.. ..j:.q2.]r..M...j.JSQ....i.8...J...".iZ.V
.....5..'S:.*..C..V.Y.!S.k*.:FT.tv...1.P.A.e..r.h......-..uGZ6.(.....l
..!5....z....2M!.?.G.........'....U>..-aH/ .E.D.T{J..C!...tK.!.a.v.
.~......$....5 ..xj.u...P...x.@ F{..S..R.O.<d#.E%PS.//......5fV.4..
.1..S.......mw..#..o Q. .....p_yI..ox.....UM.uP....b.v0GE.....A....X.!
pX4.......Y-o..f9.....L.p$.........;..P...Q.b........mZe..$s..].8..t..
.M...o......X...S".>..1A*.....2h......D.j8Y..wL..^.| ....1...`C
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/jquery-ui.min.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 19 Nov 2014 18:19:35 GMT

Expires: Wed, 19 Nov 2014 19:19:35 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 51558

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 52

Alternate-Protocol: 80:quic,p=0.01
............iw...0....d...-.@......."...x{,y.<....n.M....ZB...w...A
P...9.L,.k_n..n.{.......V..G..<........}......n.........l..Y....z3.
.................E1.-.uz..........ZXI..rZm....../[email protected].....
.yUlB..U#..L...1p.>...2...].....M(...J.....e..I......5...9...e.....
&.........W..y...f./..j..}^....r...n.._7.j.o..v.i./a.7uq......r.%.,...
...j9..Y.s......@..$...... \...H...=....?....y...}W..b].G..|-....wG.N.
O<.H.Q...'w......H.....*.....?..Uo..n..Z=..U...I...*..,[email protected]...
..l.[@E1.....jq<..V.d.=.n......,..o... .gY.G....N%$f..u..."J.....xv
rR..$.q..i....l..m7....p...]./!.......JF0..^.. ...Q.....H..q...._wr"9.
.S].I/_.....~M...Z..U5..^q.z..U...k..........Q.........v...[.v..`:UJvI
o^-...........n.;..{o....p.CliS-J..w27...F.....v .{...t..........g._._
...~z......wz.......gP.K.....W....w/.ym......B.cH....?~..~/.~..../....
_.........4..s........x..z|...^|.../.._..?.z..............?.......?=..
....N......_<...3.n..I/..../ e.Rd../U...|...O.....Pi.~.....=.5..%~z
...oh..?.._~J.?.?.....0....g.. ....0....W...x....W.k|)....h....n...7Y.
...c..l.Y..._...3.D.f.,n..G?.'h...*.l...ZN...R...q..F.;.*/f6T.q-3.....
...Z.n..y\&.].......*.C..p..I.U.Z/....`..W..k<.Pn]....OtJR...P...j.
n...z]W''..z.o.b.....m...K...u.)..%.v{.8p9..T....4U......X..U.o'...T..
...D...G.tc.3o....8./.a.NK^...........q?I.0.....)-..m.\[email protected]......
\..{.>........D..n..Gp..)R:...>.D ....d.nV.......C....pWe.?Xl.B.
....6} .Q.4...j....^.6q..3..>5w\.....'.@....&6...?ok..$.;....[...!V
o........vx}{s.L.dA...6......8.r......bt.>"a........0...I~;....
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 19 Nov 2014 17:39:09 GMT

Expires: Wed, 19 Nov 2014 18:39:09 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 3457

X-XSS-Protection: 1; mode=block

Age: 2484

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Alternate-Protocol: 80:quic,p=0.01
.PNG........IHDR.......d.....p..}...HIDATx...K..N................q..B.
...6...._.d.c.......*...V......|U.......w-...p..>Z..........`......
......`............`............`............`............`...........
.`............`.......@.....:n.K>.u.....X..V..G........l.9......j6.
x..xu..y...I... gZ.D.L...........4[OG.8.|d.....;.N[O..lz.M....{..ne.Z1
..VlO...e..k.g.........k.6.r..........be'`t#..zu39.|[..6=9....4..H."..
.-Cd.D.z.3c.g...S.,..D7.h.H=O.F6.{7.....H6G...S.......U.9.%w....`C....
.y.G^@......O..........0.l.....0.Z.4..H..[.k..Z..Z..zm].v.......J.$ZMZ
..yK.....Z.4.Z.Z.Z.Gr..M..j.b..Z^.1c.E........,....6&.9....3)....[W.vH
...a...k~....,.........1..k.R..........iWd....M.V..O)..?y.....W...._&l
t;....p.p....`............`..b.......:............:.............Xj)...
w.....-?M.bE|[...I.eki......&.U.6.........l4.[..N.F.....|...qc.Zj.7...
..;.f/..w..=......}L[...k.E.S/.x....3-...^.R....."Z.........[........:
.;...n.Z..~.....;.....%w....P7...'R^....E[?.C...X.$.^Y.Yj...}...iS.O..
...m........r%..4yy.r..I.....Io...'i..;..._....K.7.%.Q../.\......X....
3;_........[...[..ti.........._.-..Z.l;j)e.L.lyf"Dm..^4...-.|G.E VdRD.
.M....S[.{.i6G...~/7V.h....M..;^.1~.}.;......=9.]S2....y.w|Y.#s(..X..;
....:=....Y_#.\r......RkY.$.e.mk..n.E|..m|....kk...O.......'......-..n
.z..XZ}m\H.._e.....V.x9........!.../.xs......f.......5.Zl .......x....
.].?/..9r......h...]^}M....<....;..........p.p....`........}.....n.
.~....4............. ^=..kc...|j..4{u[.......H.2...Y1......R..|x.5M...
...j..4.%..x......!ij....bXcT..^[$=V.4<m^.=~..Yo.E..s..>....
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

If-Modified-Since: Fri, 12 Oct 2012 18:27:19 GMT

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 304 Not Modified

Date: Wed, 19 Nov 2014 17:39:09 GMT

Expires: Wed, 19 Nov 2014 18:39:09 GMT

Age: 2484

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.01

GET /offers/images/Theme8/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 19 Nov 2014 18:20:44 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 19 Nov 2014 18:20:44 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/nextCase.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 19 Nov 2014 18:20:44 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/button.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 19 Nov 2014 18:20:44 GMT

Content-Type: image/png

Content-Length: 458

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT

ETag: "1b5642f092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 26 Nov 2014 18:20:44 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e&
lt;...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi.......
.../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f.
..p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C......
.$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....
-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^
.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`...

GET /offers/ui/css/start/jquery-ui-1.8.19.custom.css HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 19 Nov 2014 18:20:26 GMT

Content-Type: text/css

Content-Length: 20706

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Thu, 26 Apr 2012 17:23:56 GMT

ETag: "ca38195cd123cd1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 26 Nov 2014 18:20:26 GMT

X-Cache: HIT

Accept-Ranges: bytes
/*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.tx
t (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Ve
rsion 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquer
y.com/UI/Theming/API. */../* Layout helpers.--------------------------
--------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-acce
ssible { position: absolute !important; clip: rect(1px 1px 1px 1px); c
lip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0
; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font
-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helpe
r-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:
after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfi
x { width: 100%; height: 100%; top: 0; left: 0; position: absolute; op
acity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.-----------
-----------------------*/..ui-state-disabled { cursor: default !import
ant; }.../* Icons.----------------------------------*/../* states and 
images */..ui-icon { display: block; text-indent: -99999px; overflow: 
hidden; background-repeat: no-repeat; }.../* Misc visuals.------------
----------------------*/../* Overlays */..ui-widget-overlay { position
: absolute; top: 0; left: 0; width: 100%; height: 100%; }.../*!. * jQu
ery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://
jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 li
censes.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/
<<< skipped >>>

GET /js/show_ads.js HTTP/1.1

Accept: */*

Referer: hXXp://installer.apps-track.com/installer/ThankYouInner?productid=4031&productname=Free EPS Viewer

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n20.adshostnet.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

ETag: W/"6947-1416167328000"

Last-Modified: Sun, 16 Nov 2014 19:48:48 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Wed, 19 Nov 2014 18:20:43 GMT
a..............200...Yms.6.. 2....M;[email protected].....$$.....m ...-^
H........`..}..z.......=^GzP.sJ..~....2...!...:g.~..R..a%$.Y.<_.Cz$
[email protected]..@}SN0..<s?....u.q^...r....(.iE.I..p.
[email protected]\4.D.e..%...K.n..../..H.V\.........*@._.(Dc<F..j..1~.E..
...V..>.q.".....,..|a.'*....d#k..XV.....".. .....4. .\2.W..73Le,.%{
..<.8.c..z...hJ8..'..d..<.EN..Db..eO.!...r9.yNK....M$'t....0....
<.w.......G.(..^.H...h|.N^..NF............g...l.*..bc."P?..c.......
....V....-a..G....9c...w.-/Y./&..|...B.-.yD.......C...;.s`.2.....200..
.hQ....t...q .....^.7V..M.>*5............@TP<.W...t.24...&.Y..x.
.L............#4.aX;..7v...%.`...]]...a.x.!..d\(0(p...2.r..q!.g.$..M.J
..%. Ba..h....-.%.j.qk....H..0...Py(.7.KP...Q .....d.)9<4....&7..".
0.1_z..3]...........' ........:.e..:.......(~.>!..Ba.1..JJM.... &.2
......KR.......z..p.p....;s.-..#.k...$h.`k........"/pp...b...?...U.2O.
.........5..3.W.....:.0N...}]E.3V.'Za.."@v.5....k...v.F..Z.F.d..k.q...
~.C.S....(..X."..>P...gc..P..._......(\b.:h....4..S......7.....n.p!
5.C......(p-...X...H.da.ap...^9Q .[....200......%D.... .....n..r.....L
e...........,PGt2_..nG!.A..g..8.HDcHuB.....R...D.[.....JU...&....K.x..
..v....v...PE..........Iu..s..-M..x.8.._P....9.N..U..H. ........g$...#
.U:.V...uu.V..2...hh..F8.....n._?....*.t.ap ....$.5...}`.....,.jLkT.~.
..I...9..N....s..i. ....%v.....Z.....2.$wg.C.b.el.6;......?.).{....].3
......uC.{B3....=&..u.....t.nH..}.6'.q......:....=T.p.63...Y.....S....
......:L..L2.$....J..',..Rn.x..-........m..z...X/xo5...b. .....w$.
<<< skipped >>>

GET /ads?v=1&key=6c2c19aff050b202bf7c7970cb59cde3&ch=&click=&tz=2&t=1416402832199&scrWidth=1024&scrHeight=768 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://installer.apps-track.com/installer/ThankYouInner?productid=4031&productname=Free EPS Viewer

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n20.adshostnet.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: no-cache

Pragma: no-cache

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP="CAO PSA OUR"

Set-Cookie: epomUUID=c6daedc0-7018-11e4-ac2e-002481e7ea6c; Domain=.adshostnet.com; Expires=Tue, 14-Nov-2034 18:20:44 GMT; Path=/

Content-Type: text/html;charset=UTF-8

Content-Length: 756

Date: Wed, 19 Nov 2014 18:20:43 GMT
<html><head><!--22:11--></head><body leftma
rgin='0' topmargin='0' marginwidth='0' marginheight='0' style='backgro
und-color:transparent; width: 100%; text-align: center;'><center
><script type='text/javascript'>..var adParams = {a: '5203116
9', size: '800x440',serverdomain: 'ads.adservingsolutionsinc.com' , se
cure:true  ,context:'c51791155' };..</script>..<script type='
text/javascript' src='hXXps://adservingsolutionsinc.adk2.co/adservings
olutionsinc/scripts/smart/smart.js'></script></center>&
lt;script type="text/javascript">new Image().src = "hXXp://n20.adsh
ostnet.com" "/im" "pressi" "on.gif?b=22" "&p=11&ch=&ap=&cps=&c" "=21&l
=CA" "&h=f9fbd1ed42595ac2ffa20c9cbb973f78&t=" new Date().getTime() "&s
=8c3775c9dd22ebc22c4d271ffd13b295";</script></body></ht
ml>....


GET /impression.gif?b=22&p=11&ch=&ap=&cps=&c=21&l=CA&h=f9fbd1ed42595ac2ffa20c9cbb973f78&t=1416402832793&s=8c3775c9dd22ebc22c4d271ffd13b295 HTTP/1.1

Accept: */*

Referer: hXXp://n20.adshostnet.com/ads?v=1&key=6c2c19aff050b202bf7c7970cb59cde3&ch=&click=&tz=2&t=1416402832199&scrWidth=1024&scrHeight=768

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n20.adshostnet.com

Connection: Keep-Alive

Cookie: epomUUID=c6daedc0-7018-11e4-ac2e-002481e7ea6c

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: no-cache

Pragma: no-cache

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP="CAO PSA OUR"

Set-Cookie: ucv=21-CA-1416507645162--; Domain=.adshostnet.com; Expires=Thu, 19-Nov-2015 18:20:45 GMT; Path=/

Accept-Ranges: bytes

ETag: W/"49-1395933738000"

Last-Modified: Thu, 27 Mar 2014 15:22:18 GMT

Content-Type: image/gif

Content-Length: 49

Date: Wed, 19 Nov 2014 18:20:44 GMT
GIF89a...................!.......,...........T..;..

GET /Trackers/AVChecker19-6.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.download4desktop.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 19 Nov 2014 18:20:38 GMT

Content-Type: application/octet-stream

Content-Length: 72233

Connection: keep-alive

x-amz-id-2: axZh06IT8xyw4ahAw2GTBcTL7IIJq2IENhjZzz/vHmZO8qBPiYJ49xjHDpytx57N

x-amz-request-id: B848845CF2C5F743

Last-Modified: Thu, 19 Jun 2014 15:20:40 GMT

ETag: "155013141bd477982a280f7267e7df2d"

Server: NetDNA-cache/2.2

Content-Disposition: attachment

X-Cache: HIT

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
.......@..............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
[email protected]..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>

GET /offers/images/Theme8/topComp.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 19 Nov 2014 18:20:44 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bodyImg.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 19 Nov 2014 18:20:44 GMT

Content-Type: image/png

Content-Length: 1914

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 10:27:32 GMT

ETag: "36dd864c691ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 26 Nov 2014 18:20:44 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR.......:.....j.......sRGB.........gAMA......a.... cHRM
..z&..............u0...`..:....p..Q<...0PLTE.......................
.........................{.......IDATx......:..`..p..J.4.ty.:......)v.
.\....,.fwv..U...!.....b.f.....Cy(..OW......w......]R..l..2My}<..].
.8hn{*..X.).m..4w.U.J.....u..l.J...<...>uJ.....i.>o.%......I.
\..S......U.D.}OK..J`......sJ`.}..M.9%..A....u.T.%........K....OQ..._.
.d.>..L....]I. U.].c.Je...|.W.U?..E.}...*.vZ...K...M....).W...^V..&
gt;).e(.].Z.}dg%@....S.*/...........Y.W.]}...|.SgO........rrj...4UY../
..r.~.....Z.ep.wui.sP^..X.g%$(.......C........Ze....4yn}....U.({.V..{o
..}O...w.G.Q.^..r..p....0y............8......6.v....zz~....-...F*..f.F
]...R..*. -......e{mO.s.i.9.U....zz.6.f.T>.f.DQ%.. ...l.q\N."eA({_W
7..Q.....d........>...Y.."e.\....s,.. .Li)%....R.o.....C.9wQ....8..
......KNY..t..)...k...v)P*.....I...4&../.{)..qe..R.'...2..*..d.z&.T;y.
.)Q*....)R..2..)Tj.B..)V..b..)W......QB!rj.B.J)..N)b*...R)q..<S...z
%.LPr..%.LQ2.4e.....q&*c.De,..J.x& ig...g..b.(.g..p.)Qf..uf*1g..af .Y.
..... .;(.....s......r.v. ...s'...K.0wS.....sG%.......-.R..}......4S..
...W.....=.9eN(..OS..Jt(...<...P.(..DJ;_)..Y. ..7.>[email protected])e
M.qi;...........$.z%.[..P...SJzT*E]......2zT.t..L%6.TJ..Y.a...}.V..J..
.,.....H... ....;..2_._/[.^/[.\.W.\.!..%oT*y.Z....#Q.Bw.FI.7...H..2Jt.
*..../........2.F..X.....gqJ.q:.U.q.. V...B..s.(.J2.x..()#1@.'d4.Hh.h.
J.I.i.G.#.;.J....*Q$Z..?.........sR..D.<...| ......2.1b.A3...v.....
X.y{..R....{h..pzJ.I.).Y..Kn.z;%Jn..c.W...bL........t..!...A..(..*
<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 19 Nov 2014 18:20:44 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/button_over.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 19 Nov 2014 18:20:44 GMT

Content-Type: image/png

Content-Length: 921

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT

ETag: "f072da2a092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 26 Nov 2014 18:20:44 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e&
lt;...;IDATx..Z;o.1..Y.D...W."$=D..*[email protected].
...........;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.s
h..e..z.A....G.p..IZ.z...?Ra8........Y......O.......[[email protected].
...y..-.....Lc.0......O..|z.O/...k.....e...n..!......G.p...9....3. .'?
7 ..GD@..{.<....C$....N.........Q...<.,@...].;Q.'<.(.X.r.,.6.
......QrB..h..d&r....6....G..Shr.... .....4r..= ..f.....B.qP..l.K.....
...YB.Z....H....../:.l.(.S.D...nM7..P.%R........&_uR.H6A..(raP.H9...[\
D. .(....d...`.8.A......r5Q..........:v.e....u.....-&.1.....&.........
Z.|....).L...$....)K%a-....b..a*{<(W..P<..w7_Z.....h.%6.N.......
.*\FB...A...#..f.N...C..(.p...........K.|..5d..3u-........(.k. 7..6..t
svP!.U0.q.......9z.e [email protected]............. .>=...{WVim...
.f.c6.:...|.....0X.yk...../z..!.SHW.d......o.s........a..8..g.|zvg...o
[email protected].^......IEND.B`...

GET /installer/thankyou?productid=4031&pubid=707&distid=4235&countryid=71&reqid=164520114&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 19 Nov 2014 18:20:49 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 1304

Connection: keep-alive
..<html>..    <head>..        <title>Thank you for i
nstalling Free EPS Viewer</title>..        <script type="text
/javascript"> var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-3
7348037-1']);_gaq.push(['_setDomainName', 'ppdownload.com']);_gaq.push
(['_setAllowLinker', true]);..                                        
    _gaq.push(['_trackPageview']);..                                  
          (function() {..                                             
 var ga = document.createElement('script'); ga.type = 'text/javascript
'; ga.async = true;..                                              ga.
src = ('https:' == document.location.protocol ? 'hXXps://' : 'hXXp://'
)   'stats.g.doubleclick.net/dc.js';..                                
              var s = document.getElementsByTagName('script')[0]; s.pa
rentNode.insertBefore(ga, s);..                                       
     })(); </script>       ..    </head>..    <body>
..        <div style="position:relative;left:0px;top:0px;color:whit
e; height: 1px; visibility: hidden;"></div>..        <ifra
me src="hXXp://installer.apps-track.com/installer/ThankYouInner?produc
tid=4031&productname=Free EPS Viewer" width=100% height=100%  fram
eborder=0 scrolling=no marginheight=0 marginwidth=0  >  </iframe
>  ..        ..    </body>..</html>......
<<< skipped >>>

GET /installer/ThankYouInner?productid=4031&productname=Free EPS Viewer HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://installer.apps-track.com/installer/thankyou?productid=4031&pubid=707&distid=4235&countryid=71&reqid=164520114&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 19 Nov 2014 18:20:50 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 907

Connection: keep-alive
..<html>..    <head>..        <script type="text/javasc
ript">  </script>..     ..    </head>..    <body>
..        ..    ..        <center>..           <!-- BEGIN TAG
 - DO NOT MODIFY -->..            <script type="text/javascript"
>..            //<![CDATA[..                epom_key = "6c2c19af
f050b202bf7c7970cb59cde3";..                epom_channel = "";..      
          epom_code_format = "ads";..                epom_ads_host = "
//n20.adshostnet.com";..                epom_click = "";..            
    epom_custom_params = {};..                epom_width = "1200";..  
              epom_height = "1400";..                document.write("&
lt;script type='text\/javascript' src='"   (location.protocol == 'http
s:' ? 'https:' : 'http:')   "//n20.adshostnet.com\/js/show_ads.js'>
<\/script>");..            //]]>..            </script>
..            <!-- END TAG -->..        </center>..    <
;/body>..</html>HTTP/1.1 200 OK..Cache-Control: private..Cont
ent-Type: text/html; charset=utf-8..Date: Wed, 19 Nov 2014 18:20:50 GM
T..Server: Microsoft-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc
-Version: 4.0..X-Powered-By: ASP.NET..Content-Length: 907..Connection:
 keep-alive....<html>..    <head>..        <script type
="text/javascript">  </script>..     ..    </head>..   
 <body>..        ..    ..        <center>..           <
!-- BEGIN TAG - DO NOT MODIFY -->..            <script type=
<<< skipped >>>

GET /installer/GetTrackAVs?avs=0&reqid=164520114 HTTP/1.0

Host: smartinstaller.elasticbeanstalk.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 500 Internal Server Error

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 19 Nov 2014 18:20:46 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 2618

Connection: Close
<!DOCTYPE html>..<html lang="en">..    <head>..     
   <meta charset="utf-8" />..        <title>Error - My ASP
.NET MVC Application</title>..        <link href="/Content/Si
te.css" rel="stylesheet" type="text/css" />..        <link href=
"/Content/themes/base/jquery.ui.all.css" rel="stylesheet" type="text/c
ss" />..        <script src="/Scripts/jquery-1.6.2.min.js" type=
"text/javascript"></script>..        <script src="/Scripts
/jquery-ui-1.8.11.js" type="text/javascript"></script>..     
   <script src="/Scripts/modernizr-2.0.6-development-only.js" type=
"text/javascript"></script>..        <script src="/Scripts
/AjaxLogin.js" type="text/javascript"></script>..        <
meta name="viewport" content="width=device-width">..    </head&g
t;..    <body>..        <header>..            <div clas
s="content-wrapper">..                <div class="float-left">
;..                    <p class="site-title"><a href="/">y
our logo here.</a></p>..                </div>..    
            <div class="float-right">..                    <s
ection id="login">..                            <ul>..       
 <li><a data-dialog-title="Registration" href="/Account/Regis
ter" id="registerLink">Register</a></li>..        <l
i><a data-dialog-title="Identification" href="/Account/LogOn" id
="logonLink">Log on</a></li>..    </ul>..    
<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=2&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0& HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: direct.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 19 Nov 2014 18:20:31 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8317

Connection: keep-alive
.<html>.    <head>.      .       <style type="text/css"
>.            .ui-progressbar-value { background-image: url(images/
pbar-ani.gif); }.        </style>.       .        <link type=
"text/css" href="hXXp://static.revenyou.com/offers/ui/css/start/jquery
-ui-1.8.19.custom.css" rel="stylesheet" />.        <link href="h
ttp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-u
i.css" rel="stylesheet" type="text/css" />.        <script  type
="text/javascript"  src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1
.5/jquery.min.js"></script>.        <script  type="text/ja
vascript"  src="hXXp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jque
ry-ui.min.js"></script>..       <title>2 - NonProduct (
Free EPS Viewer)</title><script type='text/javascript'>var
 _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.pu
sh(['_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker',
 true]);..                                            _gaq.push(['_tra
ckPageview']);..                                            (function(
) {..                                              var ga = document.c
reateElement('script'); ga.type = 'text/javascript'; ga.async = true;.
.                                              ga.src = ('https:' == d
ocument.location.protocol ? 'hXXps://' : 'hXXp://')   'stats.g.doublec
lick.net/dc.js';..                                              var s 
= document.getElementsByTagName('script')[0]; s.parentNode.insertB
<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=4&distid=4235&leadp=4031&countryid=71&sysbit=32&dfb=0&hb=5&isagg=0&version=4.1&external=0&external=0& HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: direct.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 19 Nov 2014 18:20:49 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 7038

Connection: keep-alive
<html>.    <head>.      <title>4 - NonProduct (Free 
EPS Viewer)</title><script type='text/javascript'>var _gaq
 = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['
_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true
]);..                                            _gaq.push(['_trackPag
eview']);..                                            (function() {..
                                              var ga = document.create
Element('script'); ga.type = 'text/javascript'; ga.async = true;..    
                                          ga.src = ('https:' == docume
nt.location.protocol ? 'hXXps://' : 'hXXp://')   'stats.g.doubleclick.
net/dc.js';..                                              var s = doc
ument.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga,
 s);..                                            })();</script>
<style type='text/css'>body      {          width:100%; height:1
00%; margin:0px; padding:0px; font-size:font-family:helvetica; font-si
ze:12px;}   .divLeadpName      {         border-bottom-style:groove;bo
rder-bottom-width: thin; padding-left:61px; padding-top:9px; font-size
:font-family:helvetica; font-style:italic; font-size:25px;            
     font-weight:bold; color:black; position:absolute;   width: 100%; 
background-color: #fff; ba}   #divTop         {display: none}  #divMid
dle      {background-color: #efecec; height: 100%;} #middle    {backgr
ound-color: #fff;} .divOnNext      {          position:absolute; w
<<< skipped >>>

GET /Files//Setup_product_4031.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dl.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 19 Nov 2014 18:20:26 GMT

Content-Type: application/octet-stream

Content-Length: 11929876

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 30 Dec 2013 01:16:57 GMT

Accept-Ranges: bytes

ETag: "b45877d5fc4cf1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 26 Nov 2014 18:20:26 GMT

X-Cache: MISS
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......C....{...{..
.{.......{...)n..{....i..{....n.S{....y..{...{...y....`..z...)~..{....
{..{..Rich.{..........PE..L......P....................................
......@.......................................@.......................
...........0..,.......................................................
............H...@....................#.......................text.....
.......................... ..`.rdata...f.......h..................@..@
.data...d....`...0...>[email protected].....
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E.VW.u....u..M..u..
~(........~(_^]...U........SV3.W..9u..........u/.O43.C._(;.t....P..w(.
.....E..09w(................u ......3...L$..O4C._(.D$.;.t....T$.R.P..w
(....Fu.3.C..._(......E.. ...(......u.3.CP..._(......M........u..O43.C
._(;.t..u....P4..3._^[..]...j..<wL.......].3....E..{..u......s..K..
..E...s...,.M....C. C.P.C. C.P.s.V......6.3..4.M..M.....n......j..S.L.
......}.W......E......E..G$LKN.3...< N..G$L N.._,.G0._4.G8.._<._
@._D._H.E..._L._P._T.E...Od..Ol..wt.GX.._\.G`.._h.Gp.._q._r.=?...E
<<< skipped >>>

The MemScan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe /PID=707 /SUBPID=0 /DISTID=4235 /NETWORKID=1 /CID=0 /PRODUCT_ID=4031 /SERVER_URL=hXXp://installer.apps-track.com /CLICKID= /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=5 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=2

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv7E.tmp\Convert.dll

GetCPInfo

GetProcessHeap

Convert.dll

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

> >$>(>,>

2 2$2(2,2

1,2024282

? ?$?(?0?4?@?`?

operator

GetProcessWindowStation

portuguese-brazilian

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

9#gyI%S

.MGV1'

zDs.DhLA

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsAVG3rs.dat

instructionsAVG3rs.dat

INSTRU~1.DAT

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv7E.tmp

c:\%original file name%.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7D.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv7E.tmp

hXXp://installer.apps-track.com

/PID=707 /SUBPID=0 /DISTID=4235 /NETWORKID=1 /CID=0 /PRODUCT_ID=4031 /SERVER_URL=hXXp://installer.apps-track.com /CLICKID= /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=5 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=2

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

1.0.0.1

convert.dll

1.0.0.2

WUSER32.DLL

- floating point support not loaded

f.exe_1604:

.text

`.rdata

@.data

.rsrc

@.reloc

spKey

szKey

keyCur

hKey

cSubKeys

cmdline

urlStr

wurl

bstrLicKey

cchLicKey

nMsg

vurl

bstrURLOut

rtExecmd

rtExeurl

reportURL

zErrMsg

compiledSql

sqliteCookieFiles

htmlDecodedUrlValue

endParamKeys

dynamicProductKeys

wUrlQS

wUrl

sqliteHistoryFiles

readDownloadUrl

searchUrl

finishUrlForOuterInstaller

reportUrl

httpResponse

fullCmd

subkey

hostBrwCmd

tyUrl

baseKeys

cmdLineW

cmdW

exeUrlW

urlW

cmdLine

exeUrl

cbMaxSubKey

achKey

offersMainUrl

antivirusesRegKeys64Arr

antivirusesRegKeys32Arr

reg64Key

postExe

preExe

regKey

offerUrl

regKey64

cbSubKeys

zMsg

nCellKey

nMaxKey

nMinKey

nKey

zErrmsg

keyInfo

errMsg

t.hx3S

osCmd

finalExePath

urlComp

szURLPath

xSSSh

FTPjKS

FtPj;S

C.PjRV

RegDeleteKeyExW

RegDeleteKeyTransactedW

RegCreateKeyTransactedW

RegOpenKeyTransactedW

.vector<T> too long

X:X:X:X:X:X

\Google\Chrome\Application\chrome.exe

%d/%d/%d %d:%d:%d

3.7.16.2

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

\obhhelper.txt

Error %u in WinHttpQueryDataAvailable.

Error %u in WinHttpReadData.

Error %d has occurred.

F%D,3

Run-Time Check Failure #%d - %s

%s%s%s%s

%s%s%p%s%ld%s%d%s

Visual C   CRT: Not enough memory to complete call to strerror.

RegCloseKey

RegOpenKeyExW

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

operator

GetProcessWindowStation

WinHttpCloseHandle

WinHttpReadData

WinHttpQueryDataAvailable

WinHttpReceiveResponse

WinHttpSendRequest

WinHttpOpenRequest

WinHttpConnect

WinHttpCrackUrl

WinHttpSetTimeouts

WinHttpOpen

WinHttpQueryHeaders

WINHTTP.dll

PSAPI.DLL

GetProcessHeap

KERNEL32.dll

EnumChildWindows

CreateDialogIndirectParamW

USER32.dll

GDI32.dll

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegQueryInfoKeyW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

OLEAUT32.dll

URLDownloadToFileW

urlmon.dll

IPHLPAPI.DLL

GetCPInfo

.?AV?$CAtlExeModuleT@VCSmartInstallerModule@@@ATL@@

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

RowKey

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s-shm

%s\etilqs_

%s\%s

Recovered %d frames from WAL file %s

cannot limit WAL size: %s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

keyinfo(%d

%s(%d)

%s-mjXXXXXX9XXz

MJ delete: %s

MJ collide: %s

-mjX9X

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_parent

%s OR name=%Q

type='trigger' AND (%s)

sqlite_

table %s may not be altered

there is already another table or index with this name: %s

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_stat1

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

sqlite_detach

sqlite_attach

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

unable to identify the object to be reindexed

no such collation sequence: %s

table %s may not be modified

cannot modify %s because it is a view

sqlite_version

sqlite_source_id

sqlite_log

sqlite_compileoption_used

sqlite_compileoption_get

foreign key mismatch - "%w" referencing "%w"

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

constraint %s failed

PRIMARY KEY must be unique

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_keys

foreign_key_list

foreign_key_check

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s.%s

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

too many references to "%s": max 65535

%s.%s.%s

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s TABLE %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid>? AND rowid<?)

%s (rowid>?)

%s (rowid<?)

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

SQL logic error or missing database

unknown operation

large file support is disabled

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

.?AVCWebPage@@

zcÁ

{A0386B19-B7E7-4BE7-B567-ABF77CBB6E60} = s `ATLExeServer'

`ATLExeServer.EXE'

val AppID = s {A0386B19-B7E7-4BE7-B567-ABF77CBB6E60}

ForceRemove {FA20B59B-21AA-44FC-8A68-450979B7CC90} = s 'CBrowserExternals Class'

val ServerExecutable = s '%MODULE_RAW%'

TypeLib = s '{03771AEF-400D-4A13-B712-25878EC4A3F5}'

ForceRemove {622D38AD-B4A9-4170-8192-5B865C6A5DCE} = s 'CBrowserExternalImp Class'

ForceRemove {6D4506CE-F855-4657-AA38-DB6B1F733982} = s 'CBrowserExternal Class'

stdole2.tlbWWW

~cmdWd

OpenUrlW

urlWd

method OpenUrl

Created by MIDL version 7.00.0555 at Thu Mar 13 16:11:05 2014

<BUTTON onclick='window.external.OnClick(theBody, "red");'>Red</BUTTON>

<BUTTON onclick='window.external.OnClick(theBody, "green");'>Green</BUTTON>

<BUTTON onclick='window.external.OnClick(theBody, "blue");'>Blue</BUTTON>

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

3%3u3

=0>4>8><>

9%9 9;9]9

6i6C6t9

7$8(8,808

5$8(8,80848

4"4&4*4.42464:4

:?<|<6=?=

5 5<5@5\5`5

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

WAdvapi32.dll

SERVER_URL

EXE_URL

EXE_CMDLINE

THANKYOU_URL

exeurl

execmdline

Exception opening/reading chrome cookies

Exception opening/reading opera cookies

a\Microsoft\Windows\Cookies

a\Mozilla\Firefox\Profiles

\Mozilla\Firefox\Profiles

sqlite

cookies.sqlite

Chrome_WidgetWin_1

a\Opera\Opera\

\..\Local\Google\Chrome\User Data\Default\

\..\Local Settings\Application Data\Google\Chrome\User Data\Default\

cookies4.dat

SELECT value,last_access_utc FROM cookies WHERE host_key LIKE '%

Found cookie in Chrome!

\..\..\Local Settings\Application Data\Opera\Opera\

Found cookie in Opera!

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

OLEACC.DLL

places.sqlite

SELECT url FROM moz_places WHERE url LIKE '%

Found history in Chrome!

SELECT urls.url FROM urls WHERE urls.url LIKE '%

\PreExe_ID_

\default.html

CHROMEVERSION

&chromev=

SOFTWARE\Microsoft\.NETFramework\policy

firefox

chrome

opera

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice

ChromeHTML

FirefoxHTML

IE.AssocFile.HTM

Opera.HTML

http\shell\open\command

Opera.exe

Safari.exe

\PostCheck.exe

SOFTWARE\Mozilla\Mozilla FireFox

Software\Mozilla\Mozilla FireFox

SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}

aSoftware\Mozilla\Mozilla Firefox

*.txt

@@exeurl

OfferURL

ExeURL

RegKey

ReportName

PreExe

PostExe

RegKey64

AntivirusesRegKeys

RegKey32

Mscoree.dll

OLEAUT32.DLL

{A33DE4AA-9646-4E33-9E44-E472C6312E2F}

888816666554443

6666554443

!6666554443

VirtualOfferCmd:

VirtualOfferCmd

/REPORTURL=

\obhhelper.txt

NMozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

user32.dll

mscoree.dll

SKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

MSPDB100.DLL

ADVAPI32.DLL

WUSER32.DLL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

4.0.0.3

setup.exe

4.0.0.1

6_Offer_11.exe_1272:

.text

`.rdata

@.data

.rsrc

@.reloc

u}SSh

PSShG

8%uPP3

t%FVh

t.Shh

u!SSh

RSShd

RSShp

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

msi.dll

gdiplus.dll

kernel32.dll

UxTheme.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

operator

GetProcessWindowStation

USER32.DLL

WININET.dll

dwmapi.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

F%D,3

ATTRIB -r "%s"

rd "%s"

if exist "%s" goto try

del "%s" | cls

del "%s"

FLT_DENORMAL_OPERAND

FLT_INVALID_OPERATION

Dbghelp.dll

[SystemFolder]msi.dll

URL=%s

FtpCommandW

FtpGetFileSize

D:\BranchAI\win\Release\stubs\x86u\ExternalUi.pdb

GdiplusShutdown

GdipSetImageAttributesColorKeys

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpFindFirstFileW

InternetCrackUrlW

KERNEL32.dll

GetAsyncKeyState

GetKeyState

USER32.dll

SetViewportOrgEx

GDI32.dll

RegCloseKey

RegOpenKeyExW

RegDeleteKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegCreateKeyExW

ADVAPI32.dll

ShellExecuteW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

dbghelp.dll

SHLWAPI.dll

COMCTL32.dll

MSIMG32.dll

VERSION.dll

NETAPI32.dll

GetWindowsDirectoryW

CreateNamedPipeW

ConnectNamedPipe

PeekNamedPipe

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

MsgWaitForMultipleObjects

ExitWindowsEx

COMDLG32.dll

RegOpenKeyExA

RegOpenKeyW

RegDeleteKeyA

RegCreateKeyA

RegOpenKeyA

zcÁ

cz">%U

cRtV

{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\lang1033\f0\fs20\par

{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\f0\fs20 EULA\par

43333333333333333

3334445558;;<<<<>>>?

"999500>

"999550-]

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3"><asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings"><ms_windowsSettings:dpiAware xmlns:ms_windowsSettings="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</ms_windowsSettings:dpiAware></asmv3:windowsSettings></asmv3:application><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>

4#656[6`6

9%9S9X9h9

4I4F4c4

7!7)7/7:7

7%7S7w7

9$:(:,:0:

04080<0@0

8 8$8(8,8084888<8

5$8(8,8084888<8

X:\:`:d:h:l:p:

$0(0,000

5 5$5(5,5054585<5@5

0 1$1(1,1

014181<1

?(?0?<?\?

;$;,;4;@;

KERNEL32.DLL

mscoree.dll

O\\?\

WindowsBuild

AUxTheme.dll

comctl32.dll

@cmdlinkarrow

@uxtheme.dll

0123456789

hXXp://

AppEvents\Schemes\Apps\Explorer\Navigating\.Current

Caphyon.AI.ExtUI.IEClickSoundRemover

{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}

Windows

FOLDERID_Windows

{F38BF404-1D43-42F2-9305-67DE0B28FC23}

{18989B1D-99B5-455B-841C-AB7C74E4DDFC}

{A63293E8-664E-48DB-A079-DF759E0509F7}

{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}

{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}

{B97D20BB-F46A-4C97-BA10-5E3608430854}

{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}

{8983036C-27C0-404B-8F08-102D10DCFD74}

{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}

{8AD10C31-2ADB-4296-A8F7-E4701232C972}

{AE50C081-EBD2-438A-8655-8A092E34987A}

{2400183A-6185-49FB-A2D8-4A392A602BA3}

{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}

{3214FAB5-9757-4298-BB61-92A9DEAA44FF}

{ED4824AF-DCE4-45A8-81E2-FC7965083634}

{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}

{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}

{DE974D24-D9C6-4D3E-BF91-F4455120B917}

{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}

{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}

{905e63b6-c1bf-494e-b29c-65b732d3d21a}

{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}

{5E6C858F-0E22-4760-9AFE-EA3317B67173}

{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}

{33E28130-4E1E-4676-835A-98395C3BC3BB}

{C5ABBF53-E17F-4121-8900-86626FC2C973}

{4BD8D571-6D19-48D3-BE97-422220080E43}

{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}

{352481E8-33BE-4251-BA85-6007CAEDCF9D}

{D9DC8A3B-B784-432E-A781-5A1130A75963}

{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}

{1777F761-68AD-4D8A-87BD-30B759FA33DD}

{FDD39AD0-238F-46AF-ADB4-6C85480369C7}

{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}

{2B0F765D-C0E9-4171-908E-08A611B84FF6}

{B94237E7-57AC-4347-9151-B08C6C32D1F7}

{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}

{A4115719-D62E-491D-AA7C-E74B8BE3B067}

{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}

{D0384E7D-BAC3-4797-8F14-CBA229B392B5}

{9E52AB10-F80D-49DF-ACB8-4330F5687855}

{724EF170-A42D-4FEF-9F26-B60E846FBA4F}

<>:"/\|?*

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

RICHED20.DLL

/passive

Unable to start installation error code: %u

oAI_MORE_CMD_LINE

..\core\ExceptionPresenter.cpp

..\core\ExceptionHandling.cpp

C:\FAKE_DIR\

\/:*?"<>|

Failed to get Windows error message [win32 error 0x

EXCEPTION_CMD

Send Error Report

/cmdloc

Return code of msiexec.exe:

Launching msiexec.exe with command line:

Detected Windows Installer version:

Code returned to Windows by setup:

User name and password for proxy server were received from command line and used.

Command line to pass to MSI:

"%s" %s

TRANSFORMS=":%d"

TRANSFORMS="%s;%s\%d"

TRANSFORMS="%s\%d"

TRANSFORMS="%s"

%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s"

EXE_CMD_LINE="%s "

[SystemFolder]msiexec.exe

%s=%i

Windows installer is inluded in package.

%d.dll

%sholder%d.aiph

%d-%s

Windows 2000

Shlwapi.dll

Shell32.dll

%d.%d.%d.%d

\StringFileInfo\xx\%s

%d %s

%d.0%d %s

%d.%d %s

Windows 8 x64

Windows 8 x86

Windows Server 2012 x64

Windows 7 x64 Service Pack 1

Windows 7 x64

Windows 7 x86 Service Pack 1

Windows 7 x86

Windows Server 2008 R2 x64 Service Pack 1

Windows Server 2008 R2 x64

Windows Vista x64 Service Pack 2

Windows Vista x64 Service Pack 1

Windows Vista x64

Windows Vista x86 Service Pack 2

Windows Vista x86 Service Pack 1

Windows Vista x86

Windows Server 2008 x64

Windows Server 2008 x86

Windows XP x64 Service Pack 2

Windows XP x64 Service Pack 1

Windows XP x64

Windows Server 2003 x64 Service Pack 2

Windows Server 2003 x64 Service Pack 1

Windows Server 2003 x64

Windows Server 2003 x86 Service Pack 2

Windows Server 2003 x86 Service Pack 1

Windows Server 2003 x86

Windows XP x86

Windows XP x86 Service Pack 3

Windows XP x86 Service Pack 2

Windows XP x86 Service Pack 1

Windows 2000 Service Pack 4

Windows 2000 Service Pack 3

Windows 2000 Service Pack 2

Windows 2000 Service Pack 1

Windows NT 4.0

Windows NT 4.0 Service Pack 6

Windows NT 4.0 Service Pack 5

Windows NT 4.0 Service Pack 4

Windows NT 4.0 Service Pack 3

Windows NT 4.0 Service Pack 2

Windows NT 4.0 Service Pack 1

Windows 95 OSR

Windows 95 OSR2.5

Windows 95

Windows 98 SE

Windows 98

Windows Millennium

{374DE290-123F-4565-9164-39C4925E467B}

Newer version is at a local URL.

/exenoupdates

hXXp://VVV.example.com

hXXp://VVV.yahoo.com

hXXp://VVV.google.com

Detected SQL Compact:

Detected SQL Express:

Detected .NET:

HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\15.0\SharePoint

HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\14.0\SharePoint

HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\12.0\SharePoint

Windows SharePoint Services 3.0 or Microsoft Office SharePoint Server 2007

Windows Mobile Device Center 6.1

Windows Mobile Device Center 6.0

HKLM\SOFTWARE\Microsoft\Windows CE Services\MinorVersion

HKLM\SOFTWARE\Microsoft\Windows CE Services\MajorVersion

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CEAPPMGR.EXE\

HKLM\Software\Microsoft\VSTO Runtime Setup\v9.0.21022\Install

HKLM\Software\Microsoft\vsto runtime Setup\v2.0.50727\Install

{64E2917E-AA13-4CA4-BFFE-EA6EDA3AFCB4}

{FAB10E66-B22C-4274-8647-7CA1BA5EF30F}

{7102C98C-EF47-4F04-A227-FE33650BF954}

{011B9112-EBB1-4A6C-86CB-C2FDC9EA7B0E}

{B2279272-3FD2-434D-B94E-E4E0F8561AC4}

{8B74A499-37F8-4DEA-B5A0-D72FC501CEFA}

{3EA123B5-6316-452E-9D51-A489E06E2347}

{EECBA6B8-3A62-44AD-99EB-8666265466F9}

{1D844339-3DAE-413E-BC13-62D6A52816B2}

{4153F732-D670-4E44-8AB7-500F2B576BDA}

{EA7564AC-C67D-4868-BE5C-26E4FC2223FF}

{957A4EC0-E67B-4E86-A383-6AF7270B216A}

{00B41853-4377-4AD8-AD44-8404E0D331EC}

{580CB155-841D-4D48-9F59-866A035C2241}

{816D4DFD-FF7B-4C16-8943-EEB07DF989CB}

{C1F1028F-D91A-43E8-A117-4F7CAFD7A041}

{04E73476-518E-4B6A-8E10-021A00078847}

{ED569DB3-58C4-4463-971F-4AAABB6440BD}

{F1B5AE30-CB00-4DCF-978B-07D33B034ADB}

{1ABEAF09-435F-47D6-9FEB-0AD05D4EF3EA}

{53C65973-D89D-4EA0-8567-8788C14E0A02}

{A58B51D1-89BF-4D88-939D-B6D0DB2EEB53}

{835AC3CE-E36B-4D65-B50F-2863A682ABEE}

{1C8772BD-6E6F-4C9D-8FF8-B5EA072F86EF}

{6F1AE751-4D8A-4B25-AC0A-C6CB912A9791}

{3F40FA9E-26CA-4CA2-93C9-603622349915}

{14D3E42A-A318-4D77-9895-A7EE585EFC3B}

{C1E59364-35F6-44B3-AF0F-FCA934C4B252}

{A1FE0698-609D-400F-BF10-F52238DD6475}

6.01.7000.0000

6.00.6000.16386

4.09.00.0903

4.09.00.0902

4.09.00.0901

4.09.00.0900

4.08.02.0134

4.08.01.0901

4.08.01.0810

4.08.00.0400

4.07.01.3000

4.07.00.0716

4.07.00.0700

SQL Server Compact 4.0

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v4.0\ENU\DesktopRuntimeVersion

SQL Server Compact 3.5 SP2

SQL Server Compact 3.5 SP1

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v3.5\ENU\DesktopRuntimeServicePackLevel

SQL Server Compact 3.5

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v3.5\ENU\DesktopRuntimeVersion

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Native Client 11.0\CurrentVersion\Version

SQL Server Express 2012

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server 2012 Redist\SQLNCLI11\1033\CurrentVersion\Version

SQL Server Express 2008 R2

SQL Server Express 2008 SP2

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Native Client 10.0\CurrentVersion\Version

SQL Server Express 2008 SP1

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server 2008 Redist\SQLNCLI10\1033\CurrentVersion\Version

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\SQLSERVER2008\MSSQLServer\CurrentVersion\CurrentVersion

SQL Server Express 2008

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\SQLEXPRESS\MSSQLServer\CurrentVersion\CurrentVersion

9.00.5000

SQL Server Express 2005 SP4

9.00.4035

SQL Server Express 2005 SP3

9.00.3042

SQL Server Express 2005 SP2

9.00.2047

SQL Server Express 2005 SP1

SQL Server Express 2005

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\90\Tools\ClientSetup\CurrentVersion\CurrentVersion

HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727\Install

HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322\Install

3321-3705

HKLM\SOFTWARE\Microsoft\.NETFramework\policy\v1.0\3705

Windows 9x/ME

Windows NT/2000/XP/Vista/Windows 7/Windows 8 x86

Windows XP/Vista/Windows 7/Windows 8 x64

[SystemFolder]wininet.dll

[SystemFolder]inetsrv\inetinfo.exe

[SystemFolder]inetsrv\w3wp.exe

[ProgramFilesFolder]Microsoft Office\Office14\vviewer.dll

[ProgramFiles64Folder]Microsoft Office\Office14\vviewer.dll

[ProgramFilesFolder]Microsoft Office\Office15\vviewer.dll

[ProgramFiles64Folder]Microsoft Office\Office15\vviewer.dll

[ProgramFilesFolder]Microsoft Office\Office15\lync.exe

[ProgramFiles64Folder]Microsoft Office\Office15\lync.exe

EXE_CMD_LINE

SETUPEXEDIR

AI_SETUPEXEPATH

/aespassword

/proxypassword

/password

/exelog

/exelang

/exefullui

/exebasicui

/exenoui

%s %s

d-d-d @d:d:d

MajorVersion: %u;

MinorVersion: %u;

BuildNumber: %u;

PlatformId: %u;

CSDVersion: %s;

ServicePackMajor: %u;

ServicePackMinor: %u;

SuiteMask: %u;

ProductType: %u;

WindowsFolder

WindowsVolume

shfolder.dll

AI_INTANCE_LOCATION="%s"

/n %s

TRANSFORMS=:%s.mst MSINEWINSTANCE=1

Software\Microsoft\Windows\CurrentVersion\Run

MainAppCmdLine

UpdatesUrl

MainAppURL

SQLExpress

SQLCompact

Operator

SearchCmdLine

DLaunching URL:

G.part

wininet.dll

FTP Server

HTTP/1.0

Range: bytes=%u-

REST %u

SELECT `Value` FROM `Property` WHERE `Property` = '%s'

A\\.\pipe\ToServer

G.aiu

0.0.0.0

*.pack

--verbose --log-file="%s" --remove-pack-file "%s" "%s"

unpack200.exe

mstask.exe

[WindowsFolder]explorer.exe

A12\BIN\STSADM.EXE

14\BIN\STSADM.EXE

15\BIN\STSADM.EXE

Microsoft Shared\Web Server Extensions\

BIN\STSADM.EXE

SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\

Solutions.list

SharePointLogNoUrl

SharePointLogInstall

`Key` = '

AiMsgBox

AiProgressReport

ErrorMsgTitle

Software\Microsoft\Windows\CurrentVersion\Uninstall\

PTF://

hXXps://

AI_MORE_CMD_LINE=1

msiexec.exe

InstallExecuteAgain

InstallExecute

InstallExecuteSequence

1500000

3000000

PIDKEY

ARPURLUPDATEINFO

ARPURLINFOABOUT

zzzzzzzzz.zzzzzzzzzzzzzzzzzzzzzz

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\6_Offer_11.exe

Copy URL In Clipboard

You must locate, download and install the following prerequisites onto your computer. Double click on an URL to open it in your web browser.

Password:

Show password

This archive is corrupted.(This archive has an unsupported version.'Windows Installer could not be started.)An error occurred while reading the file.#An error occurred while extracting.

Select the download folder.R%s can not be installed on systems with Windows Installer version smaller than %s.

ErrorkThis package requires Windows Installer version "%s". You have "%s".

Please upgrade your Windows Installer.

%s Options(Extracting the main application files...

%s [options]

/listlangs - list languages supported by this setup

/exenoui - launches the EXE setup without UI

/exebasicui - launches the EXE setup with basic UI

/exelang <langId> - launches the EXE setup using the specified language

/password - password used by the proxy

/exelog<path_to_log_file> - creates a log file at specified path

/exenoupdates - does not check for a newer version

<msiOptions> - options for msiexec.exe on running the MSI package

Installing %s4Press the Next button to download the prerequisites.3Press the Next button to install the prerequisites.;Press the Next button to open the prerequisites' web sites.8Press the Finish button to install the main application.

%s Setup

Required: %s or lower.

Required: %s or higher.

Required: between %s and %s.

Found: %s.

NameCPress the Finish button when you are done and ready to install %s. 3Press the Next button to install the prerequisites.

Error: %s

Installing %s from: %sZSome prerequisites could not be installed. Press Back to return to the prerequisites list.{After launching all packages some required prerequisites are still missing. Press Back to return to the prerequisites list.aAll prerequisites have been installed successfully. Press Finish to install the main application.&Welcome to the %s Prerequisites Wizard

%d.%d KB/slSome required prerequisites are still missing. You can try again or remove them from the prerequisites list.

%d hr %d min at %s/sec

%d min %d sec at %s/sec

%d sec at %s/sec

Progress: %d%% (%s of %s) Downloading: %s %d%% (%s of %s)

Opening site of %s

Downloading %s Extracting files from archive...

Extracting file to %s0The %s file can't be unpacked. Error message: %saThe Java Runtime Environment version 1.5 or later must be installed in order to unpack JAR files.-Another instance of setup is already running.

%s cannot be installed on %s<%s cannot be installed on the following Windows versions: %sP%s cannot be installed on systems with Internet Explorer version smaller than %s\%s cannot be installed on systems with Internet Information Services version smaller than %sH%s cannot be installed on systems with screen resolution smaller than %sJ%s cannot be installed on systems with color quality smaller than %s bits.G%s cannot be installed on systems with less physical memory than %s MB.M%s cannot be installed on systems with .NET Framework version smaller than %s1%s requires administrative privileges to install.

Unpacking file:%syThere is not enough space in folder:%s

Preparing...L%s can not be installed on systems with Adobe Reader version smaller than %s

%s Languages

B%s cannot be installed on systems with JRE version smaller than %sF%s cannot be installed on systems with DirectX version smaller than %sw%s requires an active Internet connection for installation. Please check your network configuration and proxy settings.<%s cannot be installed on systems without %s 2003 or higher.<%s cannot be installed on systems without %s 2007 or higher.

QuestionOAn upgrade of the selected instance will be performed. Do you want to continue? Upgrade all installed instances.xThis package allows you to install multiple instances of %s. Please select the option you want and press OK to continue:L%s cannot be installed on systems with XNA Framework version smaller than %s

Evaluating launch conditions...B%s cannot be installed on systems with JDK version smaller than %s-%s can not be installed on systems without %s6%s cannot be installed on systems without %s or higher,%s cannot be installed on systems without %sK%s cannot be installed on systems without %s 2003 Primary Interop Assembly.K%s cannot be installed on systems without %s 2007 Primary Interop Assembly.-%s cannot be installed on systems without %s.<%s cannot be installed on systems without %s 2010 or higher.

Connect to %sNThe server %s at %s requires a username and password. Please enter them below.

Cannot acces URL: %sK%s cannot be installed on systems without %s 2010 Primary Interop Assembly.-%s cannot be installed on systems without %s.p%s cannot be installed because the current user does not have enough permissions to deploy SharePoint solutions.g%s cannot be installed because SharePoint Administration and SharePoint Timer services are not started.Y%s cannot be installed because the SharePoint solutions it contains are already deployed.

Failed>%s cannot be installed on systems running on virtual machines.F%s cannot be installed on systems without %s Primary Interop Assembly.PThere is a newer version of %s (%s).

Checking for a newer version...mFailed to download newer version (Error: %s). Would you like to retry or proceed and install current version?(Failed to read from file "%s". Error: %s'Failed to write in file "%s". Error: %s

Setup package was encrypted using AES 256 algorithm. To continue the setup process, you should provide the password needed to decrypt the package.?

Deleting extracted files...<%s cannot be installed on systems without %s 2013 or higher.EUnmatching digital signature between EXE bootstraper and MSI database

Invalid command line"Unable to init windows application

Internal errorNThis application cannot be installed on systems earlier than Windows 2000 SP4._This installation package is not supported by this processor type. Contact your product vendor.

Unexpected exception.XThe application ran into a problem that it couldn't handle.

Could not allocate memory.PParse error in file: "%1!ls!" at line: [%2!ld!] column: [%3!ld!] (code: %4!ls!).

Unsupported XML file encoding. File "%1!ls!" could not be read.

1.0.0

setup.exe

iexplore.exe_1432:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1612
   wmic.exe:1700
   1_Offer_3.exe:580
   

2. Delete the original MemScan file.
   
3. Delete or disinfect the following files created/modified by the MemScan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\f.exe (148472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\instructionsAVG3rs.dat (27625 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsv7E.tmp\Convert.dll (3005 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\jquery.min[1].js (2321 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\button_over[1].png (921 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\6_Offer_11.exe (858796 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\jquery-ui[1].css (33 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\dc[1].js (1657 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\jquery-ui-1.8.19.custom[1].css (5521 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\DynamicOfferScreen[1].htm (1140 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\bodyImg[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GT6NGPEB\button[1].png (458 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GX6V8DEZ\AVChecker19-6[1].exe (11154 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\Setup_product_4031[1].exe (1365779 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\412Z09MJ\DynamicOfferScreen[1].htm (850 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\1_Offer_3.exe (72 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9QZ45A3\jquery-ui.min[1].js (10441 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (238 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\NSISdl.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsj80.tmp\Registry.dll (25 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.