MD5: aeb7dc27069a3a429ef465c4b493eeb8
SHA1: 9a4c59c75882e718085dd66997c434436cfadcb6
SHA256: 65a5853fd4ebf95a9a560bda012082d4a99ef2ba193d712d366bd6e97cabdc4a
SSDeep: 24576:4y4OQYjmeh0Wfxuakp9aZc21lu1RkjY 1GxobrAY6iGGQ27/l:/4DXJ8ZLlQRkZyobrui
Size: 1467904 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Premium Installer
Created at: 2013-02-17 09:00:50
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

No specific payload has been found.

Process activity

The MemScan creates the following process(es):

wmic.exe:2452
%original file name%.exe:944
Setup__5551_il350168.exe:1356
SETUP.exe:2396
Setup.exe:2372
SETUP_~2.EXE:592

The MemScan injects its code into the following process(es):

ins.exe:2420

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process wmic.exe:2452 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (238 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (0 bytes)

The process %original file name%.exe:944 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Setup.exe (18559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\SETUP_~2.EXE (7168 bytes)

The process Setup__5551_il350168.exe:1356 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\index[1].htm (7617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\amipb[1].js (27951 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe:typelib (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\desktop.ini (67 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (0 bytes)

The process SETUP.exe:2396 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ins.exe (148860 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Convert.dll (3647 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ins.dat (26689 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (0 bytes)

The process Setup.exe:2372 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\SETUP.exe (9321 bytes)

The process ins.exe:2420 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\button_over[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\bottomLine[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\topComp[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\bodyImg[1].png (1748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\dc[1].js (2685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\nextCase[1].jpg (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\topLine[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\bgImg[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\button[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\DynamicOfferScreen[1].htm (1843 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (0 bytes)

The process SETUP_~2.EXE:592 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe (3249 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe (0 bytes)

Registry activity

The process wmic.exe:2452 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E AB BC AB 8D 97 BE 18 01 21 07 00 69 5E 6D 10"

The process %original file name%.exe:944 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 54 39 74 8C 73 5C 33 28 A3 33 FD 7E 66 36 1B"

To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

The process Setup__5551_il350168.exe:1356 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCR\mandrel.yodles]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\LocalServer32]
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\Setup__5551_il350168.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0]
"(Default)" = "InstallerLib"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\mandrel.yodles.1\CLSID]
"(Default)" = "{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Setup__5551_il350168\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\Version]
"(Default)" = "1.0"

[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\TypeLib]
"(Default)" = "{69155DE9-A119-4606-BE6A-28B4BEBFA504}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "Setup__5551_il350168.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\ProgID]
"(Default)" = "mandrel.yodles.1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1408604790"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\VersionIndependentProgID]
"(Default)" = "mandrel.yodles"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\Setup__5551_il350168.exe"

[HKCR\mandrel.yodles\CurVer]
"(Default)" = "mandrel.yodles.1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 22 8F 03 2A 49 EC B7 11 FE E1 68 61 21 40 1B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{f24d31ca-2f8f-4700-8e71-f9a292ebe34a}\TypeLib]
"(Default)" = "{69155de9-a119-4606-be6a-28b4bebfa504}"

[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\Setup__5551_il350168.exe"

[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\mandrel.yodles.1]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{69155DE9-A119-4606-BE6A-28B4BEBFA504}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000"

[HKCR\Interface\{5FF5C41E-3150-4A95-87F8-6E1BE305D7EB}]
"(Default)" = "IBoot"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Setup__5551_il350168\DEBUG]
"Trace Level"

The process SETUP.exe:2396 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 32 CD 71 BA B5 0A 71 4D F5 AA 96 16 F3 61 5C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process Setup.exe:2372 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Administrative Tools" = "%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Administrative Tools" = ""
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 F9 D4 A0 FA 74 A4 A4 03 37 25 22 02 49 D6 8B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
"Recent" = "%Documents and Settings%\%current user%\Recent"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000]
"setup.exe" = "This program will help you through the installation of your downloaded software"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process ins.exe:2420 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014090720140908\"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 51 EE 23 90 21 92 44 CE 65 7E 9C 39 18 CE 4F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CacheRepair" = "0"
"CachePrefix" = ":2014090720140908:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090720140908]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The MemScan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SETUP_~2.EXE:592 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Administrative Tools" = "%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000]
"Setup__5551_il350168.exe" = "Setup__5551_il350168"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Administrative Tools" = ""
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 96 CF BD D5 54 3D C3 1C 7E 00 19 D1 D3 23 BF"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 10.00.9200.16521
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE .MUI
Internal Name: Wextract
File Version: 10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/index.php
hxxp://dyno3mlj15jgv.cloudfront.net/V2/amipb.js
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/finalize.php
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/thankyou.php
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=4360&distid=19710&productid=18873&subpubid=0&campaignid=0&networkid=&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&ds1=&hb=0&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&
hxxp://stats.l.doubleclick.net/dc.js
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/topLine.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/topComp.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/bgImg.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/bodyImg.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/bottomLine.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/nextCase.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/button_over.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme7/button.png
hxxp://cdn1.vitaldownload.com/V2/amipb.js	54.192.55.17
hxxp://stats.g.doubleclick.net/dc.js	74.125.192.156
hxxp://installer.ppdownload.com/Installer/Flow?pubid=4360&distid=19710&productid=18873&subpubid=0&campaignid=0&networkid=&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&ds1=&hb=0&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2	50.19.221.149
hxxp://static.revenyou.com/offers/images/Theme7/nextCase.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme7/button_over.png	198.232.124.224
hxxp://www.idyllicdownload.com/index.php	107.20.210.63
hxxp://static.revenyou.com/offers/images/Theme7/bodyImg.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme7/button.png	198.232.124.224
hxxp://www.idyllicdownload.com/finalize.php	107.20.210.63
hxxp://www.idyllicdownload.com/thankyou.php	107.20.210.63
hxxp://static.revenyou.com/offers/images/Theme7/topComp.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme7/bottomLine.jpg	198.232.124.224
hxxp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&	50.19.221.149
hxxp://static.revenyou.com/offers/images/Theme7/bgImg.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme7/topLine.jpg	198.232.124.224

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET MALWARE SoundCloud Downloader Install Beacon

Traffic

GET /Installer/Flow?pubid=4360&distid=19710&productid=18873&subpubid=0&campaignid=0&networkid=&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&ds1=&hb=0&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.ppdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Sun, 07 Sep 2014 14:41:38 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8522

Connection: keep-alive
..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"8/$.Fmkcsez_oajgRvjdo
"8..'.PbaJay 5..% O_fGew1,.3 .&!NenjjoG_j_!6" '.
KkmaobpIB.2 % >fv]yqJ^a^p.4/("GnO\brCiqEnqoYge 7  .Ev`MME 7.!(
"Cs]PKJ/.9."*.;jfk^hcHil`.5. ).NbfcmMME 7.gptn5'*qki(sde
 \hk&gk`n*cmh'*hdc_qo/Btf\fg`IebepN[m^ck9nbfcma_63#^hotg_5,25.
*%he__h8*6512"cmpfokwf^<.60!ktl`fn</2$debnpi7%`f`8(!a`:*!(&
quot;P\l`.8*  .Ab_aobmk[k@ar\.5. ).@jtgqamnqbmQagI`qn.8.. .P_tgpm 7
9;0("Ca^`\rfpd.: ,$.IplgnpimiJ\mc.4,-, ?an\pbj`jcwMYo^ 7'0(&q
uot;Qg]`i?cndnIlnl\ej.4/("Tdjon_iIebep>ghf_k^Kenc.2..{)u!Loqo=
s^ 7.!("Nm]@qc.4!., >ghimk_mpTwk].36).LkngoauZrfimPyn`k.3 -
9;0)3 '.M^eH_x.: .$.KcdEdu62.2..*.LdlopoF\fc.4!UosOm]^.>]balcmY
ohp.%.Oat`H\lq.&!Lrm_m^mGA.9.3*.9gp_vmNbfcm.5)*.CrSago>jkGkms]l
j.2,% BrdQRJ.2..*.?waUPG*.3 .&!?okhYi]Jfhd.: .$.Hdc_qQRJ.2.arqj9 /
vhd)mfb'`lp dfah,`il /ma^`kq,>xjakd[J_dblR_rc`f:hdc_qed;-./.tlc
c921!\dlrf^<-95,(!ec^^o9163/..alomprwd\8 4/ rus`dl8,0#^e^=.!`]6..&a
mp;!Nar`.5&/).@`dgoajg_i>`pa 5., 7/3,-5241.% >hsevgmmn^qO_fG
ewn.5. ).O]ympl.3 .&!Afd`[obtb.9)1*.HmhklnhknP\l`.8*  .Dgn[m^n^hbu
R_o].3 .&!Olc`h<_rblHjsr\dg.8-&!Ripom\eMc`dnCmhe\gbIcma&quo
t;8..x%y.JnotCs].3 .&!Lrc@p`.8.. .CmhhjgcknSupc.2,% JimetguYobmkNx
leq.2.) ).QagI`q.3 EEDU_APJM>LQYTOEP.Kj_rt[qa\ZDfnm_ifd`Bpjon^pBrsa
nqdgilZY,8375.$.KcdEdu62.2.AIBS^?UPM=IM]RMDN Qj^op_o_[XIlnl\ejb^Anoun]
m>vq_moimikWU06163"*.J`imonM]mc.2.L_s_O]sq.Fjg P_`ncf.$.Ip
<<< skipped >>>

GET /V2/amipb.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.idyllicdownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn1.vitaldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 40585

Connection: keep-alive

Date: Fri, 22 Aug 2014 22:33:35 GMT

x-amz-meta-cb-modifiedtime: Tue, 29 Jul 2014 10:46:22 GMT

Last-Modified: Wed, 30 Jul 2014 08:42:33 GMT

ETag: "d10a2ed9a4a2e81b939e360fc4931c09"

Accept-Ranges: bytes

Server: AmazonS3

Age: 61283

X-Cache: Hit from cloudfront

Via: 1.1 7c92101f5a051b6077d0586c8a74d49e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0booVGIZcRnCi6YE6Y0wLmpxoKeOsxBQjbptWSn98DWOyCSuIo-yLw==
//<!-- ../*    Progress bar   */..var g_AmiPbs = new Array();..func
tion LogMessage(message)..{..    try..    {..        g_ami.Log(message
);..    }..    catch (excpt) { }..}..function AmiPbDelayedCheck(id) {.
.    var that = g_AmiPbs[id];..    if (that && that.periodicCheck) tha
t.periodicCheck();..}..function InitPb() {..    ..    LogMessage('Init
Pb function started');..    ..    Show('header-close', 'none');..    v
ar progress1 = new AmiPb("download_progress_host", 400, 20);..    var 
progress2 = new AmiPb("install_progress_host", 400, 20);..    progress
1.start(function () {..        var p = g_ami.DownloadProgress;..      
  this.setValues(p, p);..        if (g_ami.DownloadCompleted) {..     
       LogMessage('InitPb g_ami.DownloadCompleted is True');..        
    g_ami.ReleasePostponedInstallations();..            for (var j = 0
; j < g_comps.length; j  )..                if ((g_comps[j].id == 0
 && g_comps[j].sel == 0) || g_comps[j].id == 0x7fffffff) {..          
          g_ami.AddThanksParameter('c['   g_comps[j].sn   '][s]', g_co
mps[j].pir ? '-2' : '-1');..                    if (g_testa && !ArrayC
ontains(g_notest, g_comps[j].sn) && !ArrayContains(g_notest1, g_comps[
j].sn)) {..                        if (g_testa.constructor != Array ||
 ArrayContains(g_testa, g_comps[j].sn))..                            g
_ami.WriteProfileString(g_testf, '', g_comps[j].sn, g_comps[j].pir ? '
R' : 'S');..                    }..                }..            this
.stop();..        }..    }, 20);..    progress2.start(function () 
<<< skipped >>>

POST /thankyou.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.idyllicdownload.com

Content-Length: 1006

Connection: Keep-Alive

_srvlog=&c[AdvancedSysCare][r]=5&c[AdvancedSysCare][s]=-31&c[AmigoIM][r]=6&c[AmigoIM][s]=-31&c[DownloadManager][r]=0&c[DownloadManager][s]=-31&c[ElectroRevizer1][s]=-31&c[ElectroRevizer2][s]=-31&c[MariMediaRevize][s]=-31&c[NationZoom][r]=1&c[NationZoom][s]=-31&c[NetFilter][r]=0.01&c[NetFilter][s]=-31&c[PlusHDrow][r]=3&c[PlusHDrow][s]=-31&c[Yontoo1][s]=-31&c[Yontoo3][s]=-31&c[Yontoo5][s]=-31&c[Yontoo6][s]=-31&c[Yontoo7][s]=-31&c[updater][r]=0.01&c[updater][s]=-31&capp=DownloadManager&cc=UA&cid=5551&clip=193.138.244.231&cmdl=Setup__5551_il350168.exe /S /NCRC&cnt=87fc35be4bb81198d9fd59a8fe3438b0&is=-31&netfs=-31&sysid=D6A6947B24975DB6AB9DE8B171C5FA6E&sysid1=D6A6947B24975DB6AB9DE8B171C5FA6E&te=1410100915&thankyoupage=http://VVV.installpath.com/thank-you.html?subid=5551&tid=&ts=1410100904&ver=1.1.6.20&vert=3
HTTP/1.1 200 OK

Content-Type: text/plain; charset=UTF-8

Date: Sun, 07 Sep 2014 14:41:37 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 14

Connection: keep-alive
....      ..HTTP/1.1 200 OK..Content-Type: text/plain; charset=UTF-8..
Date: Sun, 07 Sep 2014 14:41:37 GMT..Server: Apache/2.2.15 (Red Hat)..
X-Powered-By: PHP/5.3.3..Content-Length: 14..Connection: keep-alive...
...      ....

GET /offers/images/Theme7/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/jpeg

Content-Length: 1785

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Tue, 12 Mar 2013 18:05:10 GMT

ETag: "0fac224c1fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
..........................................................2.N.........
....\.................................................................
R..T.................................?.....mmd.@<..kk%2....[Y)../..
..L.y}f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}
f..Jd...6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd.
..6..S ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S
 ._Y...............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y..
.............mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y........
.......mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y..............
.mmd.@<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@
<..kk%2....[Y)../....L.y}f..Jd...6..S ._Y...............mmd.@<..
kk%2..................................................................
.............................................. .......................
......................................................................
...................... 5.qD...(..][email protected].... 5.qD...(..].
[email protected].... 5.qD...(..][email protected].... 5.qD...(..].
[email protected].... 5.qD...(..][email protected].... 5.qD...(..].
[email protected].... 5.qD...(..][email protected].... 5.qD...(..].
[email protected].... 5.qD...(..][email protected].... 5.qD.(......
P..@(......P..@(......P..@(......P..@(......P..@(......P..@(......
<<< skipped >>>

GET /offers/images/Theme7/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/jpeg

Content-Length: 2801

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Tue, 12 Mar 2013 18:05:10 GMT

ETag: "0fac224c1fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
..........................................................,.N.........
....Q.................................................................
..........................?..H........ ... .U..@E.....@@............( 
.PE..E...@P...............................%.A..D...@.@@...."......"..%
[email protected][email protected] ..... [email protected]...@.@@....".......(...
(......". [email protected]...@.@@[email protected]@.......
.E...........................(. ... ........... ..... .. .( ...."...".
.. (... [email protected][email protected]......@.......
D..................j2..........%P...P.......... .. .. ."..%Q...P..D..@
...................- .. .... .E............( [email protected]....
[email protected].([email protected]......... . . .."..%[email protected].@...
................i...................  .....(. .( ........"............
[email protected]......@[email protected]@........E................
............H ... .(...(...................... .......................
[email protected]..@...@[email protected].............. . .........................
....I..E.@........ ........@[email protected]...(.....".. .....................
.4.i...J(. .(...([email protected]....".. ..... ....................
[email protected]......... . . ..".. ".......(.........................4YP.
[email protected].@..@.@.......@.........................,.......
. ..... ..........( .(. .(..".............................U..A....
<<< skipped >>>

GET /offers/images/Theme7/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/jpeg

Content-Length: 1654

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Wed, 13 Mar 2013 13:08:16 GMT

ETag: "35420d3eb1fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
..........................................................2.N.........
....[..............................................................Q..
...T................................?..?/.........V...<.........qZ.
..... X[@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[
@._Y.k.h...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h
...8.am.y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.
y}g..-../.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-..
/.........V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.......
..V...<.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...&l
t;.........qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...<......
...qZ...... X[@._Y.k.h...8.am.y}g..-../.........V...\.................
......................................................................
[email protected][email protected][email protected]...
@[email protected][email protected][email protected][email protected]....
[email protected][email protected]......;0..f.t..n.......v`7N......;0..f.t..n.
......v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......
;0..f.t..n.......v`7N......;0..f.t..n.......v`7N......;0..f.t..n......
.v`7N......;0..f.t..n.......v`7N......;0..f.t..n.......v`7N...........
......................................................................
..................................................................
<<< skipped >>>

GET /offers/images/Theme7/button_over.png HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/png

Content-Length: 1274

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 22 Oct 2012 15:36:02 GMT

ETag: "0dd0f16ab0cd1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR...|..."........9....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..[Kl.E..gw............J.Q...p..\..Rz...!A#.KE..=...J.....
6.B....\@....*.m.Kh.H.4..{c......8vHD9.f...>...x....1.Y...A`h\.z |O
....N.c.&../!w C...<3s]......<..v.`.|O.;l.....B...o.t!].6.8|`..M
.df...e...e((.$2Q...tx/.>~W..}.e..a..lF=N......OxHJ. .c..3PR.(:..^.
q<8mn.......ZVaA..MW...#(|i........t.....]C#}..BB....M(*9f.....Fb..
......q.>.......G*.....$.?..m$.....e.<.y.....z...)a.W0-..n..(...
......g[ ..,...}......L.*.r..~...o..wU.A..wN.......N<.rQ...)O...ra.
..[.b....c.........._-.1.S.....:1|k...@u...!..y................}.v..i\
tiP.chx..a...<p.y..N.<|..tAVN1...h}.6.6.7.].....;y..5\..}...N#6/
..v.0.W..R.W.9..j...2...%..V..i..1..n......Ws6my..-.......p.....4.....
[email protected] .....K1B.-....%..z..[..a@Y7.....]F....;.f5
h..j........\..r..`.ef!.A).....u.........}....`.n5d.....LQg...8.J..../
.v'{..R.-k.N.......]9...s...s.......<...d!,....O...lD....z...w.>
|..........`...b..L~?.....9.....Z...?_..>...h{|gY7... .v..!a.&.....
.%.9...C.SgG.....&.".....C..>..2.....Z.nf..BN*..p..?.#.g.?.2.DUp..'
'fv.......lz......O.....B......<L..D.E.q....ALHp.l..j.v.y....[E....
........M.`.6....;8.~..f..u......)....^.\."...7..9..W.t)F_'Uks.....~..
.0...d7r.I.wZ..".f...N.9R.z.....@7[.N.G.......u]......IEND.B`...
<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0& HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xml.the-app-info.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Sun, 07 Sep 2014 14:41:35 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 11168

Connection: keep-alive
<html>.    <head>.      <title>5 - NonProduct (Setup
 Launcher)</title><script type='text/javascript'>var _gaq 
= _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_
setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]
);..                                            _gaq.push(['_trackPage
view']);..                                            (function() {.. 
                                             var ga = document.createE
lement('script'); ga.type = 'text/javascript'; ga.async = true;..     
                                         ga.src = ('https:' == documen
t.location.protocol ? 'hXXps://' : 'hXXp://')   'stats.g.doubleclick.n
et/dc.js';..                                              var s = docu
ment.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, 
s);..                                            })();</script>&
lt;style type='text/css'>body      {          width:100%; height:10
0%; margin:0px; padding:0px; font-size:font-family:helvetica; font-siz
e:12px; }        .divLeadpName      {          margin-left:61px; margi
n-top:9px; font-size:font-family:helvetica; font-style:italic; font-si
ze:25px;                                   font-weight:bold; color:bla
ck; position:absolute;     }            .divOnNext      {          pos
ition:absolute; bottom:11px; right:28px; width:124px; height:35px; cur
sor:pointer;                                   background:url("hXXp://
static.revenyou.com/offers/images/Theme7/button.png");}           
<<< skipped >>>

POST /index.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.idyllicdownload.com

Content-Length: 275

Connection: Keep-Alive

Cache-Control: no-cache

Net1.1=&Net2=3.5.21022.08&Net4=4.0.30319&OSversion=NT5.1SP3&Slv=&Sysid=D6A6947B24975DB6AB9DE8B171C5FA6E&Sysid1=D6A6947B24975DB6AB9DE8B171C5FA6E&X64=N&admin=Y&browser=IEXPLORE.EXE&chver=&exe=Setup__5551_il350168&ffver=&lang_DfltUser=0409&netfs=3&s=Y&ts=1410100904&ver=1.1.6.20
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sun, 07 Sep 2014 14:41:26 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive
1b79....      ..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transi
tional//EN">..<html>..<head>..<meta http-equiv="cont
ent-type" content="text/html; charset=UTF-8" /> ..<title>%app
name% Installation</title>..<base href="hXXp://VVV.idyllicdow
nload.com:80/index.php" />..<script type="text/javascript" src="
hXXp://cdn1.vitaldownload.com/V2/amipb.js"></script>..<scr
ipt type="text/javascript">..var g_amiobj = '', g_ami, g_updb = fal
se;..var g_eula = ''; ..var g_post1 = '_hdn=1&_ver=1.1.6.20&_p=1&_s=10
&_cc=UA&_cid=5551&_psb=0&_cnt=ff5c2d87d1f88a8168429e3755eec003&_instid
=&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=-31&_vert=3';..var g_ic
on = '';..var g_comps = [], g_pages = [], c, g_curPage = -1;..var g_ci
d = '5551';..var g_tid = '';..var g_cc = 'UA';..var g_lang = 'en';..va
r g_ip = '193.138.244.231';..var g_browser = 'ie';..var g_cnt = '87fc3
5be4bb81198d9fd59a8fe3438b0';..var g_ver = '1.1.6.20';..var g_buttonIm
age = 1;..var g_thanks = 'thankyou.php';..var g_images = [];..var g_pu
rl = 'hXXp://VVV.idyllicdownload.com:80/pix.php';..var g_skipCats = 40
96;..var g_ieVer = '6.0';..var g_chVer = '';..var g_ffVer = '';..var g
_netfs = -31;..var g_vert  = 3;..function InitInstall()..{..    g_ami.
AddThanksParameter('tid', g_tid);..    g_ami.AddThanksParameter('cid',
 g_cid);..    g_ami.AddThanksParameter('cc', g_cc);..    g_ami.AddThan
ksParameter('cnt', g_cnt);..    g_ami.AddThanksParameter('ver', g_ver)
;    ..    g_ami.AddThanksParameter('vert', g_vert);..    g_ami.Ad
<<< skipped >>>

POST /finalize.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.idyllicdownload.com/index.php

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.idyllicdownload.com

Content-Length: 595

Connection: Keep-Alive

Cache-Control: no-cache

_hdn=1&_ver=1.1.6.20&_p=1&_s=10&_cc=UA&_cid=5551&_psb=0&_cnt=ff5c2d87d1f88a8168429e3755eec003&_instid=&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=-31&_vert=3&r_DownloadManager=0&r_updater=0.01&r_NetFilter=0.01&r_Yontoo1=1&r_Yontoo3=3&r_Yontoo5=1&r_Yontoo6=1&r_Yontoo7=1&r_NationZoom=1&r_ElectroRevizer1=900&r_ElectroRevizer2=900&r_MariMediaRevize=900&r_PlusHDrow=3&r_AdvancedSysCare=5&r_AmigoIM=6&DownloadManager=3&updater=2&NetFilter=2&Yontoo1=1&Yontoo3=0&Yontoo5=0&Yontoo6=0&Yontoo7=0&NationZoom=1&ElectroRevizer1=0&ElectroRevizer2=0&MariMediaRevize=0&PlusHDrow=1&AdvancedSysCare=1&AmigoIM=1
HTTP/1.1 200 OK

Content-Type: text/xml

Date: Sun, 07 Sep 2014 14:41:27 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive
1b89....<Array><page><f>1</f><fb>1</f
b><pt>0</pt><cats>0</cats><updh>1<
/updh><wrn></wrn><comps>DownloadManager</comps
><bdy>DQoNCgk8ZGl2IHN0eWxlPSJ3aWR0aDogMTAwJTsgaGVpZ2h0OiA4NXB
4OyBib3JkZXItYm90dG9tLXdpZHRoOiAxcHg7IGJvcmRlci1ib3R0b20tc3R5bGU6IHNvb
GlkOyBib3JkZXItYm90dG9tLWNvbG9yOiByZ2IoMTcwLCAxNzAsIDE3MCk7IG1hcmdpbi1
0b3A6IDBweCI DQoJICZuYnNwOyZuYnNwOw0KCTxwIHN0eWxlPSJwYWRkaW5nOiA1cHg7I
HRleHQtYWxpZ246IGxlZnQ7IGZvbnQtc2l6ZTogMTdweCI DQo8c3BhbiBzdHlsZT0iZm9
udC1zaXplOiAxN3B4OyB0ZXh0LWFsaWduOiBsZWZ0Ij5Eb3dubG9hZCAmYW1wOyBJbnN0Y
WxsIDxiPiVhcHBuYW1lJTwvYj4gZm9yIEZSRUU8L3NwYW4 DQogIDwvcD4NCjwvZGl2Pg0
KPGRpdiBpZD0iZF9hbWlfRG93bmxvYWRNYW5hZ2VyIiBzdHlsZT0iaGVpZ2h0OiAxMzBwe
CI IA0KPGJyIC8 DQo8cCBzdHlsZT0iZm9udC1zaXplOiAxM3B4OyB0ZXh0LWFsaWduOiB
jZW50ZXI7IHBhZGRpbmc6IDBweCI PGI Q2xpY2sgTmV4dCBvciBJbnN0YWxsIGJlbG93I
HRvIGJlZ2luIHlvdXIgaW5zdGFsbGF0aW9uLjwvYj48L3A DQoJPGRpdiBkYXRhLWFkanV
zdC1oZWlnaHQ9IjAiIGlkPSJtaWRkbGUiIHN0eWxlPSJ3aWR0aDogMTAwJTsgcGFkZGluZ
zogMHB4OyBoZWlnaHQ6IDExMHB4OyBtYXJnaW4tdG9wOiAwcHgiPg0KCQ0KCQk8dGV4dGF
yZWEgc3BlbGxjaGVjaz0iZmFsc2UiIGNsYXNzPSJ0ZXh0YXJlYTEiIGlkPSJhbWlfZXVsY
V9Eb3dubG9hZE1hbmFnZXIiIHJlYWRvbmx5PSJyZWFkb25seSI CQkNCgkJPC90ZXh0YXJ
lYT4NCg0KCTwvZGl2Pg0KCTwvZGl2Pg0KDQoJPGlucHV0IGlkPSJpX2FtaV9Eb3dubG9hZ
E1hbmFnZXIiIHR5cGU9ImhpZGRlbiIgdmFsdWU9IjEiIC8 DQoNCgk8ZGl2IGlkPSJwaG9
sZGVyc0Rvd25sb2FkTWFuYWdlciIgc3R5bGU9InBhZGRpbmctbGVmdDogMTBweCI DQoNC
gkJPGRpdiBjbGFzcz0iYW1pLWV4cHJlc3MtY3VzdG9tIiBzdHlsZT0id2lkdGg6IDE
<<< skipped >>>

GET /offers/images/Theme7/topComp.png HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/png

Content-Length: 1684

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Tue, 12 Mar 2013 18:06:58 GMT

ETag: "08db634c1fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR...*...0.....g.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...6IDATx..Y{LSW....mK_.....,.....%..q.....23...9..1....p.7..h.3c&g
t;..2g.5f3Q.=..8.M.5....V..[.S...}_[..-m!n....s.wO..........OB...i1.1.
..........`.=8"../..]c....4..=.o=n..^.....d4X.w.AAvF...R......a..-...J
...od......#\.~{.....Y.\.\[email protected].!m..D.S...VSKOE..C....k.."PmXg.{uJ
.....i..B..%......P.........5^*C.i7/.)..p...<.....=........[.P.x.j[
9..h.:E.]wg,..$U}(.....B.p..D.3q....u. ..T......_.....w =3.=.#..`b8fB3
.<`D)~...Z...3......!:U....&..L.NZ.......5...`en{.y..8VD.......v.v.
Y....?[;?*....S.7.....u.......P4-....k...x.....A6#.|......%E..........
.....h..8r........R.g..:.WV.;..d..V....n...h.*.}....!t.A.1....o.N.^..S
C..#[email protected]\p#.p..k...9..).:m).J;.z...#a6z.R........01/'..J...1.0..
..S....\..nJ..a.....q\.....d....W2......B....."T|..q..>.p...9E|....
AF.!..([email protected] ......?]lD..H.E....2.g.$P..*&.]..l.z.&....`O..Y.[W8.
.....T.92\!..8..4.*.dN.......d20..E.8....:..u...2.....-.W.O..0...W...s
....\[^...5.aw5.....es.f.`...P....j..P}........P..A8 ...1g.uw...;P..}.
.f.FTw../~..n.e.7Wl..U)u.6.....N..B..4\5...V.w..M.6......k..E.h<>
;...........uU....w..><F.O.k...... >^...d2.D.6J...j]{F..K..6.
...J3.................N..s........r.]T`...k.Q.*.2/9A.G.....{G..B....X.
8.f.jil.>..O....#...U.5...==.`w.=..A.....;,..bH.R9..*X4.5.auEr.....
=1a.G...M.J*6..=,..p2.y.....p..M.mh........,[email protected].:.......U
....D..M .JBL&..."....J....0(@...a.&...a..........._....X.F..0..!....9
...Y}.}.6..P(.......&.`....`......9|[email protected].&....L.
<<< skipped >>>

GET /offers/images/Theme7/bodyImg.png HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/png

Content-Length: 14789

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Tue, 12 Mar 2013 18:09:36 GMT

ETag: "07038c14c1fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR................s....tEXtSoftware.Adobe ImageReadyq.e&
lt;..9gIDATx.....U...7OQ..F.!py........qEY..1.....&...t.Q...5.Q{%i.a.^
.JVz4.q........U .Q.#..y....1....7w.......U{..g.....U..{....G.........
...x...6....^.x .x............../.H/^.x .x.@z..%g..oA...5k.M...../.H/^
<.^.x.@z.........../.H/^jQ.8...2A....Te.*g..S.....UY.....<.^...x
.*[email protected].?SeR...TyZ.g"H.x .....M....^..s..~U
..g.....q.......7.]..R..u.. pn.H/..HQ...............g?..8..`..I..!C...
g>..Bu..<..H.dq..i.....`.y....Y......={....T...:.=.H/..b....!U..
.mmm.3.<....{..'..\y.....`......<.^<..........?v.X.)q.=z..>
;..O.W]uUp.9...G.......{ .x [email protected]@...*_ ..Y
[email protected]./.....!/. .>..O.s.........n...'?.I.~.z...U. ..........P.R.V...
U9:z..`..yA.~.B(w...<...... ...K.!..>..|@...H/^.......Re........
...zj...j.....^.>.....]....r.......\.^.Te.Yg..|.K_.N9..PS.l..5../~.
l..E....7..N.../9C.K.r.*...z.u...!..(.~.a.r.....Y..?2a.....K.P..A...&l
t;_...J....}..._.=x....n.TyHA......K.P.....0_1...w...<r.H.._.:x..7.
].%..H.....Z......rh......^Z........4@9....@z.%(....x?q..`.......p.t..
[email protected](1..."..._...6...DY.vm.H..5.....K-..TY../...R...D<,...
D....H/^.....q.*.0.2s...v..<|.p...o.3G4.c.%......|.D....~..Q...c...
x.w..0....4. ..M.H/^...9x..../.04]u(......7o..XM.UP^....%_A ...N:)8...
...........s......H/^..........z......d. ..&...}.../..2...x...~....dZ.
..&...C.....%?-yT....H...:./..}......U.....%?(._.%..0a../..;v....<.
..?.....K....s..g......".... x...M.^...../9iI...1sH.a2[.~.....C.l.
<<< skipped >>>

GET /offers/images/Theme7/nextCase.jpg HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/jpeg

Content-Length: 798

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Wed, 13 Mar 2013 12:09:45 GMT

ETag: "c8d90a6e31fce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
..........................................................2...........
....i.................................................................
.Q..S...!..c.1Aq..................................?..o....G.."..UkeDj*
...b.y.q.jP..............U^E.j..J..E.S....Bi.;q..F..xz..........[...S.
....(.............a:...}...&.....`:....6.Y...O...uA@.............{....
....i...h............z\9~./.aq.ZP................V%.......LM...4r...*\
@...,.[..G.#.._.9<....k.*..............M..f....qV..W/...M\O.E:.u..@
T..<..#..L.QS....#.e...G.T.2.~L..)[email protected].{.e..Hs....=...
]...z.!....(..C.w.&Q...2.~L..)[email protected].{.e..Hs....=.....D..=.
.."y.Q.....@T.@...................?......


GET /offers/images/Theme7/button.png HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 14:41:42 GMT

Content-Type: image/png

Content-Length: 1256

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 22 Oct 2012 15:36:14 GMT

ETag: "0eb27f86ab0cd1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Sun, 14 Sep 2014 14:41:42 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR...|..."........9....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..[_h[U....776M..[..-.u6...!.N.E.......V6A..^...=....^..S.
...Cp8..Nl..Z..-..g.L...m...&M.=.^...............{/y.~...{.9:..p...l..
..'./8...."N.G.@...."7sU.@. ....'z.....\"n8s...B....0..<....X...E,.
..f...-...$..R..9....(...E...._^.......u8...V....%.5zaA..T:.EC..\..\.j
.@.....~p.^P2......f....(..]..1.zeq..H ..6ul..t=.Y#....(r.[.F.....P..c
........Q....m.K...........t<.8.,^.EK./...5..(P#..P...f......).o..L
p.T..z...[[.{..:..z.....`...].P...@Q...>...z...K!.p......,.B..m.A..
1..........|...9.c..............."..Ro.i.0..XD..-A.j.<...b..d....=.
\..b.t.qK9.E.... [email protected]...[... .FI...(`.....p...$.(...
.1.....!......(8.(#.Ig..-8......>..,.v.6...........L.L.../x.Hc#/...
.......9.../{5{..=|...C.J...h[a.n.b...-[A......{.3aYX.QK_.x.P..-....Ws
.Xm....i_......f3...<...5..0y..GOf....:...u..3..klZ>.q.P(|#HKoV8
..................<...-......[.Vr.w.)......f....e.S...k...Ax.?Hv...
-..b..0..$.......l.Z....g.i<.9X.p.d..(r.k.2g..J.. ./!o#i.C...#...'.
#.g.>...l..........J.w|8...8;...}..../n~..T.!7o_c..|.....9o...<.
.._.|;hqV Y7.6XX.....0.C.4.mV..!o.t.$$.?.......1...$.........<].s.|
A9.}.........._Jb.\.2..q.|..Z1..Q..9..I.=..wO..s/......d'.......Pd..BN
!..^.c.-...W........./I....IEND.B`...
<<< skipped >>>

GET /dc.js HTTP/1.1

Accept: */*

Referer: hXXp://xml.the-app-info.com//offers/DynamicOfferScreen?offerid=5&distid=19710&leadp=18873&countryid=262&sysbit=32&imgurl=&dfb=0&hb=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stats.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 07 Sep 2014 13:38:22 GMT

Expires: Sun, 07 Sep 2014 15:38:22 GMT

Last-Modified: Wed, 27 Aug 2014 18:16:28 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15801

Cache-Control: public, max-age=7200

Age: 3800

Alternate-Protocol: 80:quic
...........}kW....w~.....;[email protected]...].,CJp..pi......d.I.~.k...X
...2..f.n<ND..&........2..H~.x.;......,..A...~~...2.....p..........
.../..A$...M!....,.~.2..."..~%.p..e..'.....a..8.`8L.v.Aq....aC._.\\8l.
..0..5FH%...@^Ay.;..sUI....b...&p..I...s...N6....C.,.......s...~..`(..
...<.b...t...p..;@\.2.. .G..=..b.3...X............3...@........~...
..S.....P.`.8......aw...~...[>.C......X..".........b.p.0....c.7}h1.
.n....../[email protected]. M.Yl..!..R.i.Z.eo./>1.
bR.............al...b.....b.........}1L..c...;........^.....T....xp..L
...B..e..Tn?vk\.<...x..mU.g.{.=..;X4.^............M.."..mo.i.h0.j..
..w.V..t8N"w...t..........hx.zv.1.d.x.......b.z.'......[..v.R.......}w
.YQ1..>........!.0.u..]x.:^.......{.$.eL...o.m>.&r...R.8)KF.....
...1."....h....a?.e"..,....Z...y.sqA.........CTo...........n...1....W.
.v9r...:E.E..{....B............_..o....g...j..f..`...(...Q.....j......
.w@.....^;.G<..;..>..L....[...fx....o...K...s..!......M...w0J.ar
kl.............._.3..T......N. ....I.....|..*...}.Zi.....Np^IP4`n*...Q
..O.%4T ...;.....%J.........xKK.&..^I../{............8..83[X......p...
c...3j%.....Z.....m"tf.Gm. .ZY.Y....T.._.lH.......A=1..N.....;..R ..{.
..(.RS..^...)...8em.e.EU...,...."I.L..C.....R......%...<$..........
......L.,..^.R...l...[...n2.....6.v.Q..=....v.#.0.......g.5..z]__.a.j.
..fJh.....r.6a.6v3..!.}^0...,...I.w................Q..q ..c;2.p2 .%..;
0..14....f....c.*Z..*..>..[v].....H...N...kVT.]....I ...._.........
.^]..e..]..wd.N.....9..u5.bZ`.*...i.`..V..l.{.*{..(.,2.nv. .......
<<< skipped >>>

The MemScan connects to the servers at the folowing location(s):

.text

`.data

.idata

@.rsrc

@.reloc

Invalid parameter passed to C runtime function.

advapi32.dll

setupx.dll

setupapi.dll

advpack.dll

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

ADMQCMD

USRQCMD

FINISHMSG

IXPd.TMP

msdownld.tmp

TMP4351$.TMP

wextract.pdb

PSSSSSSh

PSSShX

PSShX

SShtL@

zcÁ

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

Command.com /c %s

rundll32.exe %s,InstallHinfSection %s 128 %s

SHELL32.DLL

Software\Microsoft\Windows\CurrentVersion\RunOnce

%s /D:%s

PendingFileRenameOperations

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

RegCreateKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegCloseKey

ADVAPI32.dll

GetWindowsDirectoryA

KERNEL32.dll

GDI32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

_amsg_exit

_acmdln

msvcrt.dll

COMCTL32.dll

Cabinet.dll

VERSION.dll

)%u]Q

Bp.Dx

gA`0)%UJ

SETUP_~2.EXE

Setup.exe

lW.Wi

%XTIxs

Bu.oU

=G.oV

^}0

){%%d

FtPq
:..ut
#.Ff$
{3I%s
-ky}Z
NrK%u
0w@%x
.rmf6w.
s%FZ]
.gl,K
VH;%F 
N*sB.Jy
)F.Vd
4.ii.EfCKU
%SK85
ZZ-5}r
=eXEo
oh.bwR
A%CG`
2(^.EZ
Wl.Fz
&,[t|.RF4
:.cm=
'6.lp
DQ".MO
.YO{{
G.qGr
U.DY4
Q.NJe
.AJ(0A&U
.Nnee
%uE/rm
h}%CR
]:.fC'4
E.MxmO
.Yp]i
@%Dvr
.BWe@w
Gn .nHW;m
Y:\t4
.sp?!
7]%C,
s#O.mhO
.FZJ{
/.khh
b.IY,
|.drJ
e.TH]
.NK$Sb
.Wtp(0
.vY8!
W;;.eI6pa
*y%S)>
%SKebEs
,%%s]xcP
#H#Lx.ik
R.W%Xe
8.IAIS
U.NIg
E%uO~<^y
1%Sut]
3'%x%F
;s.UZ
JZ_-O}~
12%XN
j.tGz
%%fg)
xre.nRf
q&(I}.gvcBJk
.cR,tI
%C'AN
f.jB>
P ;%D
l.WlJ
-zs94%c
AO#-E}
%6 -@^//
u_.RI
g%Xof
B.Hx|
CRT4F
\.vu$M
.TsB$
^.yT1
.FCXI~
Y]K^&E.oeK
.bp '
x%U,5
q.zvN28F
nP%fM
y]v%F
GQ\.Ty
%xYcn
%5uoQ
C(.SiA
YZs%F
D!$%c
dsshM
<assemblyIdentity version="5.1.0.0"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel
<!--The ID below indicates application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--The ID below indicates application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!--The ID below indicates application support for Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
5&5,52585
Kernel32.dll
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
CFailed to get disk space information from: %s.
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
8Unable to retrieve operating system version information.!Memory allocation request failed.
Filetable full.Ên not change to destination folder.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
(Error creating process <%s>. Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Could not create folder '%s'
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
Error retrieving Windows folder
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
/C:<Cmd> -- Override Install Command defined by author.
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
Could not find the file: %s.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
WEXTRACT.EXE .MUI
Windows
10.00.9200.16521

Setup.exe_2372:


!Require Windows
.text
`.rdata
@.data
.rsrc
v%f=a
<x%u<
"%s".
Could not overwrite file "%s".
Could not create file "%s".
0xX.
7-Zip: Internal error, code 0xX.
7-Zip: Internal error, code %u.
7-Zip: Unsupported method.
Error during execution "%s".
"setup.exe"
Could not find "setup.exe".
Could not find command for "%s".
Could not delete file or folder "%s".
Could not create folder "%s".
Error in line %d of configuration data:
Could not open archive file "%s".
1.4.0-i386 alpha
1.4.0-i386 alpha build 1501 (September 7, 2009)
Supported methods and filters:
:Language:%u!
Sorry, this program requires Microsoft Windows 2000 or later.
KERNEL32.dll
GetKeyState
USER32.dll
GDI32.dll
ShellExecuteW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
msvcrt.dll
_acmdln
version="1.4.0.1501"
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"/>
<requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges>
7ZSfxx.cmd
7zSfxFolderd
setup.exe
7ZipSfx.x
@ (%u%s)
3.4.5.6

SETUP.exe_2396:


.text
`.rdata
@.data
.ndata
.rsrc
uDSSh
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
KERNEL32.dll
ExitWindowsEx
USER32.dll
GDI32.dll
SHFileOperationA
ShellExecuteA
SHELL32.dll
RegEnumKeyA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
ADVAPI32.dll
COMCTL32.dll
ole32.dll
VERSION.dll
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
... %d%%
~nsu.tmp
%u.%u%s%s
RegDeleteKeyExA
%s=%s
*?|<>/":
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp/ins.exe /PID=4360 /SUBPID=0 /DISTID=19710 /VM=2 /NETWORDK=1 /CID=0 /PRODUCT_ID=18873 /RETURNING_USER_DAYS=2 /SERVER_URL=hXXp://installer.ppdownload.com
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\Convert.dll
operator
GetProcessWindowStation
portuguese-brazilian
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
GetCPInfo
GetProcessHeap
Convert.dll
zcÁ
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
=*>0>4>8><>
1*2024282<2
>&>,>5><>^>
<$<@<\<`<
3 3$3(3,30383
.mTl6F
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp/ins.dat
Tempins.dat
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\SETUP.exe" /S /NCRC
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000
SETUP.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000\SETUP.exe
aller.ppdow
/PID=4360 /SUBPID=0 /DISTID=19710 /VM=2 /NETWORDK=1 /CID=0 /PRODUCT_ID=18873 /RETURNING_USER_DAYS=2 /SERVER_URL=hXXp://installer.ppdownload.com
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
WUSER32.DLL
1.0.0.1
convert.dll
1.0.0.2
KERNEL32.DLL
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded

ins.exe_2420:


.text
`.rdata
@.data
.rsrc
@.reloc
spKey
szKey
keyCur
hKey
cSubKeys
cmdline
urlStr
wurl
bstrLicKey
cchLicKey
nMsg
vurl
bstrURLOut
rtExecmd
rtExeurl
reportURL
zErrMsg
compiledSql
sqliteCookieFiles
htmlDecodedUrlValue
endParamKeys
dynamicProductKeys
wUrlQS
wUrl
sqliteHistoryFiles
readDownloadUrl
.hL3Q
searchUrl
finishUrlForOuterInstaller
reportUrl
httpResponse
fullCmd
subkey
hostBrwCmd
tyUrl
baseKeys
cmdLineW
cmdW
exeUrlW
urlW
cmdLine
exeUrl
cbMaxSubKey
achKey
offersMainUrl
antivirusesRegKeys64Arr
antivirusesRegKeys32Arr
reg64Key
postExe
preExe
regKey
offerUrl
regKey64
cbSubKeys
zMsg
nCellKey
nMaxKey
nMinKey
nKey
zErrmsg
keyInfo
errMsg
t.hx3S
osCmd
finalExePath
urlComp
szURLPath
xSSSh
FTPjKS
FtPj;S
C.PjRV
RegDeleteKeyExW
RegDeleteKeyTransactedW
RegCreateKeyTransactedW
RegOpenKeyTransactedW
.vector<T> too long
X:X:X:X:X:X
\Google\Chrome\Application\chrome.exe
%d/%d/%d %d:%d:%d
3.7.16.2
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
\ob1hhelper.txt
Error %u in WinHttpQueryDataAvailable.
Error %u in WinHttpReadData.
Error %d has occurred.
F%D,3
Run-Time Check Failure #%d - %s
%s%s%s%s
%s%s%p%s%ld%s%d%s
Visual C   CRT: Not enough memory to complete call to strerror.
RegCloseKey
RegOpenKeyExW
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
operator
GetProcessWindowStation
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpOpen
WinHttpQueryHeaders
WINHTTP.dll
PSAPI.DLL
GetProcessHeap
KERNEL32.dll
EnumChildWindows
CreateDialogIndirectParamW
USER32.dll
GDI32.dll
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
ole32.dll
OLEAUT32.dll
URLDownloadToFileW
urlmon.dll
IPHLPAPI.DLL
GetCPInfo
.?AV?$CAtlExeModuleT@VCSmartInstallerModule@@@ATL@@
SQLITE_
d-d-d d:d:d
d:d:d
d-d-d
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
922337203685477580
API call with %s database connection pointer
RowKey
OsError 0x%x (%u)
os_win.c:%d: (%d) %s(%s) - %s
delayed %dms for lock/sharing conflict
%s-shm
%s\etilqs_
%s\%s
Recovered %d frames from WAL file %s
cannot limit WAL size: %s
invalid page number %d
2nd reference to page %d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
failed to get page %d
freelist leaf count too big on page %d
Page %d:
unable to get the page. error code=%d
btreeInitPage() returns error code %d
On tree page %d cell %d:
On page %d at right child:
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Fragmentation of %d bytes reported as %d on page %d
Page %d is never used
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
unknown database %s
keyinfo(%d
%s(%d)
%s-mjXXXXXX9XXz
MJ delete: %s
MJ collide: %s
-mjX9X
foreign key constraint failed
unable to use function %s in the requested context
bind on a busy prepared statement: [%s]
zeroblob(%d)
abort at %d in [%s]: %s
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot release savepoint - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
database table is locked: %s
statement aborts at %d: [%s] %s
cannot open value of type %s
cannot open virtual table: %s
cannot open view: %s
no such column: "%s"
foreign key
indexed
cannot open %s column for writing
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
EXECUTE %s%s SUBQUERY %d
misuse of aggregate: %s()
%.*s"%w"%s
%s%.*s"%w"
sqlite_rename_table
sqlite_rename_trigger
sqlite_rename_parent
%s OR name=%Q
type='trigger' AND (%s)
sqlite_
table %s may not be altered
there is already another table or index with this name: %s
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_stat1
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE %s=%Q
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
sqlite_detach
sqlite_attach
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
sqlite_stat%d
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
sqlite_stat
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
a JOIN clause is required before %s
unable to identify the object to be reindexed
no such collation sequence: %s
table %s may not be modified
cannot modify %s because it is a view
sqlite_version
sqlite_source_id
sqlite_log
sqlite_compileoption_used
sqlite_compileoption_get
foreign key mismatch - "%w" referencing "%w"
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
%s.%s may not be NULL
constraint %s failed
PRIMARY KEY must be unique
sqlite3_extension_init
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
automatic extension loading failed: %s
foreign_keys
foreign_key_list
foreign_key_check
*** in database %s ***
unsupported encoding: %s
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
USE TEMP B-TREE FOR %s
COMPOUND SUBQUERIES %d AND %d %s(%s)
%s.%s
%s:%d
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
sqlite_subquery_%p_
too many references to "%s": max 65535
%s.%s.%s
no such table: %s
SCAN TABLE %s %s%s(~%d rows)
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
-- TRIGGER %s
no such column: %s
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
%s SUBQUERY %d
%s TABLE %s
%s AS %s
%s USING %s%sINDEX%s%s%s
%s USING INTEGER PRIMARY KEY
%s (rowid=?)
%s (rowid>? AND rowid<?)
%s (rowid>?)
%s (rowid<?)
%s VIRTUAL TABLE INDEX %d:%s
%s (~%lld rows)
at most %d tables in a join
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
SQL logic error or missing database
unknown operation
large file support is disabled
unknown database: %s
no such %s mode: %s
%s mode not allowed: %s
no such vfs: %s
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
.?AVCWebPage@@
zcÁ
{A0386B19-B7E7-4BE7-B567-ABF77CBB6E60} = s `ATLExeServer'
`ATLExeServer.EXE'
val AppID = s {A0386B19-B7E7-4BE7-B567-ABF77CBB6E60}
ForceRemove {FA20B59B-21AA-44FC-8A68-450979B7CC90} = s 'CBrowserExternals Class'
val ServerExecutable = s '%MODULE_RAW%'
TypeLib = s '{03771AEF-400D-4A13-B712-25878EC4A3F5}'
ForceRemove {622D38AD-B4A9-4170-8192-5B865C6A5DCE} = s 'CBrowserExternalImp Class'
ForceRemove {6D4506CE-F855-4657-AA38-DB6B1F733982} = s 'CBrowserExternal Class'
stdole2.tlbWWW
~cmdWd
OpenUrlW
urlWd
method OpenUrl
Created by MIDL version 7.00.0555 at Thu Mar 13 16:11:05 2014
<BUTTON onclick='window.external.OnClick(theBody, "red");'>Red</BUTTON>
<BUTTON onclick='window.external.OnClick(theBody, "green");'>Green</BUTTON>
<BUTTON onclick='window.external.OnClick(theBody, "blue");'>Blue</BUTTON>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
3%3u3
=0>4>8><>
9%9 9;9]9
6i6C6t9
2 2$2(2,202
?-?3?^?{?
5o6^6|6
4054585<5@5
12
1)4 6$6(6,6
<,=0=4=8=$>4>}>
88b8|8
: :$:(:,:
< <$<(<,<
0,080@0\0|0
3$3,383\3|3
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
WAdvapi32.dll
SERVER_URL
EXE_URL
EXE_CMDLINE
THANKYOU_URL
exeurl
execmdline
Exception opening/reading chrome cookies
Exception opening/reading opera cookies
a\Microsoft\Windows\Cookies
a\Mozilla\Firefox\Profiles
\Mozilla\Firefox\Profiles
sqlite
cookies.sqlite
Chrome_WidgetWin_1
a\Opera\Opera\
\..\Local\Google\Chrome\User Data\Default\
\..\Local Settings\Application Data\Google\Chrome\User Data\Default\
cookies4.dat
SELECT value,last_access_utc FROM cookies WHERE host_key LIKE '%
Found cookie in Chrome!
\..\..\Local Settings\Application Data\Opera\Opera\
Found cookie in Opera!
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
OLEACC.DLL
places.sqlite
SELECT url FROM moz_places WHERE url LIKE '%
Found history in Chrome!
SELECT urls.url FROM urls WHERE urls.url LIKE '%
\PreExe_ID_
\default.html
CHROMEVERSION
&chromev=
SOFTWARE\Microsoft\.NETFramework\policy
firefox
chrome
opera
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice
ChromeHTML
FirefoxHTML
IE.AssocFile.HTM
Opera.HTML
http\shell\open\command
Opera.exe
Safari.exe
\PostCheck.exe
SOFTWARE\Mozilla\Mozilla FireFox
Software\Mozilla\Mozilla FireFox
SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
aSoftware\Mozilla\Mozilla Firefox
*.txt
@@exeurl
OfferURL
ExeURL
RegKey
ReportName
PreExe
PostExe
RegKey64
AntivirusesRegKeys
RegKey32
Mscoree.dll
OLEAUT32.DLL
{A33DE4AA-9646-4E33-9E44-E472C6312E2F}
888816666554443
6666554443
!6666554443
virtualoffercmd:
virtualoffercmd
/REPORTURL=
\ob1hhelper.txt
user32.dll
mscoree.dll
SKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
MSPDB100.DLL
ADVAPI32.DLL
WUSER32.DLL
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins.exe
{8856F961-340A-11D0-A96B-00C04FD705A2}
3.0.0.6
sfile.exe
3.0.0.4

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   wmic.exe:2452
   %original file name%.exe:944
   Setup__5551_il350168.exe:1356
   SETUP.exe:2396
   Setup.exe:2372
   SETUP_~2.EXE:592

2. Delete the original MemScan file.
   
3. Delete or disinfect the following files created/modified by the MemScan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\ob1hhelper.txt (238 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Setup.exe (18559 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\SETUP_~2.EXE (7168 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\index[1].htm (7617 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (766 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\amipb[1].js (27951 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\Setup__5551_il350168.exe:typelib (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (114 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ins.exe (148860 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Convert.dll (3647 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ins.dat (26689 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\SETUP.exe (9321 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\button_over[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\bottomLine[1].jpg (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\topComp[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\bodyImg[1].png (1748 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\dc[1].js (2685 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XUR4TU3\nextCase[1].jpg (798 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OLQ78DEZ\topLine[1].jpg (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXQ74XAV\bgImg[1].jpg (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\button[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHQ7S167\DynamicOfferScreen[1].htm (1843 bytes)
   

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.