MD5: 77ee5a9a04d4d0df31ae7289b04011c2
SHA1: 4c1f70184ef2e113453d96a21ec4bebf5e4e19e7
SHA256: d9ebf0e4e3f20544586e9e438dab8428c4640d6b50e76414fe9e073f80d75593
SSDeep: 12288:1 UnYdbT2wW c1fFbftgCin2JI6J8bc1YT/AAUHnSco9Oo:1 UnY03lgd2J0bqAUyco
Size: 566960 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

wmic.exe:288
%original file name%.exe:1356
LiveiStream.exe:2012

The Trojan injects its code into the following process(es):

rd.exe:1292

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process wmic.exe:288 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91406680071.txt (238 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91406680071.txt (0 bytes)

The process %original file name%.exe:1356 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.exe (398737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rd.zip (57028 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB3.tmp\Convert.dll (4635 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB3.tmp\nsisunz.dll (211 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rd.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB2.tmp (0 bytes)

The process LiveiStream.exe:2012 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Liveistream\mplayer\fonts\conf.d\30-metric-aliases.conf (5 bytes)
%Program Files%\Liveistream\translations\smplayer_pt.qm (4516 bytes)
%Program Files%\Liveistream\translations\smplayer_en_US.qm (96 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\60-latin.conf (1 bytes)
%Program Files%\Liveistream\Copying.txt (18 bytes)
%Program Files%\Liveistream\translations\smplayer_lt.qm (5133 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\30-urw-aliases.conf (1 bytes)
%Program Files%\Liveistream\QtNetwork4.dll (26959 bytes)
%Program Files%\Liveistream\dvdmenus.txt (1 bytes)
%Program Files%\Liveistream\translations\smplayer_gl.qm (8119 bytes)
%Program Files%\Liveistream\Not_so_obvious_things.txt (3 bytes)
%Program Files%\Liveistream\translations\smplayer_nl.qm (6504 bytes)
%Program Files%\Liveistream\mingwm10.dll (11 bytes)
%Program Files%\Liveistream\QtCore4.dll (62107 bytes)
%Program Files%\Liveistream\Copying_libmaia.txt (1 bytes)
%Program Files%\Liveistream\translations\smplayer_hr.qm (7712 bytes)
%Program Files%\Liveistream\Copying_BSD.txt (1 bytes)
%Program Files%\Liveistream\mplayer\mplayer\config (43 bytes)
%Program Files%\Liveistream\translations\smplayer_ka.qm (1568 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\51-local.conf (189 bytes)
%Program Files%\Liveistream\mplayer\mplayer\subfont.ttf (11619 bytes)
%Program Files%\Liveistream\translations\smplayer_cs.qm (4502 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\45-latin.conf (3 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\65-nonlatin.conf (7 bytes)
%Program Files%\Liveistream\translations\smplayer_sl_SI.qm (1568 bytes)
%Program Files%\Liveistream\translations\smplayer_fr.qm (6509 bytes)
%Program Files%\Liveistream\Watching_TV.txt (4 bytes)
%Program Files%\Liveistream\Finding_subtitles.txt (863 bytes)
%Program Files%\Liveistream\translations\smplayer_zh_CN.qm (4181 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\10-scale-bitmap-fonts.conf (1 bytes)
%Program Files%\Liveistream\zlib1.dll (956 bytes)
%Program Files%\Liveistream\imageformats\qjpeg4.dll (7535 bytes)
%Program Files%\Liveistream\translations\smplayer_et.qm (4021 bytes)
%Program Files%\Liveistream\translations\smplayer_he_IL.qm (4495 bytes)
%Program Files%\Liveistream\translations\smplayer_da.qm (4794 bytes)
%Program Files%\Liveistream\translations\smplayer_fi.qm (5233 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\65-fonts-persian.conf (10 bytes)
%Program Files%\Liveistream\uninstall.exe (1328 bytes)
%Documents and Settings%\%current user%\Desktop\Liveistream.lnk (703 bytes)
%Program Files%\Liveistream\translations\smplayer_de.qm (4984 bytes)
%Program Files%\Liveistream\translations\smplayer_eu.qm (6184 bytes)
%Program Files%\Liveistream\translations\smplayer_pt_BR.qm (4251 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\20-unhint-small-vera.conf (1 bytes)
%Program Files%\Liveistream\Readme.txt (3 bytes)
%Program Files%\Liveistream\translations\smplayer_vi_VN.qm (2414 bytes)
%Program Files%\Liveistream\translations\smplayer_ro_RO.qm (5204 bytes)
%Program Files%\Liveistream\mplayer\README.txt (3 bytes)
%Program Files%\Liveistream\mplayer\mplayer\input.conf (4 bytes)
%Program Files%\Liveistream\Install.txt (3 bytes)
%Program Files%\Liveistream\mplayer\MPlayer.html (13585 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Uninstall Liveistream.lnk (720 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Liveistream Website.lnk (770 bytes)
%Program Files%\Liveistream\translations\smplayer_hu.qm (3128 bytes)
%Program Files%\Liveistream\mplayer\LICENSE.txt (18 bytes)
%Program Files%\Liveistream\translations\smplayer_ru_RU.qm (6439 bytes)
%Program Files%\Liveistream\translations\smplayer_ar_SY.qm (2704 bytes)
%Program Files%\Liveistream\translations\smplayer_ko.qm (2808 bytes)
%Program Files%\Liveistream\translations\smplayer_th.qm (4402 bytes)
%Program Files%\Liveistream\sample.avi (29 bytes)
%Program Files%\Liveistream\translations\smplayer_sk.qm (3727 bytes)
%Program Files%\Liveistream\translations\smplayer_pl.qm (3799 bytes)
%Program Files%\Liveistream\translations\smplayer_sr.qm (6826 bytes)
%Program Files%\Liveistream\Liveistream website.url (51 bytes)
%Program Files%\Liveistream\mplayer\mplayer.exe (463001 bytes)
%Program Files%\Liveistream\translations\smplayer_ms_MY.qm (7328 bytes)
%Program Files%\Liveistream\translations\smplayer_it.qm (2763 bytes)
%Program Files%\Liveistream\QtXml4.dll (10675 bytes)
%Program Files%\Liveistream\Release_notes.txt (19 bytes)
%Program Files%\Liveistream\translations\smplayer_ja.qm (4666 bytes)
%Program Files%\Liveistream\translations\smplayer_ca.qm (4228 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\40-nonlatin.conf (5 bytes)
%Program Files%\Liveistream\smplayer.exe (58749 bytes)
%Program Files%\Liveistream\translations\smplayer_zh_TW.qm (2242 bytes)
%Program Files%\Liveistream\translations\smplayer_ku.qm (2679 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Liveistream.lnk (715 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\50-user.conf (673 bytes)
%Program Files%\Liveistream\translations\smplayer_es.qm (7068 bytes)
%Program Files%\Liveistream\translations\smplayer_el_GR.qm (6541 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\README (959 bytes)
%Program Files%\Liveistream\translations\smplayer_bg.qm (1568 bytes)
%Program Files%\Liveistream\Portable_Edition.txt (1 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\90-synthetic.conf (1 bytes)
%Program Files%\Liveistream\libgcc_s_dw2-1.dll (2752 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\69-unifont.conf (672 bytes)
%Program Files%\Liveistream\QtGui4.dll (257266 bytes)
%Program Files%\Liveistream\translations\qt_eu.qm (3054 bytes)
%Program Files%\Liveistream\mplayer\mplayer\config.sample (357 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\49-sansserif.conf (545 bytes)
%Program Files%\Liveistream\translations\smplayer_tr.qm (3134 bytes)
%Program Files%\Liveistream\mplayer\mplayer.man.html (16053 bytes)
%Program Files%\Liveistream\QtScript4.dll (48407 bytes)
%Program Files%\Liveistream\translations\smplayer_mk.qm (2507 bytes)
%Program Files%\Liveistream\translations\smplayer_sv.qm (1568 bytes)
%Program Files%\Liveistream\mplayer\fonts\fonts.conf (5 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\80-delicious.conf (422 bytes)
%Program Files%\Liveistream\shortcuts\default.keys (3 bytes)
%Program Files%\Liveistream\translations\smplayer_uk_UA.qm (5905 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nssB4.tmp (0 bytes)

The process rd.exe:1292 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\DynamicOfferScreen[1].htm (850 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-ui.min[1].js (6590 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-ui-1.8.19.custom[1].css (5521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\914066800710\LiveiStream.exe (1881417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\LiveiStream[1].exe (2527563 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DynamicOfferScreen[1].htm (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.min[1].js (2321 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91406680071 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\91406680071.txt (0 bytes)

Registry activity

The process wmic.exe:288 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 60 BB 4E 44 B8 2A 7F 97 65 CF 0E 8E 0D 11 33"

The process %original file name%.exe:1356 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 35 6B 93 D3 94 8A 84 73 7C 81 CE 09 BF 1C 5F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process LiveiStream.exe:2012 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Liveistream]
"DisplayIcon" = "%Program Files%\Liveistream\smplayer.exe"
"DisplayVersion" = "00.00.00.00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\smplayer.exe]
"(Default)" = "%Program Files%\Liveistream\smplayer.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Liveistream]
"URLInfoAbout" = "http://www.liveistream.tv"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Liveistream]
"Publisher" = "Liveistream"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 B3 DB BB 77 C2 2B AB 4A 0E 40 68 E4 EE 95 7F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Liveistream]
"DisplayName" = "Liveistream"
"UninstallString" = "%Program Files%\Liveistream\uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Liveistream]
"Start Menu Folder" = "Liveistream"

The process rd.exe:1292 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 F0 AA C3 FD 4B 17 5F FD 29 45 FA C1 9B B7 4C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: setup
Product Version: 5.0
Legal Copyright: setup
Legal Trademarks: setup
Original Filename:
Internal Name:
File Version:
File Description: setup
Comments: setup Installer
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1706
ad987a179c03370db0a1386816158695
0a1f004b62803f3fb9df5fa29bd4f4c4
4dc5e8a77f881d0fffcd0b1a004d4049
63d555e82324b625b5761aee238d0385
bc2b7b3ea4f5c551cca84e6304d1a66f
e689bfe629c4d6f5c6e0b800309bc2fe
a6d45df65e886d687d125bfb2284b7ca
5098f3e15c111b6441e3cbfbed6dc214
899eb46fff5e66f11e2707a3224ca2b3
0935ceeb276ca645e41af021a3ed76d3
11f6b8c5c261ea8677acd4de7bbd24f8
0cfa2bbaee1e7e889d508e8a63fced57
1070529ffc03e88aaaeaa1398d847e82
d6404f0ce456d406cbffae078ebd80ed
7a052f03cbe6e2f174a8e70e3d0869b5
523d8444192b25bb6a0d061cf3b88d7e
93eb403ac5e1522007c2c72e3d43a9ac
7661bed69040f18a074dae6ec9dc648c
d1161ea41d58b296fbb11381169903e7
8fdd47869084df3c1b3db69dcafdbbdf
ad4cb988d36fe21c1aae172eb18d603d
14f44ef4cc6ec691bfdd68643fecbd09
974f822a551a93de96dde5025475f466
10114a187289d6b48f2fa5d67b24d42b
7379c9605b7113e8fa306362f749a1d0
ec97367be06cbc2e42f5cdbfc7c0d61c

URLs

URL	IP
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/ProductS/LiveiStream.exe
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.5/jquery.min.js
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/topComp.png
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/topLine.jpg
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/bgImg.jpg
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/bottomLine.jpg
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Track?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&reqid=127786953&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=1694&offerscreenid=&offerorder=22&downloadduration=10766&installduration=109&issecond=0
hxxp://smartinstaller.elasticbeanstalk.com/Installer/TrackFinish?reqid=127786953&x=y&clickid=1120202166
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
hxxp://smartinstaller.elasticbeanstalk.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/bodyImg.png
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/nextCase.jpg
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/button_over.png
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/button.png
hxxp://smartinstaller.elasticbeanstalk.com/installer/ThankYouInner?productid=1694&productname=FLV Player&d1=16438
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_45.js
hxxp://pagead46.l.doubleclick.net/gampad/ads?gdfp_req=1&correlator=3337422373247795&output=json_html&callback=window.parent.googletag.impl.pubads.setAdContentsBySlotForAsync&impl=fifs&json_a=1&iu_parts=5612216,TYP&enc_prev_ius=/0/1&prev_iu_szs=1200x1400&cookie_enabled=1&cdm=data.getserverinfo.com&lmt=1406680098&dt=1406680098351&cc=42&ea=0&frm=23&biw=1004&bih=615&oid=3&adks=231420566&osd=1&oe=utf-8&gut=v2&ifi=1&ifk=809129705&u_tz=180&u_java=true&u_h=768&u_w=1024&u_ah=740&u_aw=1024&u_cd=32&flash=11.6.602.168&url=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&ref=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&vrg=45&vrp=45&ga_vid=240277465.1406680098&ga_sid=1406680098&ga_hid=1570451532
hxxp://static.revenyou.com/offers/images/Theme8/button.png	198.232.124.224
hxxp://www.googletagservices.com/tag/js/gpt.js	173.194.43.58
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&	54.235.198.46
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png	64.233.171.95
hxxp://cdn.ppdownload.com/ProductS/LiveiStream.exe	198.232.124.224
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css	64.233.171.95
hxxp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css	198.232.124.224
hxxp://pubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=3337422373247795&output=json_html&callback=window.parent.googletag.impl.pubads.setAdContentsBySlotForAsync&impl=fifs&json_a=1&iu_parts=5612216,TYP&enc_prev_ius=/0/1&prev_iu_szs=1200x1400&cookie_enabled=1&cdm=data.getserverinfo.com&lmt=1406680098&dt=1406680098351&cc=42&ea=0&frm=23&biw=1004&bih=615&oid=3&adks=231420566&osd=1&oe=utf-8&gut=v2&ifi=1&ifk=809129705&u_tz=180&u_java=true&u_h=768&u_w=1024&u_ah=740&u_aw=1024&u_cd=32&flash=11.6.602.168&url=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&ref=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&vrg=45&vrp=45&ga_vid=240277465.1406680098&ga_sid=1406680098&ga_hid=1570451532	173.194.43.57
hxxp://static.revenyou.com/offers/images/Theme8/button_over.png	198.232.124.224
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js	64.233.171.95
hxxp://data.getserverinfo.com/Installer/Flow?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4	54.235.198.46
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js	64.233.171.95
hxxp://static.revenyou.com/offers/images/Theme8/bgImg.jpg	198.232.124.224
hxxp://data.getserverinfo.com/Installer/Track?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&reqid=127786953&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=1694&offerscreenid=&offerorder=22&downloadduration=10766&installduration=109&issecond=0	54.235.198.46
hxxp://static.revenyou.com/offers/images/Theme8/topLine.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/bottomLine.jpg	198.232.124.224
hxxp://data.getserverinfo.com/installer/ThankYouInner?productid=1694&productname=FLV Player&d1=16438	54.235.198.46
hxxp://data.getserverinfo.com/Installer/TrackFinish?reqid=127786953&x=y&clickid=1120202166	54.235.198.46
hxxp://partner.googleadservices.com/gpt/pubads_impl_45.js	173.194.43.58
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&	54.235.198.46
hxxp://static.revenyou.com/offers/images/Theme8/bodyImg.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/topComp.png	198.232.124.224
hxxp://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2	54.235.198.46
hxxp://static.revenyou.com/offers/images/Theme8/nextCase.jpg	198.232.124.224
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png	64.233.171.95

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA STREAM ESTABLISHED packet out of window
SURICATA STREAM Packet with invalid ack
SURICATA STREAM ESTABLISHED invalid ack
SURICATA STREAM FIN out of window
SURICATA STREAM SHUTDOWN RST invalid ack

Traffic

GET /offers/ui/css/start/jquery-ui-1.8.19.custom.css HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Jul 2014 05:25:49 GMT

Content-Type: text/css

Content-Length: 20706

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Thu, 26 Apr 2012 17:23:56 GMT

ETag: "ca38195cd123cd1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 06 Aug 2014 05:25:49 GMT

X-Cache: HIT

Accept-Ranges: bytes
/*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.tx
t (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Ve
rsion 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquer
y.com/UI/Theming/API. */../* Layout helpers.--------------------------
--------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-acce
ssible { position: absolute !important; clip: rect(1px 1px 1px 1px); c
lip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0
; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font
-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helpe
r-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:
after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfi
x { width: 100%; height: 100%; top: 0; left: 0; position: absolute; op
acity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.-----------
-----------------------*/..ui-state-disabled { cursor: default !import
ant; }.../* Icons.----------------------------------*/../* states and 
images */..ui-icon { display: block; text-indent: -99999px; overflow: 
hidden; background-repeat: no-repeat; }.../* Misc visuals.------------
----------------------*/../* Overlays */..ui-widget-overlay { position
: absolute; top: 0; left: 0; width: 100%; height: 100%; }.../*!. * jQu
ery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://
jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 li
censes.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/
<<< skipped >>>

GET /offers/images/Theme8/topComp.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 30 Jul 2014 05:25:50 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 30 Jul 2014 05:25:50 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>....
<<< skipped >>>

GET /Installer/Flow?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: data.getserverinfo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 30 Jul 2014 05:25:49 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 23800

Connection: keep-alive
..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"83$.Fmkcsez_oajgRvjdo
"8.)-&4* 6., M]bDcv.9."*.J``Ibs50"8..'.PbjnntL\
e`.8.Phnts\d.&.T_`phcm9g^pq.*.Rcb;g^_k,.' Dj[pl@^md."*.Hm
hbr]sED 5,3% >fv]yqJ^a^p.4/("GnO\brCiqEnqoYge 7  .Ev`MME 7.!(&
quot;Cs]PKJ/.9."*.;jfk^hcHil`.5. ).NbfcmMME 7.gptn5'*]go_bp.r
c](Znmm,pr_^c)\mj).kfd`jn(Bvh`iiaJ^a^pP]qael:ga_cocc9274._bqqcc9152-!e
c^^o9144,!\mrhsnyg_52*$psr^ir8 -.bc\<,&f]5-.*.L`pe 5%,% >^ce
tgjf\eB^n`.: .)22 /.64-//,11 ).@jtgqamnqbmQagI`qn.8.. .P_tgpm 7'0(
"Ca^`\rfpd.: ,$.IplgnpimiJ\mc.4,-, ?an\pbj`jcwMYo^ 7'0("
Qg]`i?cndnIlnl\ej.4/y,y.HjlrBrd.: .$.Ipb?wa"8..'.AlgokncilOrn
b.9,, Hgibrft`pimiLticp.9.2 ..'.PbaJay 5.CDCVYBQRP@FOXSP?Q.SmalrZp
bV[Oe_m[cIplnd_tUN.'.PbaJay4/.5.FH?X[CSMJ@GR\ORAR.Ngamu^ldX\Q`Ym\f
MlnpeaoON.*.LdlopoF\fc.4!Oe_m[cIplnd_t.RK-.*.Jqkds^lD= 7 6440'.<
;eu^srKfd`j.3.).HoW_dlAhpFhrpajg.5**.?waUPG.5.fqno6/-_d,'blqmoepq]
m ,`il Ilnl\ejbl.Oe_m[cIplnd_tE`f`kg`)Raap^`Kkmq_bpGci]mba/(dte '.
@qcRLK."8.`omn7).`l/)\jplp_qrep-&^hk,Cmot_gd`k-P_`ncfKjjmc`nF
ancma^(Qb[q_hNmgo^aqAdjepd[-'cu_!("AjehZlaFhje 5..(PBA<SS.
..*<RF><?T1.*1 12. .Oda]mNPI.9.hroh5(-acqacr)lc^ ^joo-rmY^d,`
il /ma^`kq,>xjakd[J_dblR_rc`f:hdc_qed;,)2.noicqcrd\8*55.1"dgnl
d];.161&j`Y_i;.080&ajmimpvcc97/!ktl`fn</2$_^]6.#ba92 '.
MZrb.9)1*.9_]gqcnjaj?YoZ 7.!("?ildogoorasP`_F^wp.9."*.H\rmrn
!6-/'.@_db]sevc.2(**.JqkmmoajgP^nd.: ,$.=gp]qap_i[tK_q_!6-/
<<< skipped >>>

GET /Installer/Track?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&reqid=127786953&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=1694&offerscreenid=&offerorder=22&downloadduration=10766&installduration=109&issecond=0 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: data.getserverinfo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 30 Jul 2014 05:26:00 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive
..OK......


GET /Installer/TrackFinish?reqid=127786953&x=y&clickid=1120202166 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: data.getserverinfo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 30 Jul 2014 05:25:57 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive
..OK....

GET /gampad/ads?gdfp_req=1&correlator=3337422373247795&output=json_html&callback=window.parent.googletag.impl.pubads.setAdContentsBySlotForAsync&impl=fifs&json_a=1&iu_parts=5612216,TYP&enc_prev_ius=/0/1&prev_iu_szs=1200x1400&cookie_enabled=1&cdm=data.getserverinfo.com&lmt=1406680098&dt=1406680098351&cc=42&ea=0&frm=23&biw=1004&bih=615&oid=3&adks=231420566&osd=1&oe=utf-8&gut=v2&ifi=1&ifk=809129705&u_tz=180&u_java=true&u_h=768&u_w=1024&u_ah=740&u_aw=1024&u_cd=32&flash=11.6.602.168&url=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&ref=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&vrg=45&vrp=45&ga_vid=240277465.1406680098&ga_sid=1406680098&ga_hid=1570451532 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pubads.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Google-LineItem-Id: -2

Google-Creative-Id: -2

Content-Type: text/javascript; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Date: Wed, 30 Jul 2014 05:26:10 GMT

Server: cafe

Cache-Control: private

Content-Length: 345

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

Set-Cookie: test_cookie=CheckForPermission; expires=Wed, 30-Jul-2014 05:41:10 GMT; path=/; domain=.doubleclick.net

Expires: Wed, 30 Jul 2014 05:26:10 GMT
[email protected])P..P#F..1!.4Cw....uw[h.....C=.o.L... )?8.$..
I9Os..:...#..P.(.3...6.5oV9..\.TS.W.'...}........'..F`DB.."'7$.......4
.\..vhM..J&....Y.Y.....Fuf..UX....ee.LE......=Ce.I...Wm.....a.....a<
;.c...}7.&....W....2z.ZVl..=>=|..~._.c..>o~Tz..d{....`b....f$=..
..VZ..V(k..L......6.D.....6.e@S. .u.i'.t..0...}/vB.#.?)...........J...
....HTTP/1.1 200 OK..P3P: policyref="hXXp://googleads.g.doubleclick.ne
t/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI 
PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Google-LineItem-Id: -2..
Google-Creative-Id: -2..Content-Type: text/javascript; charset=UTF-8..
X-Content-Type-Options: nosniff..Content-Disposition: attachment; file
name="f.txt"..Content-Encoding: gzip..Date: Wed, 30 Jul 2014 05:26:10 
GMT..Server: cafe..Cache-Control: private..Content-Length: 345..X-XSS-
Protection: 1; mode=block..Alternate-Protocol: 80:quic..Set-Cookie: te
st_cookie=CheckForPermission; expires=Wed, 30-Jul-2014 05:41:10 GMT; p
ath=/; domain=.doubleclick.net..Expires: Wed, 30 Jul 2014 05:26:10 GMT
[email protected])P..P#F..1!.4Cw....uw[h.....C=.o.L... )?8.$
..I9Os..:...#..P.(.3...6.5oV9..\.TS.W.'...}........'..F`DB.."'7$......
.4.\..vhM..J&....Y.Y.....Fuf..UX....ee.LE......=Ce.I...Wm.....a.....a&
lt;.c...}7.&....W....2z.ZVl..=>=|..~._.c..>o~Tz..d{....`b....f$=
....VZ..V(k..L......6.D.....6.e@S. .u.i'.t..0...}/vB.#.?)...........J.
........
<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: direct.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 30 Jul 2014 05:25:49 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 7542

Connection: keep-alive
.<html>.    <head>.      .       <style type="text/css"
>.            .ui-progressbar-value { background-image: url(images/
pbar-ani.gif); }.        </style>.       .        <link type=
"text/css" href="hXXp://static.revenyou.com/offers/ui/css/start/jquery
-ui-1.8.19.custom.css" rel="stylesheet" />.        <link href="h
ttp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-u
i.css" rel="stylesheet" type="text/css" />.        <script  type
="text/javascript"  src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1
.5/jquery.min.js"></script>.        <script  type="text/ja
vascript"  src="hXXp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jque
ry-ui.min.js"></script>..       <title>2 - NonProduct (
FLV Player)</title><script type='text/javascript'></scr
ipt><style type='text/css'>body      {          width:100%; h
eight:100%; margin:0px; padding:0px; font-size:font-family:helvetica; 
font-size:12px;}   .divLeadpName      {         border-bottom-style:gr
oove;border-bottom-width: thin; padding-left:61px; padding-top:9px; fo
nt-size:font-family:helvetica; font-style:italic; font-size:25px;     
            font-weight:bold; color:black; position:absolute;   width:
 100%; background-color: #fff; ba}   #divTop         {display: none}  
#divMiddle      {background-color: #efecec; height: 100%;} #middle    
{background-color: #fff;} .divOnNext      {          position:absolute
; width:89px; height:26px; cursor:pointer;  bottom:  8px; margin-l
<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: direct.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 30 Jul 2014 05:26:04 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 6258

Connection: keep-alive
<html>.    <head>.      <title>4 - NonProduct (FLV P
layer)</title><script type='text/javascript'></script&g
t;<style type='text/css'>body      {          width:100%; height
:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-
size:12px;}   .divLeadpName      {         border-bottom-style:groove;
border-bottom-width: thin; padding-left:61px; padding-top:9px; font-si
ze:font-family:helvetica; font-style:italic; font-size:25px;          
       font-weight:bold; color:black; position:absolute;   width: 100%
; background-color: #fff; ba}   #divTop         {display: none}  #divM
iddle      {background-color: #efecec; height: 100%;} #middle    {back
ground-color: #fff;} .divOnNext      {          position:absolute; wid
th:89px; height:26px; cursor:pointer;  bottom:  8px; margin-left:1px; 
right: 1%;                           background:url("hXXp://static.rev
enyou.com/offers/images/Theme8/button.png");}   .divAccept      {     
     text-align:center; font-family:Arial halvetica; width:89px; posit
ion:absolute; font-size:12px; bottom: 7px; margin-left:1px; right: 2%;
}     .divDecline      {         text-align:center;height:26px; bottom
: 8px; cursor:pointer; font-family:Arial helvetica; font-size:12px; po
sition:absolute; left:1%; padding-top: 4px;}     .divAgreementLeadP{  
        position:absolute; bottom:46px; left:3px;font-size:10px;      
}     #divAgreementLeadPWelcome {bottom:46px;position:absolute;left:18
7px;font-size:10px;}     a:visited      {           color:Blue;   
<<< skipped >>>

GET /ProductS/LiveiStream.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.ppdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Jul 2014 05:25:49 GMT

Content-Type: application/octet-stream

Content-Length: 18882288

Connection: keep-alive

x-amz-id-2: YatrtHRdLsK26eekxasXh6ysSlaIRORnzt3iJfwPLig8vdX1Xa UrtLEgI0ijzE0

x-amz-request-id: C9D9649E72638C50

Last-Modified: Tue, 15 Jul 2014 12:41:43 GMT

ETag: "43beb25532046d8f45dccbe1cf7c86b2"

Server: NetDNA-cache/2.2

Content-Disposition: attachment

X-Cache: HIT

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
........................E- ......................................t....
...... B..............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
.. B.......D...z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>

GET /offers/images/Theme8/topComp.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 30 Jul 2014 05:26:07 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 30 Jul 2014 05:26:07 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 30 Jul 2014 05:26:07 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/button_over.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Jul 2014 05:26:07 GMT

Content-Type: image/png

Content-Length: 921

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT

ETag: "f072da2a092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 06 Aug 2014 05:26:07 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e&
lt;...;IDATx..Z;o.1..Y.D...W."%=D..*[email protected].
...........;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.s
h..e..z.A....G.p..IZ.z...?Ra8........Y......O.......[[email protected].
...y..-.....Lc.0......O..|z.O/...k.....e...n..!......G.p...9....3. .'?
7 ..GD@..{.<....C$....N.........Q...<.,@...].;Q.'<.(.X.r.,.6.
......QrB..h..d&r....6....G..Shr.... .....4r..= ..f.....B.qP..l.K.....
...YB.Z....H....../:.l.(.S.D...nM7..P.%R........&_uR.H6A..(raP.H9...[\
D. .(....d...`.8.A......r5Q..........:v.e....u.....-&.1.....&.........
Z.|....).L...$....)K%a-....b..a*{<(W..P<..w7_Z.....h.%6.N.......
.*\FB...A...#..f.N...C..(.p...........K.|..5d..3u-........(.k. 7..6..t
svP!.U0.q.......9z.e [email protected]............. .>=...{WVim...
.f.c6.:...|.....0X.yk...../z..!.SHW.d......o.s........a..8..g.|zvg...o
[email protected].^......IEND.B`...

GET /gpt/pubads_impl_45.js HTTP/1.1

Accept: */*

Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partner.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Wed, 16 Jul 2014 15:23:21 GMT

Date: Thu, 24 Jul 2014 19:41:20 GMT

Expires: Fri, 24 Jul 2015 19:41:20 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 31222

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 467087

Alternate-Protocol: 80:quic
......n.....ww.F.8..>..'W...E.%1 ...\...F1:.`AB.&@.[....l....?...K.
.....Nq..,......]....}..Q..ehR..m)..r.{1....^..5.<...Y. %..(,..b...
 K]g....p.0. .y..n6..>.1...._{.-.c...y.R%*.n.`;q(c.....c..b..Xf.a;.
...E............z...T.*..;........XB@..=..a1..wV.D..L$.^../&Y,..BG.bY\
..O.b......5'.....6..t...{...fq2j]......*{...Y.I.vU.l.y.....L..*...]./
.^.5.y..T...r.\..i'RZP/..U.J...U^........}.Dc....N..=......\...zlW.fC.
:.d....l.%gN...<........F......;.....2.].....n9.m.XL.]....0........
|^)J%aU..W.......r.t.....rj.......uNs.....".H/.n.:.?T....V.|....Z....W
q8..z...l.......\.. Z..L...t..%.p.zm....pZf....n<O...2...}.{...{..D
c.>..h...77..h........e..zz%.*\..x,...q.3.f....^..W"../.Eqsc.\.K;-.
..).... 60..a..5p=/......y../.a..O/....?.7...ZWuh7..'..2........e>.
...i.s.b..../C.).V.z.R...:[email protected].]Y..&....uxI..%L.p.... .i........
.<...x...).;........1[...r. \.k.c."..P.j;r.pp.N9...`jO..OE.<Y..|
J...a..g.........W.3...a..yA..0....V.l.T...R,&8........p...J_mL.......
..8.g..Gn..`"xX.......E.W]=..F..sO....72..y....s..y......u............
.W..F.K*...zv.l...}...~........._.~/....^./V..;_..........!{......s..p
..|.].=...........Z..*P3....y.a....0..?.q....j.K...d"0.:Iv.X7.....Y.@.
..0...^v..N)!d..k..../..n.......,\....8.".6n.&;...7....qSu...r>}..&
lt;...I.:...fk&./>.~.......`j.-...(.$....;....q;..[.&.6L.p4.....w..
.....r.@..._fE<r. ...90...p.}'.....D.;....q.u...........I..Y.......
Wf..........L....8..q..pO..}.r.......S.;....C..}F...g..3.....>..Y.g
..W...._.C.o..:. ....g..bk.(|..'.v....G.....F...Y.g..KMm.._....)W.
<<< skipped >>>

GET /offers/images/Theme8/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 30 Jul 2014 05:25:50 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 30 Jul 2014 05:25:50 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>....
<<< skipped >>>

GET /offers/images/Theme8/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 30 Jul 2014 05:26:07 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bodyImg.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Jul 2014 05:26:07 GMT

Content-Type: image/png

Content-Length: 1914

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 10:27:32 GMT

ETag: "36dd864c691ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 06 Aug 2014 05:26:07 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR.......:.....j.......sRGB.........gAMA......a.... cHRM
..z&..............u0...`..:....p..Q<...0PLTE.......................
.........................{.......IDATx......:..`..p..J.4.ty.:......)v.
.\....,.fwv..U...!.....b.f.....Cy(..OW......w......]R..l..2My}<..].
.8hn{*..X.).m..4w.U.J.....u..l.J...<...>uJ.....i.>o.%......I.
\..S......U.D.}OK..J`......sJ`.}..M.9%..A....u.T.%........K....OQ..._.
.d.>..L....]I. U.].c.Je...|.W.U?..E.}...*.vZ...K...M....).W...^V..&
gt;).e(.].Z.}dg%@....S.*/...........Y.W.]}...|.SgO........rrj...4UY../
..r.~.....Z.ep.wui.sP^..X.g%$(.......C........Ze....4yn}....U.({.V..{o
..}O...w.G.Q.^..r..p....0y............8......6.v....zz~....-...F*..f.F
]...R..*. -......e{mO.s.i.9.U....zz.6.f.T>.f.DQ%.. ...l.q\N."eA({_W
7..Q.....d........>...Y.."e.\....s,.. .Li)%....R.o.....C.9wQ....8..
......KNY..t..)...k...v)P*.....I...4&../.{)..qe..R.'...2..*..d.z&.T;y.
.)Q*....)R..2..)Tj.B..)V..b..)W......QB!rj.B.J)..N)b*...R)q..<S...z
%.LPr..%.LQ2.4e.....q&*c.De,..J.x& ig...g..b.(.g..p.)Qf..uf*1g..af .Y.
..... .;(.....s......r.v. ...s'...K.0wS.....sG%.......-.R..}......4S..
...W.....=.9eN(..OS..Jt(...<...P.(..DJ;_)..Y. ..7.>[email protected])e
M.qi;...........$.z%.[..P...SJzT*E]......2zT.t..L%6.TJ..Y.a...}.V..J..
.,.....H... ....;..2_._/[.^/[.\.W.\.!..%oT*y.Z....#Q.Bw.FI.7...H..2Jt.
*..../........2.F..X.....gqJ.q:.U.q.. V...B..s.(.J2.x..()#1@.'d4.Hh.h.
J.I.i.G.#.;.J....*Q$Z..?.........sR..D.<...| ......2.1b.A3...v.....
X.y{..R....{h..pzJ.I.).Y..Kn.z;%Jn..c.W...bL........t..!...A..(..*
<<< skipped >>>

GET /offers/images/Theme8/nextCase.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 30 Jul 2014 05:26:07 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/button.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Jul 2014 05:26:07 GMT

Content-Type: image/png

Content-Length: 458

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT

ETag: "1b5642f092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 06 Aug 2014 05:26:07 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e&
lt;...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi.......
.../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f.
..p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C......
.$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....
-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^
.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`...

GET /ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/css; charset=UTF-8

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 30 Jul 2014 04:26:25 GMT

Expires: Wed, 30 Jul 2014 05:26:25 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 6091

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 3564

Alternate-Protocol: 80:quic
[email protected]..~...e.#K.$.#A..=.!%J|iz...
;@Z.:...y..}..........X.H~{G...O~......-.M^[email protected]........
....!/.Ms.\\...'t.&qy..........hN.,fE..r*.V.f..O.>.."...G._.... s.W
O8f....v...dJ>O...H ..o..>..! v.o~y...gg.....#.D.,?BwgQ...&.,B.h
.%. .'.d.1...R...&.M...1..l.3.?.u..t.B.u...F....e....&q..7.bq.bv| ....
....... V..z;.j.A_.kr.I.J...e.z..A.yV0........0..5i.C.%,. .L..iY4Q.}..
.t......y..U.q.h.f..-K.....3.6...H..Y..|..u.....\d[T.........>.....
.|...Y...T.*...<..X..F.S.:.4..G.<.r`k.&?........0.p.w gEcN..=.'8
a...E......~...$OXJOy.s)...ud..\tQ.Z$$;..|.}[email protected]^...S2.gn.h......;V.
yy.!...{4..U%D>x....{...2.SV....!Y<....3..e...cMTb.5.,f...r..$Or
..%X...78.I.>[email protected].<.W 
EY.h.<.U.l2c.....V.J..T.^...owo.....(...|...Sh..~x..l..ovyY.7...M..
. ..v2.%.j....Np1_....4...M...9.~.,y.V..b.-...i.&i.q...W7......*1.QP.k
:C..^.k6..T.\.u,..LW.(S<)5.............X...ZW...#.UC*.:nT;.....\<
;._.. J.YK.:9.H}3....U.B..$..W..f$l]^[email protected].,(."
......l.%........:.A..y.'n.. ..j:.q2.]r..M...j.JSQ....i.8...J...".iZ.V
.....5..'S:.*..C..V.Y.!S.k*.:FT.tv...1.P.A.e..r.h......-..uGZ6.(.....l
..!5....z....2M!.?.G.........'....U>..-aH/ .E.D.T{J..C!...tK.!.a.v.
.~......$....5 ..xj.u...P...x.@ F{..S..R.O.<d#.E%PS.//......5fV.4..
.1..S.......mw..#..o Q. .....p_yI..ox.....UM.uP....b.v0GE.....A....X.!
pX4.......Y-o..f9.....L.p$.........;..P...Q.b........mZe..$s..].8..t..
.M...o......X...S".>..1A*.....2h......D.j8Y..wL..^.| ....1...`C
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/jquery-ui.min.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 30 Jul 2014 04:35:08 GMT

Expires: Wed, 30 Jul 2014 05:35:08 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 51558

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 3042

Alternate-Protocol: 80:quic
............iw...0....d...-.@......."...x{,y.<....n.M....ZB...w...A
P...9.L,.k_n..n.{.......V..G..<........}......n.........l..Y....z3.
.................E1.-.uz..........ZXI..rZm....../[email protected].....
.yUlB..U#..L...1p.>...2...].....M(...J.....e..I......5...9...e.....
&.........W..y...f./..j..}^....r...n.._7.j.o..v.i./a.7uq......r.%.,...
...j9..Y.s......@..$...... \...H...=....?....y...}W..b].G..|-....wG.N.
O<.H.Q...'w......H.....*.....?..Uo..n..Z=..U...I...*..,[email protected]...
..l.[@E1.....jq<..V.d.=.n......,..o... .gY.G....N%$f..u..."J.....xv
rR..$.q..i....l..m7....p...]./!.......JF0..^.. ...Q.....H..q...._wr"9.
.S].I/_.....~M...Z..U5..^q.z..U...k..........Q.........v...[.v..`:UJvI
o^-...........n.;..{o....p.CliS-J..w27...F.....v .{...t..........g._._
...~z......wz.......gP.K.....W....w/.ym......B.cH....?~..~/.~..../....
_.........4..s........x..z|...^|.../.._..?.z..............?.......?=..
....N......_<...3.n..I/..../ e.Rd../U...|...O.....Pi.~.....=.5..%~z
...oh..?.._~J.?.?.....0....g.. ....0....W...x....W.k|)....h....n...7Y.
...c..l.Y..._...3.D.f.,n..G?.'h...*.l...ZN...R...q..F.;.*/f6T.q-3.....
...Z.n..y\&.].......*.C..p..I.U.Z/....`..W..k<.Pn]....OtJR...P...j.
n...z]W''..z.o.b.....m...K...u.)..%.v{.8p9..T....4U......X..U.o'...T..
...D...G.tc.3o....8./.a.NK^...........q?I.0.....)-..m.\[email protected]......
\..{.>........D..n..Gp..)R:...>.D ....d.nV.......C....pWe.?Xl.B.
....6} .Q.4...j....^.6q..3..>5w\.....'.@....&6...?ok..$.;....[...!V
o........vx}{s.L.dA...6......8.r......bt.>"a........0...I~;....
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 30 Jul 2014 04:42:37 GMT

Expires: Wed, 30 Jul 2014 05:42:37 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 3457

X-XSS-Protection: 1; mode=block

Age: 2593

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Alternate-Protocol: 80:quic
.PNG........IHDR.......d.....p..}...HIDATx...K..N................q..B.
...6...._.d.c.......*...V......|U.......w-...p..>Z..........`......
......`............`............`............`............`...........
.`............`.......@.....:n.K>.u.....X..V..G........l.9......j6.
x..xu..y...I... gZ.D.L...........4[OG.8.|d.....;.N[O..lz.M....{..ne.Z1
..VlO...e..k.g.........k.6.r..........be'`t#..zu39.|[..6=9....4..H."..
.-Cd.D.z.3c.g...S.,..D7.h.H=O.F6.{7.....H6G...S.......U.9.%w....`C....
.y.G^@......O..........0.l.....0.Z.4..H..[.k..Z..Z..zm].v.......J.$ZMZ
..yK.....Z.4.Z.Z.Z.Gr..M..j.b..Z^.1c.E........,....6&.9....3)....[W.vH
...a...k~....,.........1..k.R..........iWd....M.V..O)..?y.....W...._&l
t;....p.p....`............`..b.......:............:.............Xj)...
w.....-?M.bE|[...I.eki......&.U.6.........l4.[..N.F.....|...qc.Zj.7...
..;.f/..w..=......}L[...k.E.S/.x....3-...^.R....."Z.........[........:
.;...n.Z..~.....;.....%w....P7...'R^....E[?.C...X.$.^Y.Yj...}...iS.O..
...m........r%..4yy.r..I.....Io...'i..;..._....K.7.%.Q../.\......X....
3;_........[...[..ti.........._.-..Z.l;j)e.L.lyf"Dm..^4...-.|G.E VdRD.
.M....S[.{.i6G...~/7V.h....M..;^.1~.}.;......=9.]S2....y.w|Y.#s(..X..;
....:=....Y_#.\r......RkY.$.e.mk..n.E|..m|....kk...O.......'......-..n
.z..XZ}m\H.._e.....V.x9........!.../.xs......f.......5.Zl .......x....
.].?/..9r......h...]^}M....<....;..........p.p....`........}.....n.
.~....4............. ^=..kc...|j..4{u[.......H.2...Y1......R..|x.5M...
...j..4.%..x......!ij....bXcT..^ file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\91406680071.txt (238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.exe (398737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rd.zip (57028 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB3.tmp\Convert.dll (4635 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB3.tmp\nsisunz.dll (211 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\30-metric-aliases.conf (5 bytes)
%Program Files%\Liveistream\translations\smplayer_pt.qm (4516 bytes)
%Program Files%\Liveistream\translations\smplayer_en_US.qm (96 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\60-latin.conf (1 bytes)
%Program Files%\Liveistream\Copying.txt (18 bytes)
%Program Files%\Liveistream\translations\smplayer_lt.qm (5133 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\30-urw-aliases.conf (1 bytes)
%Program Files%\Liveistream\QtNetwork4.dll (26959 bytes)
%Program Files%\Liveistream\dvdmenus.txt (1 bytes)
%Program Files%\Liveistream\translations\smplayer_gl.qm (8119 bytes)
%Program Files%\Liveistream\Not_so_obvious_things.txt (3 bytes)
%Program Files%\Liveistream\translations\smplayer_nl.qm (6504 bytes)
%Program Files%\Liveistream\mingwm10.dll (11 bytes)
%Program Files%\Liveistream\QtCore4.dll (62107 bytes)
%Program Files%\Liveistream\Copying_libmaia.txt (1 bytes)
%Program Files%\Liveistream\translations\smplayer_hr.qm (7712 bytes)
%Program Files%\Liveistream\Copying_BSD.txt (1 bytes)
%Program Files%\Liveistream\mplayer\mplayer\config (43 bytes)
%Program Files%\Liveistream\translations\smplayer_ka.qm (1568 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\51-local.conf (189 bytes)
%Program Files%\Liveistream\mplayer\mplayer\subfont.ttf (11619 bytes)
%Program Files%\Liveistream\translations\smplayer_cs.qm (4502 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\45-latin.conf (3 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\65-nonlatin.conf (7 bytes)
%Program Files%\Liveistream\translations\smplayer_sl_SI.qm (1568 bytes)
%Program Files%\Liveistream\translations\smplayer_fr.qm (6509 bytes)
%Program Files%\Liveistream\Watching_TV.txt (4 bytes)
%Program Files%\Liveistream\Finding_subtitles.txt (863 bytes)
%Program Files%\Liveistream\translations\smplayer_zh_CN.qm (4181 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\10-scale-bitmap-fonts.conf (1 bytes)
%Program Files%\Liveistream\zlib1.dll (956 bytes)
%Program Files%\Liveistream\imageformats\qjpeg4.dll (7535 bytes)
%Program Files%\Liveistream\translations\smplayer_et.qm (4021 bytes)
%Program Files%\Liveistream\translations\smplayer_he_IL.qm (4495 bytes)
%Program Files%\Liveistream\translations\smplayer_da.qm (4794 bytes)
%Program Files%\Liveistream\translations\smplayer_fi.qm (5233 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\65-fonts-persian.conf (10 bytes)
%Program Files%\Liveistream\uninstall.exe (1328 bytes)
%Documents and Settings%\%current user%\Desktop\Liveistream.lnk (703 bytes)
%Program Files%\Liveistream\translations\smplayer_de.qm (4984 bytes)
%Program Files%\Liveistream\translations\smplayer_eu.qm (6184 bytes)
%Program Files%\Liveistream\translations\smplayer_pt_BR.qm (4251 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\20-unhint-small-vera.conf (1 bytes)
%Program Files%\Liveistream\Readme.txt (3 bytes)
%Program Files%\Liveistream\translations\smplayer_vi_VN.qm (2414 bytes)
%Program Files%\Liveistream\translations\smplayer_ro_RO.qm (5204 bytes)
%Program Files%\Liveistream\mplayer\README.txt (3 bytes)
%Program Files%\Liveistream\mplayer\mplayer\input.conf (4 bytes)
%Program Files%\Liveistream\Install.txt (3 bytes)
%Program Files%\Liveistream\mplayer\MPlayer.html (13585 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Uninstall Liveistream.lnk (720 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Liveistream Website.lnk (770 bytes)
%Program Files%\Liveistream\translations\smplayer_hu.qm (3128 bytes)
%Program Files%\Liveistream\mplayer\LICENSE.txt (18 bytes)
%Program Files%\Liveistream\translations\smplayer_ru_RU.qm (6439 bytes)
%Program Files%\Liveistream\translations\smplayer_ar_SY.qm (2704 bytes)
%Program Files%\Liveistream\translations\smplayer_ko.qm (2808 bytes)
%Program Files%\Liveistream\translations\smplayer_th.qm (4402 bytes)
%Program Files%\Liveistream\sample.avi (29 bytes)
%Program Files%\Liveistream\translations\smplayer_sk.qm (3727 bytes)
%Program Files%\Liveistream\translations\smplayer_pl.qm (3799 bytes)
%Program Files%\Liveistream\translations\smplayer_sr.qm (6826 bytes)
%Program Files%\Liveistream\Liveistream website.url (51 bytes)
%Program Files%\Liveistream\mplayer\mplayer.exe (463001 bytes)
%Program Files%\Liveistream\translations\smplayer_ms_MY.qm (7328 bytes)
%Program Files%\Liveistream\translations\smplayer_it.qm (2763 bytes)
%Program Files%\Liveistream\QtXml4.dll (10675 bytes)
%Program Files%\Liveistream\Release_notes.txt (19 bytes)
%Program Files%\Liveistream\translations\smplayer_ja.qm (4666 bytes)
%Program Files%\Liveistream\translations\smplayer_ca.qm (4228 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\40-nonlatin.conf (5 bytes)
%Program Files%\Liveistream\smplayer.exe (58749 bytes)
%Program Files%\Liveistream\translations\smplayer_zh_TW.qm (2242 bytes)
%Program Files%\Liveistream\translations\smplayer_ku.qm (2679 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Liveistream.lnk (715 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\50-user.conf (673 bytes)
%Program Files%\Liveistream\translations\smplayer_es.qm (7068 bytes)
%Program Files%\Liveistream\translations\smplayer_el_GR.qm (6541 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\README (959 bytes)
%Program Files%\Liveistream\translations\smplayer_bg.qm (1568 bytes)
%Program Files%\Liveistream\Portable_Edition.txt (1 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\90-synthetic.conf (1 bytes)
%Program Files%\Liveistream\libgcc_s_dw2-1.dll (2752 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\69-unifont.conf (672 bytes)
%Program Files%\Liveistream\QtGui4.dll (257266 bytes)
%Program Files%\Liveistream\translations\qt_eu.qm (3054 bytes)
%Program Files%\Liveistream\mplayer\mplayer\config.sample (357 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\49-sansserif.conf (545 bytes)
%Program Files%\Liveistream\translations\smplayer_tr.qm (3134 bytes)
%Program Files%\Liveistream\mplayer\mplayer.man.html (16053 bytes)
%Program Files%\Liveistream\QtScript4.dll (48407 bytes)
%Program Files%\Liveistream\translations\smplayer_mk.qm (2507 bytes)
%Program Files%\Liveistream\translations\smplayer_sv.qm (1568 bytes)
%Program Files%\Liveistream\mplayer\fonts\fonts.conf (5 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\80-delicious.conf (422 bytes)
%Program Files%\Liveistream\shortcuts\default.keys (3 bytes)
%Program Files%\Liveistream\translations\smplayer_uk_UA.qm (5905 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\DynamicOfferScreen[1].htm (850 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-ui.min[1].js (6590 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-ui-1.8.19.custom[1].css (5521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\914066800710\LiveiStream.exe (1881417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\LiveiStream[1].exe (2527563 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DynamicOfferScreen[1].htm (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.min[1].js (2321 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.