IObitAdvancedSystemCare_57e00b034c

by malwarelabrobot on May 16th, 2014 in Malware Descriptions.

mzpefinder_pcap_file.YR, GenericEmailWorm.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: PUP


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 57e00b034c2e092e45a14b617f16afa7
SHA1: 8ad4698172e62dcc5ed95884bf43f22e3fae9869
SHA256: 7d0003e8d66b03c625475344d42c10142e4f26c7891918b84a5e786a4a6f9d0c
SSDeep: 24576:tFS c9CNq /suhNNlN67yyVi3wwpZgTM6q0KdpGAsReDM4B2sQTAH:mh UM59yVYiM6BqYAWeDVBay
Size: 1055040 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPXv0896v102v105v122Delphistub, UPolyXv05_v6
Company: IObit
Created at: 2014-05-04 15:11:06
Analyzed on: WindowsAda SP3 32-bit


Summary:

PUP. Potentially Unwanted Program. An application that does not display malicious behavior yet is installed without having first sought affirmative user consent for installation. Users may not realize, due to the nature of the installation procedure, that an application they have not explicitly agreed to has been installed. This category can also be used to classify other applications which in a certain context can be wanted e.g. remote administration tools or IRC clients.

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The program creates the following process(es):

ASCSetup.tmp:3220
AutoUpdate.exe:3528
LiveUpdate.exe:2880
LiveUpdate.exe:1196
LiveUpdate.exe:1088
LiveUpdate.exe:228
homepage.exe:3284
Display.exe:2904
Install_PintoStartMenu.exe:2348
ASCSetup.exe:3736
RealTimeProtector.exe:348
RealTimeProtector.exe:1636
RealTimeProtector.exe:4036
IEXPLORE.EXE:2500
PluginInstall.exe:2072
PerformUpdate.exe:3408
Reinforce.exe:3288
ASCUpgrade.exe:3844
UpgradeTip.exe:3208
iobitappsToolbar-stub-1.exe:3908
sc.exe:604
sc.exe:3532
SearchSettings.exe:2724
AutoCare.exe:2320
AutoCare.exe:340
SlickSavingsSet:3300
AutoSweep.exe:3644
Regsvr32.exe:2228
Regsvr32.exe:1324
ToolbarAcceptRate.exe:3900
ApplicationUpdater.exe:3388
verclsid.exe:2532
verclsid.exe:2520
IObitUninstaller.exe:3116
ASCInit.exe:1692
SPSetup.tmp:208
regsvr32.exe:2284
regsvr32.exe:352
regsvr32.exe:2272
SPSetup.exe:232
MonitorDisk.exe:1932
register.exe:2328
Wizard.exe:2280
Homepage.exe:2864
UninstallPromote.exe:1336
UninstallPromote.exe:2248
MsiExec.exe:1400
MsiExec.exe:2056
SPUpdate.exe:3656
%original file name%.exe:2172
MSIEXEC.EXE:1324
CouponsHelper.exe:3380
msfeedssync.exe:2376

The program injects its code into the following process(es):

IEXPLORE.EXE:2456
DiskDefrag.exe:1524
Asc.exe:3360
ASCTray.exe:3276
Monitor.exe:3356
ASCService.exe:2064

File activity

The process ASCSetup.tmp:3220 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced SystemCare 7.lnk (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-ITB88.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-SBQ5M.tmp (4185 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-KG0RF.tmp (857 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-SASS3.tmp (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-HJGCP.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-BR27O.tmp (898 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-BN4HI.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-359S6.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\drivers\wnet_x86\is-243N0.tmp (23 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-M4IM3.tmp (24284 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-4CEHO.tmp (4185 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-6VA20.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-5TOJN.tmp (7547 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-TN7EJ.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-EGEM3.tmp (3361 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-A3T4R.tmp (15019 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-HMG37.tmp (1425 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-CPR6B.tmp (15116 bytes)
%Program Files%\IObit\Advanced SystemCare 7\skin\is-6MFF2.tmp (14022 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-J9VO3.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-IC84M.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-NIVS5.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-1MQ5H.tmp (1281 bytes)
%Documents and Settings%\All Users\Desktop\Advanced SystemCare 7.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\ASCUpgrade.exe (3361 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-6RSJO.tmp (780 bytes)
%Program Files%\IObit\Advanced SystemCare 7\skin\is-688L8.tmp (7433 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-K1Q8T.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-OQHH6.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-G7VGS.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-D67R1.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-FJ32V.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-5GDGP.tmp (7726 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-KJRV5.tmp (63 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-29FG8.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\skin\is-91907.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-DQ8CJ.tmp (7345 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-TL8T6.tmp (889 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-R4V8I.tmp (968 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-89GRT.tmp (9 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-J68V4.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\drivers\wlh_x86\is-VS17B.tmp (24 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-TJHP3.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-SL9TE.tmp (5441 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-S2CLL.tmp (5873 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-EPEVC.tmp (7345 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-9KUT6.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Update\is-S89N8.tmp (2 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-KG0Q9.tmp (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-6T8QT.tmp (4545 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-HKEJB.tmp (7971 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-QKUON.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-2PTQ6.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-QH0K1.tmp (14 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-5IBHU.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-4OCLS.tmp (7345 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-SCIT8.tmp (46 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-DV78N.tmp (7726 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-KLGSK.tmp (13122 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-VUKSK.tmp (1281 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (104 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-3PQP9.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-0UC0R.tmp (3073 bytes)
%Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-NJUCF.tmp (1425 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-T7AVP.tmp (3 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-M0G8M.tmp (7433 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Advanced SystemCare 7\Advanced SystemCare 7.lnk (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-TACQK.tmp (15799 bytes)
%Program Files%\IObit\Advanced SystemCare 7\drivers\win7_x86\is-DFMOE.tmp (24 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-ODK5J.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-O0J3V.tmp (5441 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-2HFE9.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-MVMGC.tmp (1425 bytes)
%Program Files%\IObit\Advanced SystemCare 7\unins000.msg (646 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-OL1O2.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\drivers\wxp_x86\is-UDJ13.tmp (23 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-TNJOE.tmp (3361 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-U05KK.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-67SSQ.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-A34G8.tmp (44 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-1LNQD.tmp (3361 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-AC83F.tmp (3361 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-TICD4.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-VAF7E.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-U3N5K.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-EJMQ2.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\drivers\win7_amd64\is-10GOM.tmp (27 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-EJ99M.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-M1SMS.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-27V9L.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-2LJ0R.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-UCC5J.tmp (4185 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-N9LE3.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-GIGIB.tmp (44 bytes)
%Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-D274O.tmp (1425 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-ECT8K.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-V9RDT.tmp (3361 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-OEPTK.tmp (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\itdownload.dll (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-R271H.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-S0GNH.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-TLHOJ.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\skin\is-IKV3N.tmp (8281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\unins000.dat (38201 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-SJ3D3.tmp (56 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-F42GM.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-B84HA.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-5G3GD.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-LJPO5.tmp (32242 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-CD994.tmp (12 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-BR7E8.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-1S4VO.tmp (6841 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-6NME8.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-1A0LU.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-F94LD.tmp (4545 bytes)
%Program Files%\IObit\Advanced SystemCare 7\drivers\wnet_amd64\is-06DDD.tmp (26 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-USU05.tmp (3361 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-3CJAR.tmp (43 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-A0UAA.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-LHA6T.tmp (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-5IDA8.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-RGFV9.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-UQKR1.tmp (7433 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-4Q7TA.tmp (3361 bytes)
%Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-3EHL3.tmp (1425 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-EKCJD.tmp (4185 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-FC0PH.tmp (4545 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Advanced SystemCare 7\Uninstall Advanced SystemCare.lnk (869 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-NBIG9.tmp (3073 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-QLKO2.tmp (904 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-1AOPI.tmp (8281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-79RRK.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\iobitappsToolbar-stub-1.exe (8281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-45KL1.tmp (23 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-BMNPL.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-MLIH8.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-P0A69.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-J3QH2.tmp (39506 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-PS915.tmp (51 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-9J159.tmp (15116 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-GMLE5.tmp (14022 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-2PTPK.tmp (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\_isetup\_shfoldr.dll (23 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-648U6.tmp (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-E5T93.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-A7K2S.tmp (1425 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-DL5F4.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-2MAN4.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-H617Q.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-C1K6K.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-3S1HS.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-9H9LR.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-UH4K8.tmp (5 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-3SH0L.tmp (11 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-O7GOD.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-VJOBM.tmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\RdZone.dll (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-DFPAO.tmp (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-42OFF.tmp (1425 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-S7UHM.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-I4TNG.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-GJ10H.tmp (7433 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-L4PE2.tmp (806 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-37ET2.tmp (7433 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-89VPT.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Update\is-46DMF.tmp (20 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-FI00K.tmp (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-HFEMK.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\skin\is-C84BQ.tmp (10815 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-SQ93E.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-HDL3F.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\ToolbarAcceptRate.exe (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-LNIAS.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-E1E1P.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-7PU27.tmp (32429 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-3720L.tmp (22 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-T44HN.tmp (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-VGE3T.tmp (3073 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-V3FLI.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\drivers\wlh_amd64\is-UD4JC.tmp (27 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-9F44T.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-F20P8.tmp (2105 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Advanced SystemCare 7\Turbo Boost.lnk (886 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-HQQO4.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-20PHJ.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-DNPI1.tmp (1425 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-K6A1L.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-63J86.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-04H9G.tmp (1425 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-LCM36.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-C2TD5.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-9PA7U.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-C1J5P.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-48DJ5.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-O8SAB.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-K5IV9.tmp (7 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-BB6BU.tmp (56198 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-H0O9L.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-FMTRF.tmp (1425 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-MTLLE.tmp (5873 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-MB051.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-4045E.tmp (56 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-L8QDP.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-O2QK0.tmp (13122 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-4NSCU.tmp (13122 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Update\is-J5O4I.tmp (11 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-AUVR9.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\drivers\wxp_amd64\is-5SPV4.tmp (26 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-EEV4J.tmp (2321 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-LQ39D.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-MJ3P2.tmp (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\Inno_English.lng (14 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-H14OM.tmp (7971 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-HF5MS.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-JPIVB.tmp (10 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-PFNI0.tmp (14 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-IHOA1.tmp (11 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-4RU14.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-UO00C.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-0MEK3.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-CKQL6.tmp (948 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-6K5B0.tmp (7547 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-98P8T.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-IUPSQ.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-QKJ5N.tmp (4185 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-28TOU.tmp (15506 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-G2ETA.tmp (7547 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-KCKV0.tmp (5 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-ALJU9.tmp (6841 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Advanced SystemCare 7\Toolbox.lnk (880 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-QQPEU.tmp (6841 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-JNRDB.tmp (11518 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-4C3H9.tmp (2321 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-ESLT8.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-9DVOA.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-76HU0.tmp (36 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-TRVV5.tmp (4 bytes)
%Program Files%\IObit\Advanced SystemCare 7\is-331UQ.tmp (14988 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-BK9QL.tmp (673 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-SDTLT.tmp (2105 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Images\is-NKONP.tmp (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\is-ALKAS.tmp (601 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-LH96E.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Language\is-ELATG.tmp (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\skin\is-IK5N9.tmp (14988 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\ASCUpgrade.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\itdownload.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\_isetup\_shfoldr.dll (0 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Reinforce.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\_isetup (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\Inno_English.lng (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\RdZone.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\ToolbarAcceptRate.exe (0 bytes)

The process AutoUpdate.exe:3528 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (110 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Update\Update.ini (20 bytes)
%Program Files%\IObit\Advanced SystemCare 7\AutoUpdate.log (7142 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Update\Update.ini.tmp (1521 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Update\Test.ini (34 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AutoUpdate.madExcept (0 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Update\Test.ini (0 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Update\Update.ini.tmp (0 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Update\Update.ini (0 bytes)

The process LiveUpdate.exe:2880 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Program Files%\IObit\LiveUpdate\update\timer.db (189 bytes)
%Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\Downloader.log (13954 bytes)
%Program Files%\IObit\LiveUpdate\LiveUpdateSrvUpt.log (27392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZtfKYq3ttQv8tnkE.tmp (1700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZtfKYq3ttQv8tnkE.tmp.dat (1720 bytes)
%Program Files%\IObit\LiveUpdate\system.ini (93 bytes)
%Program Files%\IObit\LiveUpdate\update\update.spt (5 bytes)
%Documents and Settings%\%current user%\Application Data\ProductData\update.spt (5 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LiveUpdate.madExcept (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZtfKYq3ttQv8tnkE.tmp.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZtfKYq3ttQv8tnkE.tmp (0 bytes)

The process LiveUpdate.exe:1196 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Program Files%\IObit\LiveUpdate\Language\Slovak.lng (1281 bytes)
%Program Files%\IObit\Advanced SystemCare 7\LiveUpdate.log (272 bytes)
%Program Files%\IObit\LiveUpdate\Language\Hungarian.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Czech.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\ChineseSimp.lng (673 bytes)
%Program Files%\IObit\LiveUpdate\Language\Portuguese(PT-PT).lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Malayalam.lng (673 bytes)
%Program Files%\IObit\LiveUpdate\Language\Russian.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Greek.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Portuguese(PT-BR).lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Latvian.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\LiveUpdate.exe (15116 bytes)
%Program Files%\IObit\LiveUpdate\Language\Polish.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Dinka.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\ProductStatistics.dll (4185 bytes)
%Program Files%\IObit\LiveUpdate\Language\English.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Finnish.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Dutch.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Hebrew.lng (673 bytes)
%Program Files%\IObit\LiveUpdate\Language\Romanian.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Korean.lng (673 bytes)
%Program Files%\IObit\LiveUpdate\Language\Arabic.lng (673 bytes)
%Program Files%\IObit\LiveUpdate\Language\Spanish.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Vietnamese.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Belarusian.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Japanese.lng (673 bytes)
%Program Files%\IObit\LiveUpdate\Language\Flemish.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Slovenian.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\ChineseTrad.lng (601 bytes)
%Program Files%\IObit\LiveUpdate\Language\Serbian (latin).lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Serbian (cyrillic).lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Ukrainian.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Italian.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\German.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Indonesia.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\French.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Turkish.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Swedish.lng (1281 bytes)
%Program Files%\IObit\LiveUpdate\Language\Danish.lng (1281 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LiveUpdate.madExcept (0 bytes)

The process LiveUpdate.exe:1088 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Program Files%\IObit\LiveUpdate\LiveUpdate.log (806 bytes)

The program deletes the following file(s):

%WinDir%\Temp\LiveUpdate.madExcept (0 bytes)

The process homepage.exe:3284 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\homepage.log (607 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\homepage.madExcept (0 bytes)

The process Display.exe:2904 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced SystemCare 7.lnk (1 bytes)
%Documents and Settings%\All Users\Desktop\Advanced SystemCare 7.lnk (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Advanced SystemCare 7\Advanced SystemCare 7.lnk (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Display_log.txt (796 bytes)
%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\HealthLevel.ini (82 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\change.log (244 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000009.lnk (2 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000007.lnk (2 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000008.lnk (2 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Display.madExcept (0 bytes)

The process Install_PintoStartMenu.exe:2348 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Uninstall Programs.lnk (887 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\IObit Uninstaller\MenuRight.dat (302 bytes)

The process ASCSetup.exe:3736 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-HLFGJ.tmp\ASCSetup.tmp (7386 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-HLFGJ.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-HLFGJ.tmp\ASCSetup.tmp (0 bytes)

The process RealTimeProtector.exe:348 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (924 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RealTimeProtector.madExcept (0 bytes)

The process RealTimeProtector.exe:1636 makes changes in the file system.
The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RealTimeProtector.madExcept (0 bytes)

The process RealTimeProtector.exe:4036 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (3540 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RealTimeProtector.madExcept (0 bytes)

The process IEXPLORE.EXE:2456 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\icon_11[1].png (646 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\google_logo_41[1].png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\icon_13[1].png (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\css[1].css (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\f[1].txt (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\itema[1].png (997 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\jane_mcclain[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\icon_10[1].png (580 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\mony_back[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\asc7pro[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icon_14[1].png (606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\main[1].js (277 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icons[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\discount[1].png (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\icon_09[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\footer_bg[1].png (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\public[1].css (12682 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot (4689 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\f[1].txt (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\reset[1].css (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\translateelement[1].css (9026 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\bluemark[1].png (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\banner-dbfree-300x250[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\logo_head[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\loading[1].gif (1107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\icon_04[1].png (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\redirect[1].js (3398 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\icon_03[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\element_main[1].js (151668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\almirr[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\scrollup_telsupport[1].png (1308 bytes)
%Documents and Settings%\%current user%\Cookies\5I7OX03J.txt (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icon_06[1].png (915 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\favicon[1].ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\jquery.superbox-min[1].js (2450 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icon_08[1].png (556 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\en[1].htm (1849 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\icon_12[1].png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icon_02[1].png (171 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\icon_05[1].png (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\asc7free[1].png (7 bytes)
%Documents and Settings%\%current user%\Cookies\U5CZ81GJ.txt (120 bytes)
%Documents and Settings%\%current user%\Cookies\EAC1U558.txt (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\gordon[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\base[1].js (2317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\icon_07[1].png (545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\arr[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icon_01[1].png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014051620140517\index.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\btns[1].png (578 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\install_en[1].css (807 bytes)
%Documents and Settings%\%current user%\Cookies\AH0OJJGN.txt (300 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\itemb[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\ga[1].js (22344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\translate-32[1].png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\bob_bassett[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\promo_awards[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\redmark[1].png (398 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\en[1].php (738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\mapplication[1].js (13067 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\jquery-1.7.1.min[1].js (58919 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\U5CZ81GJ.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\EAC1U558.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\AH0OJJGN.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\f[1].txt (0 bytes)

The process IEXPLORE.EXE:2500 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{F29AF83C-DD01-11E3-81D1-0050563EC483}.dat (15783 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F29AF83D-DD01-11E3-81D1-0050563EC483}.dat (17815 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DF297C.tmp (3263 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DF3CC1.tmp (3263 bytes)

The process PluginInstall.exe:2072 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\warning.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\background.html (206 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\urlbaricon.js (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\window_safe.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\tip_details.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\imagemgr.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\safe_logo.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\ASCPlugin_Protect.dll (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\popbox_btn_close.png (1 bytes)
%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\AscService.ini (76 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions.json (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\background.js (14 bytes)
%Program Files%\IObit\Surfing Protection\Preferences (1269 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome.manifest (153 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\IObit\Advanced SystemCare V7\Main.ini (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\window_risk.png (4 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\ascsurfingprotection.xul (3 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\protectpage.js (8 bytes)
%Documents and Settings%\%current user%\Application Data\Apple Computer\Safari\Extensions\Extensions.plist (643 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\searchresultmgr.js (22 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\ascsurfingprotection.js (19 bytes)
%Program Files%\IObit\Surfing Protection\Extensions.plist (643 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\warning.bak (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\tips.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\popup.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\asc.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Ex.js (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\popup.html (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\risk_logo.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\popbox.css (136 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\risk.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\icon.png (4 bytes)
%Program Files%\IObit\Surfing Protection\SPInit.log (8003 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (4274 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\popbox_btn_ok.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Apple Computer\Safari\Extensions\ASCBrowserProtection.safariextz (601 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions.ini (522 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\install.rdf (843 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\safe.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\wraningBg.png (24 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\languagemgr.js (7 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PluginInstall.madExcept (0 bytes)

The process PerformUpdate.exe:3408 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (300 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\active[1].php (31 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PerformUpdate.madExcept (0 bytes)

The process Reinforce.exe:3288 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\ReinforceData.ini (2288 bytes)
%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\AntivirusConfig.ini (228 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Reinforce.madExcept (0 bytes)

The process UpgradeTip.exe:3208 makes changes in the file system.
The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UpgradeTip.madExcept (0 bytes)

The process iobitappsToolbar-stub-1.exe:3908 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x0410.ini (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is2B.tmp (345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is34.tmp (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is28.tmp (345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is27.tmp (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x040c.ini (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~33.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~2E.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\iobitappsToolbar.msi (36896 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E} (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\1033.MST (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x0409.ini (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\Setup.INI (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\iobitappsToolbar[1].msi (466782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is26.tmp (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x0407.ini (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is32.tmp (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x040a.ini (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is2A.tmp (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is2F.tmp (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is2D.tmp (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~2C.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is30.tmp (660 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is29.tmp (345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\_ISMSIDEL.INI (14120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~31.tmp (5 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x0410.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is2B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is34.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is28.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is27.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x040c.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~33.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~2E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MSI5166._IS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\iobitappsToolbar.msi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\1033.MST (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x0409.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\Setup.INI (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\iobitappsToolbar[1].msi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is26.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x0407.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is32.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x040a.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is2A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is2F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is2D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~2C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is30.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is29.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\_ISMSIDEL.INI (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~31.tmp (0 bytes)

The process SearchSettings.exe:2724 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal (13210 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\favicon[1].ico (1150 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data (6968 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\searchplugins\yandex.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Local State (58 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js (57 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal (0 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\search.json (0 bytes)

The process AutoCare.exe:2320 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (80 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (152 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AutoCare.madExcept (0 bytes)

The process AutoCare.exe:340 makes changes in the file system.
The program creates and/or writes to the following file(s):

%WinDir%\WindowsUpdate.log (10140 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (96 bytes)
%Program Files%\IObit\Advanced SystemCare 7\sh.dat (1373572 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Ignore.ini (4 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AutoCare.madExcept (0 bytes)

The process SlickSavingsSet:3300 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Slick Savings\Uninstall.exe (3268 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9F.tmp\NSISCouponsPlugin.dll (2392 bytes)
%Documents and Settings%\%current user%\Application Data\Slick Savings\Coupons64.dll (21216 bytes)
%Documents and Settings%\%current user%\Application Data\Slick Savings\coupons_2.4.crx (784 bytes)
%Documents and Settings%\%current user%\Application Data\Slick Savings\coupons_2.9.xpi (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9F.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9E.tmp (49595 bytes)
%Documents and Settings%\%current user%\Application Data\Slick Savings\CouponsHelper.exe (27704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9F.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Application Data\Slick Savings\Coupons.dll (18424 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss9D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9F.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9F.tmp\NSISCouponsPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9F.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9F.tmp (0 bytes)

The process AutoSweep.exe:3644 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (40 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (248 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AutoSweep.madExcept (0 bytes)

The process ToolbarAcceptRate.exe:3900 makes changes in the file system.
The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ToolbarAcceptRate.madExcept (0 bytes)

The process Asc.exe:3360 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Program Files%\IObit\Advanced SystemCare 7\LatestNews\imagenews_B.tmp (5 bytes)
%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\HealthLevel.ini (2 bytes)
%Program Files%\IObit\Advanced SystemCare 7\LatestNews\LatestNews.ini (26 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (104 bytes)
%Program Files%\IObit\Advanced SystemCare 7\LatestNews\imagenews.tmp (159 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (72 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Asc.madExcept (0 bytes)

The process ApplicationUpdater.exe:3388 makes changes in the file system.
The program creates and/or writes to the following file(s):

C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\change.log (812 bytes)

The process IObitUninstaller.exe:3116 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZLB52.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6E.tmp (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6B.tmp (5224 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Dinka.lng (27 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Vietnamese.lng (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4E.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB74.tmp (38624 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\German.lng (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5E.tmp (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB70.tmp (1 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\right-click-entrance.jpg (49 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Hindi.lng (27 bytes)
%Program Files%\IObit\IObit Uninstaller\UninstallPromote.exe (15116 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\ChineseTrad.lng (19 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Hrvatski.lng (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB43.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\sqlite3.dll (1798 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\uninstalling.jpg (99 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Hungarian.lng (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5A.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB62.tmp (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB35.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4C.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB77.tmp (18768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4D.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6C.tmp (1 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Malayalam.lng (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5B.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5D.tmp (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB78.tmp (20504 bytes)
%Program Files%\IObit\IObit Uninstaller\taskmgr.dll (1620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4F.tmp (4 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Portuguese(PT-BR).lng (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB64.tmp (2 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\more-settings-button.jpg (845 bytes)
%Program Files%\IObit\IObit Uninstaller\UninstallRote.dbd (15 bytes)
%Program Files%\IObit\IObit Uninstaller\vcl120.bpl (14988 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Nuer.lng (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB50.tmp (5 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\change.log (5 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\search-program.jpg (2 bytes)
%Program Files%\IObit\IObit Uninstaller\IObitUninstaler.exe (56198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4B.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB75.tmp (2696 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Danish.lng (24 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Ukrainian.lng (24 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\more-settings.jpg (113 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\shred-file.jpg (85 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\batch-uninstall.jpg (1 bytes)
%Program Files%\IObit\IObit Uninstaller\UninstallMenuRight32_1.dll (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4A.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\main-screen.jpg (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB37.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB65.tmp (5952 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\uninstall.jpg (96 bytes)
%Program Files%\IObit\IObit Uninstaller\madbasic_.bpl (673 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Polish.lng (28 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Korean.lng (21 bytes)
%Program Files%\IObit\IObit Uninstaller\datastate.dll (66 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB42.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB48.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Serbian(Cyrillic).lng (28 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Dutch.lng (29 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\like.jpg (1 bytes)
%Program Files%\IObit\IObit Uninstaller\UninstallExplorer32_1.dll (3825 bytes)
%Program Files%\IObit\IObit Uninstaller\Uninstaler_SkipUac.exe (7386 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Swedish.lng (26 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Thai.lng (27 bytes)
%Documents and Settings%\All Users\Desktop\IObit Uninstaller.lnk (881 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Arabic.lng (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB7B.tmp (23608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6D.tmp (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3F.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB67.tmp (826 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\file-shredder.jpg (82 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\browser-plug-ins.jpg (111 bytes)
%Program Files%\IObit\IObit Uninstaller\help.html (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB51.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\pr.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB44.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB60.tmp (661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB47.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB55.tmp (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\IObit Uninstaller\Uninstall IObit Uninstaller.lnk (915 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB58.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB7A.tmp (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3D.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\control-panel-entrance.jpg (115 bytes)
%Program Files%\IObit\IObit Uninstaller\rtl120.bpl (7433 bytes)
%Program Files%\IObit\IObit Uninstaller\Install_PintoStartMenu.exe (1869 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Belarusian.lng (28 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\_driver.cfg (512 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\French.lng (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB57.tmp (5 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\IObit Uninstaller\Main.ini (26 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Serbian(Latin).lng (28 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Slovenian.lng (29 bytes)
%Program Files%\IObit\IObit Uninstaller\UninstallDisplay.exe (3702 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB69.tmp (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3C.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB39.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB54.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Romanian.lng (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB49.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Latvian.lng (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB66.tmp (5952 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\powerful-scan.jpg (94 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Finnish.lng (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB71.tmp (392 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Greek.lng (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB61.tmp (5952 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Japanese.lng (21 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\more-settings-dropdown.jpg (15 bytes)
%Program Files%\IObit\IObit Uninstaller\ProductStatistics.dll (4185 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\file-shred.jpg (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB68.tmp (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3A.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6F.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB38.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB40.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\English.lng (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB45.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB79.tmp (16 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\restore-browser-default.jpg (97 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3E.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB7C.tmp (9496 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Czech.lng (24 bytes)
%Program Files%\IObit\IObit Uninstaller\mcwNWP2fEx (30622 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB73.tmp (20400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3B.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\ChineseSimp.lng (19 bytes)
%Program Files%\IObit\IObit Uninstaller\maddisAsm_.bpl (51 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\IObit Uninstaller\Help.lnk (826 bytes)
%Program Files%\IObit\IObit Uninstaller\madexcept_.bpl (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB41.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB53.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\forced-uninstall.jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB56.tmp (4 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Spanish.lng (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB36.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB46.tmp (6 bytes)
%Program Files%\IObit\IObit Uninstaller\EULA.rtf (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5C.tmp (6872 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Italian.lng (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5F.tmp (6984 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Russian.lng (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6A.tmp (5224 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\settings.jpg (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB63.tmp (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB72.tmp (392 bytes)
%Program Files%\IObit\IObit Uninstaller\vclx120.bpl (1281 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\create-restore-point.jpg (94 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\IObit Uninstaller\IObit Uninstaller.lnk (893 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Portuguese(PT-PT).lng (30 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\view-style.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB59.tmp (5 bytes)
%Program Files%\IObit\IObit Uninstaller\Images\vote.jpg (108 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Turkish.lng (28 bytes)
%Program Files%\IObit\IObit Uninstaller\Language\Indonesian.lng (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB76.tmp (7288 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB60.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB38.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB40.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB47.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB76.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB45.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB7C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB7B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB69.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB48.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB77.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB37.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB52.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB58.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB78.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB74.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB65.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB53.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3D.tmp (0 bytes)
%Program Files%\IObit\IObit Uninstaller\mcwNWP2fEx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB73.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB71.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB42.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IObitUninstaller.madExcept (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB43.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB72.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB79.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB57.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB62.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB35.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB41.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB39.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB54.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB56.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB49.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB36.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB46.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB66.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB5F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB6A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB55.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB63.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB67.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB7A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB68.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB64.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB61.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB51.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB75.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB50.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB59.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB70.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB44.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB4B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLB3A.tmp (0 bytes)

The process ASCInit.exe:1692 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Program Files%\IObit\Advanced SystemCare 7\Boottime\path.ini (97 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (6349 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (498 bytes)
%Program Files%\IObit\Advanced SystemCare 7\ASCInit.log (6399 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ASCInit.madExcept (0 bytes)

The process SPSetup.tmp:208 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Program Files%\IObit\Surfing Protection\BrowerProtect\is-6MLU5.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-RNTOR.tmp (3 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-K8HIV.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-S7H0C.tmp (2 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\is-19IBT.tmp (5441 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-0BHOK.tmp (4 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-TKT96.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-1BQHB.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-7TIE3.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-8TCIU.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-TRP7C.tmp (3 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-C5M14.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-GBDE3.tmp (3 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\is-HALQP.tmp (843 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-JSA1K.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-FKE83.tmp (3 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-O426H.tmp (812 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-UJ9QP.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-LT00K.tmp (3361 bytes)
%Program Files%\IObit\Surfing Protection\is-8JKOG.tmp (32233 bytes)
%Program Files%\IObit\Surfing Protection\Database\is-59VLP.tmp (23811 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-NL4P9.tmp (4 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\is-C2VJP.tmp (545 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-VCN8B.tmp (393 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-791VF.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-MEFGC.tmp (7 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-1QFKC.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-UTFC2.tmp (136 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-KI5P7.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-ITLIN.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-96ES9.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-GOPD5.tmp (19 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\is-QRRD2.tmp (1281 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-4V27Q.tmp (8 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-VD3GJ.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\Database\is-7MI81.tmp (911 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-GT93V.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-NOMN1.tmp (2 bytes)
%Program Files%\IObit\Surfing Protection\Database\is-VANPK.tmp (5873 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-OAVRF.tmp (4 bytes)
%Program Files%\IObit\Surfing Protection\unins000.dat (11432 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-U0Q7D.tmp (24 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-9TJ1E.tmp (24 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-2FDM1.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\is-G67UP.tmp (2105 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-Q4EQ3.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-RKHR7.tmp (4 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-2DM4T.tmp (2 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-RLAST.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\unins000.msg (646 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-EQ8HJ.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-52Q9V.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-H3RS3.tmp (4 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-PODS0.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-NJD69.tmp (2 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-E0LPN.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-103M0.tmp\Inno_English.lng (5 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-9UR7A.tmp (14 bytes)
%Program Files%\IObit\Surfing Protection\Database\is-JFGBS.tmp (21 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-5RO71.tmp (3 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-US8E9.tmp (3 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\is-5QGIA.tmp (1425 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-5UH7B.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\is-JUQQ6.tmp (8281 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-1T7OA.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-2NMJ8.tmp (4 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-9S6Q8.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-3DUT8.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-92N8V.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-ISSVD.tmp (924 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\is-1MTCD.tmp (601 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\is-OGSNG.tmp (3361 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\is-3UL2F.tmp (153 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-3QEAS.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-43I5L.tmp (6 bytes)
%Program Files%\IObit\Surfing Protection\is-IS7N4.tmp (3073 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-KTBFJ.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-B3SNS.tmp (206 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-103M0.tmp\_isetup\_shfoldr.dll (23 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\is-4EUCT.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\is-FLIU7.tmp (5 bytes)
%Program Files%\IObit\Surfing Protection\is-F42BJ.tmp (7971 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-AUS9U.tmp (878 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-1MMQV.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-6HA8N.tmp (22 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-A35SO.tmp (43 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\is-I1UCE.tmp (1 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\is-1BN7V.tmp (4 bytes)
%Program Files%\IObit\Surfing Protection\Language\is-5IQFJ.tmp (768 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-NTCF6.tmp (28 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\is-NRRLP.tmp (4545 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-2UASH.tmp (13 bytes)
%Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-6SUH6.tmp (4 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-103M0.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-103M0.tmp\_isetup\_shfoldr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-103M0.tmp\_isetup (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-103M0.tmp\Inno_English.lng (0 bytes)

The process ASCTray.exe:3276 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (17 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\ASCTray.log (709 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ASCTray.madExcept (0 bytes)

The process SPSetup.exe:232 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-J7VII.tmp\SPSetup.tmp (7386 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-J7VII.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-J7VII.tmp\SPSetup.tmp (0 bytes)

The process MonitorDisk.exe:1932 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (49 bytes)
%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\AscService.ini (172 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MonitorDisk.madExcept (0 bytes)

The process Monitor.exe:3356 makes changes in the file system.
The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Monitor.madExcept (0 bytes)

The process register.exe:2328 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (42 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\register.madExcept (0 bytes)

The process Wizard.exe:2280 makes changes in the file system.
The program creates and/or writes to the following file(s):

%WinDir%\Tasks\ASC7_PerformanceMonitor.job (264 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (14 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (1384 bytes)
%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\AntivirusConfig.ini (26 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000003.ini (512 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Wizard.madExcept (0 bytes)

The process Homepage.exe:2864 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\homepage.log (1741 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Homepage.madExcept (0 bytes)

The process UninstallPromote.exe:1336 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (1865 bytes)
%Documents and Settings%\All Users\Application Data\IObit\Install.ini (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\install[1].php (4 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UninstallPromote.madExcept (0 bytes)

The process UninstallPromote.exe:2248 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\install[1].php (4 bytes)
%Documents and Settings%\All Users\Application Data\IObit\Install.ini (46 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000002.ini (512 bytes)

The process MsiExec.exe:1400 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_is90 (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is91 (1 bytes)
%Program Files%\Common Files\Spigot\Search Settings\yandex_ff.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~87.tmp (277532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is8F (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is8E (734 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is8D (595 bytes)
%Program Files%\IObit Apps Toolbar\Res\widgets.xml (9 bytes)
%Program Files%\Common Files\Spigot\Search Settings\yandex_ie.xml (617 bytes)
%Program Files%\Common Files\Spigot\Search Settings\yahoo_ie.xml (584 bytes)
%Program Files%\Common Files\Spigot\Search Settings\yahoo_ff.xml (776 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_is91.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is90.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is8D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is8E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is8F.tmp (0 bytes)

The process MsiExec.exe:2056 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (241 bytes)
%Program Files%\IObit Apps Toolbar\Res\widgets.xml (9 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~87.tmp (137830 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\iobitapps@mybrowserbar.com (39 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_is90 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is91 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~87.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is8F (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is8E (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is8D (0 bytes)

The process SPUpdate.exe:3656 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (20482 bytes)
%Program Files%\IObit\Surfing Protection\Database\base_upt_add_tmp (23886 bytes)
%Program Files%\IObit\Surfing Protection\Database\spupdate.utp (912 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SPUpdate.madExcept (0 bytes)
%Program Files%\IObit\Surfing Protection\Database\base_upt_add_del (0 bytes)

The process %original file name%.exe:2172 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\Country.dat.dat (2 bytes)
%Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\Update.upt (194 bytes)
%Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\Downloader.log (8278 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000001.ini (512 bytes)
%Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\Update.upt.dat (617 bytes)
%Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\ASCSetup.exe.dat (1396 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (102 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\_driver.cfg (512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\getcountry[1].cgi (2 bytes)
%Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\ASCSetup.exe (11378059 bytes)
%Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\ASC7_UserConfig.ini (1356 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\57e00b034c2e092e45a14b617f16afa7.madExcept (0 bytes)

The process ASCService.exe:2064 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Program Files%\IObit\Advanced SystemCare 7\Database\yahoo.xml (1 bytes)
%Program Files%\IObit\Advanced SystemCare 7\ASCService.log (17257 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data.ReadOnly (2875 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-13-510).old (601 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-48-588).old (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data (3328 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\HomepageBlack.dbd (130 bytes)
%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\AscService.ini (158 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000005.ini (512 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\HomepageIgnore.dbd (633 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-48-619).new (601 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\HomepageProtect.ini (102648 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\bing.xml (2 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\google.xml (2 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\prefs.js.2014-05-16(16-57-13-338).old (5 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\prefs.js.2014-05-16(16-57-48-510).old (5 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\ProgramDeactivator\myAutoDisable.ini (4 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-13-572).new (601 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-48-244).old (601 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\prefs.js.2014-05-16(16-57-48-525).new (5 bytes)
C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000010.ini (512 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js (26 bytes)
%Program Files%\IObit\Advanced SystemCare 7\Database\HomepageWhite.dbd (633 bytes)
%Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\ASCService.log (91059 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-48-260).new (601 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\prefs.js.2014-05-16(16-57-13-385).new (5 bytes)
%Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\google.xml (3 bytes)

The program deletes the following file(s):

%WinDir%\Temp\ASCService.madExcept (0 bytes)

The process CouponsHelper.exe:3380 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\savingsslider.js (392 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\main.js (386 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\icon.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Slick Savings\coupons.crx (22 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\spigot.js (3 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\config.json (371 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome.manifest (148 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\savingsslider.xul (606 bytes)

The process msfeedssync.exe:2376 makes changes in the file system.
The program creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\ie8[1].txt (644 bytes)
%WinDir%\Tasks\User_Feed_Synchronization-{414D0F7C-B684-437B-B53E-8AB5AE32E070}.job (416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\SuggestedSites.dat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms (2168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\rss[1].xml (11437 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms (10780 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms (4452 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms (4452 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\Internet Explorer Suggested Sites~.feed-ms (2168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\rss[1].xml (10305 bytes)

The program deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\ie8[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\rss[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\rss[1].xml (0 bytes)

Registry activity

The process ASCSetup.tmp:3220 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"LiveUpdate.exe" = "Product Updater"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-IMU9L.tmp]
"ToolbarAcceptRate.exe" = "ToolbarAcceptRate"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"Inno Setup: Setup Version" = "5.5.4 (u)"
"QuietUninstallString" = "%Program Files%\IObit\Advanced SystemCare 7\unins000.exe /SILENT"

[HKLM\SOFTWARE\IObit\Advanced SystemCare 7]
"AppPath" = "%Program Files%\IObit\Advanced SystemCare 7\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"DisplayIcon" = "%Program Files%\IObit\Advanced SystemCare 7\ASC.exe"

[HKLM\SOFTWARE\IObit\Advanced SystemCare 7]
"Upgrade" = "No"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"Publisher" = "IObit"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-IMU9L.tmp]
"iobitappsToolbar-stub-1.exe" = "Setup Launcher Unicode"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"Inno Setup: Selected Tasks" = "desktopicon,quicklaunchicon"
"InstallLocation" = "%Program Files%\IObit\Advanced SystemCare 7\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"Inno Setup: User" = "%CurrentUserName%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\IObit\ASC]
"Path" = "%Program Files%\IObit\Advanced SystemCare 7\ASC.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"MajorVersion" = "7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"SPSetup.exe" = "IObit Surfing Protection"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"HelpLink" = "http://www.iobit.com/"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\IObit\Advanced SystemCare 7]
"ref" = "asc7"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"DiskDefrag.exe" = "Advanced SystemCare Disk Defrag"
"RealTimeProtector.exe" = "Real-time Protector"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"NoModify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"UninstallString" = "%Program Files%\IObit\Advanced SystemCare 7\unins000.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"URLInfoAbout" = "http://www.iobit.com/"

"Inno Setup: Deselected Tasks" = ""
"DisplayName" = "Advanced SystemCare 7"

[HKLM\SOFTWARE\IObit\ASC]
"Latest Version" = "7.3.0.454"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"IObitUninstaller.exe" = "Uninstall Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"URLUpdateInfo" = "http://www.iobit.com/"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E 34 53 15 B9 03 E6 D8 46 52 41 DD 33 09 9A 7B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-IMU9L.tmp]
"ASCUpgrade.exe" = "Advanced SystemCare 7 Upgrader"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"Inno Setup: App Path" = "%Program Files%\IObit\Advanced SystemCare 7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"Inno Setup: Icon Group" = "Advanced SystemCare 7"
"InstallDate" = "20140516"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"ASCInit.exe" = "Advanced SystemCare 7 Initialization"
"UpgradeTip.exe" = "Show new ASC function"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1]
"MinorVersion" = "3"
"DisplayVersion" = "7.3.0"
"Inno Setup: Language" = "English"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process AutoUpdate.exe:3528 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A6 C8 3B D0 68 9B 36 DC 01 AC F9 61 69 5A F7 8D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 46 00 00 00 01 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process LiveUpdate.exe:2880 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 EB 9B EE C1 63 25 E9 C8 E5 D7 36 56 DA C6 49"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\IObit\LiveUpdate]
"AppPath" = "%Program Files%\IObit\LiveUpdate\LiveUpdate.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Surfing Protection]
"SPUpdate.exe" = "Advanced SystemCare 7 SP Update"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process LiveUpdate.exe:1196 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 94 43 7B A2 3A 36 05 3A DF E0 3D 9E 05 E3 74"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\IObit\LiveUpdate]
"AppPath" = "%Program Files%\IObit\LiveUpdate\LiveUpdate.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\System\CurrentControlSet\Services\LiveUpdateSvc]
"Description" = "LiveUpdate"

The process LiveUpdate.exe:1088 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 9E A1 7D DF 03 D1 F3 F3 3E EA A2 59 A3 0A 10"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\LocalService\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process LiveUpdate.exe:228 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 74 E6 9F DD E8 4F 9A 4E 3F 4E 07 70 E9 33 EA"

The process homepage.exe:3284 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF D3 D3 BB E0 49 06 06 BC AE 9D 21 4B 18 D7 BE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process Display.exe:2904 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 88 B2 9A 56 4A 09 AA F7 9F AE 09 E7 43 DF A7"

[HKLM\SOFTWARE\IObit\Advanced SystemCare 7]
"HealthLevel" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\IObit\Advanced SystemCare 7]
"LastWrite" = "41775.7062985764"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

The process Install_PintoStartMenu.exe:2348 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 49 E1 1B AC 41 02 FF 8E CC B7 81 1C 46 29 38"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{2803063F-4B8D-4DC6-8874-D1802487FE2D} {000214E8-0000-0000-C000-000000000046} 0x401" = "01 00 00 00 31 00 38 00 76 4C 4C B4 0E 71 CF 01"
"{A6FF0E3A-8437-482C-8E04-4F9E15C57538} {000214E8-0000-0000-C000-000000000046} 0x401" = "01 00 00 00 7C 6C 9C 7C D6 26 26 B4 0E 71 CF 01"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

The process ASCSetup.exe:3736 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 DF F4 1B 57 A6 07 3C 17 CC 34 4B 2A D3 23 E9"

The process RealTimeProtector.exe:348 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 66 2C 72 4F E4 D9 6E A2 A9 E0 7A D1 FF DD BA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process RealTimeProtector.exe:1636 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 73 87 9C 73 50 F8 8A C0 51 12 C1 F8 41 E2 EA"

[HKLM\SOFTWARE\IObit\RealTimeProtector]
"InstallLocation" = "%Program Files%\IObit\Advanced SystemCare 7\"

The process RealTimeProtector.exe:4036 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 9F 42 2E 27 30 13 01 2A EC 29 D1 F0 F1 0D 75"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process IEXPLORE.EXE:2456 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_20"

[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Type" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Type" = "3"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_27"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Type" = "3"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}\iexplore]
"Flags" = "0"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "IEXPLORE.EXE"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Count" = "28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_04"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}]
"(Default)" = "Java Plug-in 1.3.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Time" = "DE 07 05 00 05 00 10 00 0D 00 39 00 00 00 BF 01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_17"

[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051620140517]
"CacheLimit" = "8192"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\JavaPlugin.160_18\CLSID]
"(Default)" = "{5852F5ED-8BF4-11D4-A245-0080C6F74284}"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"LoadTime" = "570"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_04"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}\iexplore]
"Flags" = "0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"LoadTime" = "7"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Count" = "28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Count" = "25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}\iexplore]
"Time" = "DE 07 05 00 05 00 10 00 0D 00 39 00 00 00 EE 01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_14"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051620140517]
"CacheOptions" = "11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}\iexplore]
"Type" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_03"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}\iexplore]
"LoadTime" = "392"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Count" = "16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051620140517]
"CacheRepair" = "0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Time" = "DE 07 05 00 05 00 10 00 0D 00 39 00 02 00 48 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Type" = "3"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051620140517]
"CachePrefix" = ":2014051620140517:"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}\iexplore]
"Type" = "3"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1236512046"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Time" = "DE 07 05 00 05 00 10 00 0D 00 39 00 00 00 75 03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051620140517]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014051620140517"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}\iexplore]
"Count" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}\iexplore]
"Time" = "DE 07 05 00 05 00 10 00 0D 00 39 00 00 00 90 01"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 0E E4 6D DF F5 06 5F 77 E7 2D 8D 62 38 FB 3F"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}\iexplore]
"LoadTime" = "42"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_19"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"LoadTime" = "29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}\iexplore]
"Count" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_08"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Time" = "DE 07 05 00 05 00 10 00 0D 00 39 00 04 00 13 01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_09"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The program deletes the following registry key(s):

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\JavaPlugin.160_18\CLSID]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\JavaPlugin.160_18]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}]

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process IEXPLORE.EXE:2500 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore]
"Type" = "4"
"Count" = "29"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"CompatibilityFlags" = "0"
"FullScreen" = "no"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links]
"Order" = "08 00 00 00 02 00 00 00 42 01 00 00 01 00 00 00"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"DisplayName" = ""

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"Path" = "%Documents and Settings%\%current user%\Favorites\Links\Web Slice Gallery.url"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"FeedUrl" = "https://ieonline.microsoft.com/#ieslice"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Type" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"ErrorState" = "0"
"FeedUrl" = "http://go.microsoft.com/fwlink/?LinkId=121315"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore]
"Time" = "DE 07 05 00 05 00 10 00 0D 00 39 00 00 00 39 00"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"DisplayMask" = "0"

[HKCU\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}]
"Enable" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"DisplayName" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Count" = "29"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"Handler" = "{B0FA7D7C-7195-4F03-B03E-9DC1C9EBC394}"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"ErrorState" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Window_Placement" = "2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"Expiration" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}]
"VerCache" = "54 78 3F AD 0E 71 CF 01 00 1D CD 98 0F 2E CF 01"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"DisplayMask" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]
"SecuritySafe" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
"VerCache" = "E2 BC 72 B1 0E 71 CF 01 3C 1F 75 B1 0E 71 CF 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Time" = "DE 07 05 00 05 00 10 00 0D 00 39 00 00 00 48 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 4F 4E 1E 0D 1A A2 D1 32 CF C6 34 A2 61 F2 5A"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"Handler" = "{B0FA7D7C-7195-4F03-B03E-9DC1C9EBC394}"
"Path" = "%Documents and Settings%\%current user%\Favorites\Links\Suggested Sites.url"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKCU\Software\Microsoft\Internet Explorer\Recovery\Active]
"{F29AF83C-DD01-11E3-81D1-0050563EC483}" = "0"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"Expiration" = "0"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The program deletes the following registry key(s):

[HKCU\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}]
[HKCU\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}]
[HKCU\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000]
[HKCU\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile]

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"Expiration"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"Expiration"

The process PluginInstall.exe:2072 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 0E 4E 96 E1 F4 9C 7C 95 CA 5D 03 A0 8E EB B0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"regsvr32.exe" = "Microsoft(C) Register Server"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\IObit\Advanced SystemCare 7]
"InstallPath" = "%Program Files%\IObit\Surfing Protection"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files%\IObit\Surfing Protection\BrowerProtect\np_Asc_plugin.tmp437,"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process PerformUpdate.exe:3408 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 97 7F 37 B6 FB 50 1A 05 34 99 97 F6 60 4A 5F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Reinforce.exe:3288 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 02 26 E1 24 3A A7 B5 92 A9 3E 2D 3E 7A C4 63"

[HKLM\System\CurrentControlSet\Control\Lsa]
"limitblankpassworduse" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\System\CurrentControlSet\Services\lanmanserver\parameters]
"AutoShareServer" = "0"

[HKLM\System\CurrentControlSet\Control\Terminal Server]
"fAllowToGetHelp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Services\lanmanserver\parameters]
"AutoShareWks" = "0"

[HKLM\System\CurrentControlSet\Control\Terminal Server]
"fDenyTSConnections" = "1"

The following service is disabled:

[HKLM\System\CurrentControlSet\Services\TlntSvr]
"Start" = "4"

The following service will be launched automatically at system boot up:

[HKLM\System\CurrentControlSet\Services\SharedAccess]
"Start" = "2"

The following service is disabled:

[HKLM\System\CurrentControlSet\Services\RemoteRegistry]
"Start" = "4"

The process ASCUpgrade.exe:3844 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E E2 5B 46 B1 9E 83 E8 58 01 18 00 E5 07 70 89"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process DiskDefrag.exe:1524 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 08 67 2F 06 AD AD 9F 7D 70 9D CD 61 1E 86 5F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process UpgradeTip.exe:3208 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 F3 EF BD 5D 93 25 CC A4 FE 5E B2 22 D2 06 F4"

The process iobitappsToolbar-stub-1.exe:3908 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 AD 5A 5B 5D 9D D9 AA 8C EA EE 2A 07 8C A4 8D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3F 00 00 00 01 00 00 00 00 00 00 00"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The program disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISSetup"

The process sc.exe:604 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 F9 86 C4 5F DE 7E 0A EF 82 C6 45 98 F5 BE 87"

The process sc.exe:3532 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 4E 04 D1 2F 5E AB 3D 3B D9 46 E1 BC BE 74 0E"

The process SearchSettings.exe:2724 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"OSDFileURL" = "file:///C:/Program Files/Common Files/Spigot/Search Settings/yandex_ie.xml"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"DisplayName" = "Яндекс"

[HKCU\Software\Microsoft\Internet Explorer\User Preferences]
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977" = "01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"FaviconURL" = "http://www.yandex.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"URL" = "http://yandex.ru/yandsearch?clid=1782905&text={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"ShowSearchSuggestions" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 C7 8C 27 94 91 06 27 0D 1B A3 30 B4 43 08 C9"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"ShowSearchSuggestionsInAddressGlobal" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"FaviconPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}.ico"

[HKCU\Software\AppDataLow\Software\Search Settings]
"FFinstallSEFailed" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"SuggestionsURL_JSON" = "http://suggest.yandex.com/suggest-ff.cgi?part={searchTerms}"

[HKCU\Software\AppDataLow\Software\Search Settings]
"GCprotected" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\AppDataLow\Software\Search Settings]
"FF_InstallNTP"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\AppDataLow\Software\Search Settings]
"searchProtection"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

The process AutoCare.exe:2320 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B 1F 3B 0E 6F 26 43 F1 DE A2 F4 23 49 4B 8F 17"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process AutoCare.exe:340 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 28 A2 98 EC 10 4F 8B E0 7E E6 E0 DC C7 D2 A9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process SlickSavingsSet:3300 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"URLInfoAbout" = "http://www.spigot.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\Approved Extensions]
"{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}" = "51 66 7A 6C 4C 1D 3B 1B 5B C7 BA 29 EF 9C A8 04"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"DisplayIcon" = "%Documents and Settings%\%current user%\Application Data\Slick Savings\Coupons.dll,0"
"InstallLocation" = "%Documents and Settings%\%current user%\Application Data\Slick Savings\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"VersionMajor" = "1"
"DisplayVersion" = "1.3"

[HKCU\Software\AppDataLow\Software\Slick Savings]
"crx_path" = "%Documents and Settings%\%current user%\Application Data\Slick Savings\coupons_2.4.crx"
"ISN" = "099A1C56DBB74D56827A1EC155F3CC87"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"InstallDir" = "%Documents and Settings%\%current user%\Application Data\Slick Savings\"

[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"VersionMinor" = "0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAE9BEC8-4723-4347-AFC6-25EE3326BA5B}]
"AppName" = "CouponsHelper.exe"

[HKCU\Software\AppDataLow\Software\Slick Savings]
"xpi_path" = "%Documents and Settings%\%current user%\Application Data\Slick Savings\coupons_2.9.xpi"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"DisplayName" = "Slick Savings"

[HKCU\Software\AppDataLow\Software\Slick Savings]
"cnid" = "114576"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"NoModify" = "1"

[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 0C D1 58 39 75 BC 8D EE DE B0 8E C9 D9 B7 85"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAE9BEC8-4723-4347-AFC6-25EE3326BA5B}]
"AppPath" = "%Documents and Settings%\%current user%\Application Data\Slick Savings"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"UninstallString" = "%Documents and Settings%\%current user%\Application Data\Slick Savings\uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Application Data\Slick Savings\Coupons64.dll"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAE9BEC8-4723-4347-AFC6-25EE3326BA5B}]
"Policy" = "3"

[HKCU\Software\AppDataLow\Software\Slick Savings]
"SS_Ver" = "1.3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"NoRepair" = "1"

[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\Implemented Categories]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"Publisher" = "Spigot, Inc."

[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]
"(Default)" = "Slick Savings"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]
"NoExplorer" = "1"

"(Default)" = "Slick Savings"

To automatically run itself each time Windows is booted, the program adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Slick Savings" = "%Documents and Settings%\%current user%\Application Data\Slick Savings\CouponsHelper.exe"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Internet Explorer\Approved Extensions]
"{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}"

The process AutoSweep.exe:3644 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 D2 58 E1 E1 F8 92 12 ED 43 1A E4 AD E6 5A 86"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process Regsvr32.exe:2228 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKCR\Interface\{373DBC2E-5D9D-4149-AEED-F21B17BDA1F4}\TypeLib]
"(Default)" = "{F28E68F5-6EA5-491E-B7F7-B2253E644497}"

[HKCR\Interface\{373DBC2E-5D9D-4149-AEED-F21B17BDA1F4}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{CC0A933C-A838-4a12-B05C-821E482F8D21}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ASCComputerMenu.CComExtMenu]
"(Default)" = "CComExtMenu Class"

[HKCR\TypeLib\{F28E68F5-6EA5-491E-B7F7-B2253E644497}\1.0\HELPDIR]
"(Default)" = "%Program Files%\IObit\Advanced SystemCare 7"

[HKCR\Interface\{373DBC2E-5D9D-4149-AEED-F21B17BDA1F4}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{CC0A933C-A838-4a12-B05C-821E482F8D21}]
"(Default)" = "CComExtMenu Class"

[HKCR\ASCComputerMenu.CComExtMenu.1]
"(Default)" = "CComExtMenu Class"

[HKCR\CLSID\{CC0A933C-A838-4a12-B05C-821E482F8D21}\VersionIndependentProgID]
"(Default)" = "ASCComputerMenu.CComExtMenu"

[HKCR\Interface\{373DBC2E-5D9D-4149-AEED-F21B17BDA1F4}]
"(Default)" = "ICComExtMenu"

[HKCR\TypeLib\{F28E68F5-6EA5-491E-B7F7-B2253E644497}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\CLSID\{CC0A933C-A838-4a12-B05C-821E482F8D21}\TypeLib]
"(Default)" = "{F28E68F5-6EA5-491e-B7F7-B2253E644497}"

[HKCR\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellEx\ContextMenuHandlers\Advanced SystemCare]
"(Default)" = "{CC0A933C-A838-4a12-B05C-821E482F8D21}"

[HKCR\CLSID\{CC0A933C-A838-4a12-B05C-821E482F8D21}\InprocServer32]
"(Default)" = "%Program Files%\IObit\Advanced SystemCare 7\ASCComputerMenu.dll"

[HKCR\TypeLib\{F28E68F5-6EA5-491E-B7F7-B2253E644497}\1.0\0\win32]
"(Default)" = "%Program Files%\IObit\Advanced SystemCare 7\ASCComputerMenu.dll"

[HKCR\CLSID\{CC0A933C-A838-4a12-B05C-821E482F8D21}\ProgID]
"(Default)" = "ASCComputerMenu.CComExtMenu.1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 91 9F 91 1A 13 8F 21 CA E1 5B 6E FA 93 CD EF"

[HKCR\ASCComputerMenu.CComExtMenu.1\CLSID]
"(Default)" = "{CC0A933C-A838-4a12-B05C-821E482F8D21}"

[HKCR\ASCComputerMenu.CComExtMenu\CLSID]
"(Default)" = "{CC0A933C-A838-4a12-B05C-821E482F8D21}"

[HKCR\TypeLib\{F28E68F5-6EA5-491E-B7F7-B2253E644497}\1.0]
"(Default)" = "ASCComputerMenu 1.0 Type Library"

[HKCR\Interface\{373DBC2E-5D9D-4149-AEED-F21B17BDA1F4}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\ASCComputerMenu.CComExtMenu\CurVer]
"(Default)" = "ASCComputerMenu.CComExtMenu.1"

The process Regsvr32.exe:1324 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKCR\Interface\{BA935377-E17C-4475-B1BF-DE3110613A99}\TypeLib]
"(Default)" = "{60AD0991-ECD4-49DC-B170-8B7E7C60F51B}"

[HKCR\CLSID\{2803063F-4B8D-4dc6-8874-D1802487FE2D}\InprocServer32]
"(Default)" = "%Program Files%\IObit\Advanced SystemCare 7\ASCExtMenu.dll"
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{2803063F-4B8D-4dc6-8874-D1802487FE2D}\ProgID]
"(Default)" = "ASCExtMenu.CExtMenu.1"

[HKCR\Interface\{BA935377-E17C-4475-B1BF-DE3110613A99}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{BA935377-E17C-4475-B1BF-DE3110613A99}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{BA935377-E17C-4475-B1BF-DE3110613A99}\TypeLib]
"Version" = "1.0"

[HKCR\ASCExtMenu.CExtMenu.1]
"(Default)" = "CExtMenu Class"

[HKCR\*\shellex\ContextMenuHandlers\Advanced SystemCare]
"(Default)" = "{2803063F-4B8D-4dc6-8874-D1802487FE2D}"

[HKCR\CLSID\{2803063F-4B8D-4dc6-8874-D1802487FE2D}]
"(Default)" = "CExtMenu Class"

[HKCR\CLSID\{2803063F-4B8D-4dc6-8874-D1802487FE2D}\VersionIndependentProgID]
"(Default)" = "ASCExtMenu.CExtMenu"

[HKCR\ASCExtMenu.CExtMenu\CurVer]
"(Default)" = "ASCExtMenu.CExtMenu.1"

[HKCR\TypeLib\{60AD0991-ECD4-49DC-B170-8B7E7C60F51B}\1.0\HELPDIR]
"(Default)" = "%Program Files%\IObit\Advanced SystemCare 7"

[HKCR\lnkfile\shellex\ContextMenuHandlers\Advanced SystemCare]
"(Default)" = "{2803063F-4B8D-4dc6-8874-D1802487FE2D}"

[HKCR\Interface\{BA935377-E17C-4475-B1BF-DE3110613A99}]
"(Default)" = "ICExtMenu"

[HKCR\ASCExtMenu.CExtMenu\CLSID]
"(Default)" = "{2803063F-4B8D-4dc6-8874-D1802487FE2D}"

[HKCR\TypeLib\{60AD0991-ECD4-49DC-B170-8B7E7C60F51B}\1.0]
"(Default)" = "ASCExtMenu 1.0 Type Library"

[HKCR\CLSID\{2803063F-4B8D-4dc6-8874-D1802487FE2D}\TypeLib]
"(Default)" = "{60AD0991-ECD4-49dc-B170-8B7E7C60F51B}"

[HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\Advanced SystemCare]
"(Default)" = "{2803063F-4B8D-4dc6-8874-D1802487FE2D}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 87 04 A5 92 57 E0 8D 5B 37 CE 56 20 6A C2 DD"

[HKCR\Drive\shellex\ContextMenuHandlers\Advanced SystemCare]
"(Default)" = "{2803063F-4B8D-4dc6-8874-D1802487FE2D}"

[HKCR\Directory\shellex\ContextMenuHandlers\Advanced SystemCare]
"(Default)" = "{2803063F-4B8D-4dc6-8874-D1802487FE2D}"

[HKCR\ASCExtMenu.CExtMenu]
"(Default)" = "CExtMenu Class"

[HKCR\ASCExtMenu.CExtMenu.1\CLSID]
"(Default)" = "{2803063F-4B8D-4dc6-8874-D1802487FE2D}"

[HKCR\TypeLib\{60AD0991-ECD4-49DC-B170-8B7E7C60F51B}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{60AD0991-ECD4-49DC-B170-8B7E7C60F51B}\1.0\0\win32]
"(Default)" = "%Program Files%\IObit\Advanced SystemCare 7\ASCExtMenu.dll"

The process ToolbarAcceptRate.exe:3900 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A 8E D5 50 4D 68 20 32 39 C7 0B F6 61 AE 68 85"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 01 00 00 00 00 00 00 00"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Asc.exe:3360 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 23 9B 00 26 54 C1 4B 1C 62 A0 6F 8B 61 69 B4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"AutoUpdate.exe" = "Advanced SystemCare 7 Autoupdate"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"PerformUpdate.exe" = "Advanced SystemCare PerformUpdate"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process ApplicationUpdater.exe:3388 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 2B 6A 3A A1 98 BE 98 F8 5A 04 E6 7C 2F B5 C8"

[HKLM\SOFTWARE\Application Updater]
"retryAUS" = "0"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Application Updater]
"ping_ts" = "1400248668"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"
"Cookies" = "%Documents and Settings%\LocalService\Cookies"
"AppData" = "%System%\config\systemprofile\Application Data"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"

[HKLM\SOFTWARE\Application Updater\Subscriptions\58]
"kitVer"
"kitPath"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKLM\SOFTWARE\Application Updater\Subscriptions\58]
"kitUrl"

The process verclsid.exe:2532 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 99 C9 4A 30 C0 D0 87 51 30 80 2E 36 70 3F C9"

The process verclsid.exe:2520 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 1B 0D 18 7F 39 AF 6D 9E 8F A4 54 6A 18 D8 04"

The process IObitUninstaller.exe:3116 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\IObit Uninstaller]
"Install_PintoStartMenu.exe" = "Install_PintoStartMenu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObitUninstall]
"InstallDate" = "20140516"
"UninstallString" = "%Program Files%\IObit\IObit Uninstaller\UninstallDisplay.exe uninstall_start"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObitUninstall]
"DisplayVersion" = "3.2.10.2466"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}]
"(Default)" = "IObit Uninstaller"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObitUninstall]
"Publisher" = "IObit"

[HKCR\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\DefaultIcon]
"(Default)" = "%Program Files%\IObit\IObit Uninstaller\IObitUninstaler.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\Shell\Open\command]
"(Default)" = "%Program Files%\IObit\IObit Uninstaller\IObitUninstaler.exe control_statistics"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\IObit Uninstaller]
"UninstallPromote.exe" = "UninstallPromote"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObitUninstall]
"DisplayIcon" = "%Program Files%\IObit\IObit Uninstaller\IObitUninstaler.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 82 30 37 BD A9 29 C5 4B FA 36 CD D3 8F 8A 10"

[HKCR\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}]
"{305ca226-d286-468e-b848-2b2e8e697b74} 2" = "8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCR\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}]
"InfoTip" = "Uninstall/Remove programs, clean browser plugins"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObitUninstall]
"DisplayName" = "IObit Uninstaller"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}]
"(Default)" = "IObit Uninstaller"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObitUninstall]
"InstallLocation" = "%Program Files%\IObit\IObit Uninstaller\IObitUninstaler.exe"

[HKLM\SOFTWARE\IObit\Uninstaller 3]
"UninstallerFree" = "%Program Files%\IObit\IObit Uninstaller"

[HKCR\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\ShellFolder]
"Attributes" = "48"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process ASCInit.exe:1692 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\DefragPath]
"(Default)" = "%Program Files%\IObit\Advanced SystemCare 7\DiskDefrag.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\IObit\Advanced SystemCare 7]
"IdleCare" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"UninstallPromote.exe" = "UninstallPromote"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F C9 E9 F5 82 70 DA 91 DC 6C 38 7A 3D 0A 7D 81"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\IObit\Advanced SystemCare 7]
"isDefragMemory" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the program adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 7" = "%Program Files%\IObit\Advanced SystemCare 7\ASCTray.exe /Auto"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The process SPSetup.tmp:208 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Surfing Protection]
"PluginInstall.exe" = "Surfing Protection"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Surfing Protection_is1]
"DisplayVersion" = "1.0"
"Inno Setup: Language" = "English"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Surfing Protection_is1]
"URLUpdateInfo" = "http://www.iobit.com/"
"DisplayName" = "Surfing Protection"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Surfing Protection_is1]
"Inno Setup: Icon Group" = "Surfing Protection"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Surfing Protection_is1]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Surfing Protection_is1]
"MajorVersion" = "1"
"UninstallString" = "%Program Files%\IObit\Surfing Protection\unins000.exe"
"Inno Setup: Setup Version" = "5.5.4 (u)"
"InstallLocation" = "%Program Files%\IObit\Surfing Protection\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Surfing Protection_is1]
"Inno Setup: User" = "%CurrentUserName%"
"HelpLink" = "http://www.iobit.com/"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Surfing Protection_is1]
"URLInfoAbout" = "http://www.iobit.com/"
"MinorVersion" = "0"
"Publisher" = "IObit"

"NoRepair" = "1"
"Inno Setup: App Path" = "%Program Files%\IObit\Surfing Protection"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 4D 2E 82 48 7F DD 5E 69 93 FA F0 14 F4 4C 96"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Surfing Protection_is1]
"QuietUninstallString" = "%Program Files%\IObit\Surfing Protection\unins000.exe /SILENT"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Surfing Protection_is1]
"InstallDate" = "20140516"
"DisplayIcon" = "%Program Files%\IObit\Surfing Protection\PluginInstall.exe"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process ASCTray.exe:3276 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F 54 92 AB A6 14 4F 92 5B 89 95 24 11 33 18 4F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"Asc.exe" = "Advanced SystemCare 7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process regsvr32.exe:2284 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 09 5F C4 B0 F4 17 55 1E 14 59 CA 33 45 E0 D0"

[HKCR\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
"(Default)" = "ExplorerWnd Helper"

[HKCR\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32]
"(Default)" = "C:\PROGRA~1\IObit\IOBITU~1\UNINST~1.DLL"

[HKCR\UninstallExplorer32.ExplorerBtn]
"(Default)" = "ExplorerWnd Helper"

[HKCR\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\ProgID]
"(Default)" = "UninstallExplorer32.ExplorerBtn"

[HKCR\UninstallExplorer32.ExplorerBtn\Clsid]
"(Default)" = "{10921475-03CE-4E04-90CE-E2E7EF20C814}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
"NewTime" = "2014-05-16 16:56:56:635"

"(Default)" = "ExplorerWnd Helper"

"NoInternetExplorer" = "1"

The process regsvr32.exe:352 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 6C DD 93 4E 26 EB 3D E4 AF DD 25 19 AF 23 05"

[HKCR\ASCPlugin_Protection.TASCBrowserProtection]
"(Default)" = "Advanced SystemCare Browser Protection"

[HKCR\CLSID\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}]
"(Default)" = "Advanced SystemCare Browser Protection"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}\InprocServer32]
"(Default)" = "C:\PROGRA~1\IObit\SURFIN~1\BROWER~1\ASCPLU~1.DLL"
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}\ProgID]
"(Default)" = "ASCPlugin_Protection.TASCBrowserProtection"

[HKCR\ASCPlugin_Protection.TASCBrowserProtection\Clsid]
"(Default)" = "{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}]
"NoExplorer" = "1"

"(Default)" = ""

The process regsvr32.exe:2272 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 30 8C D0 E2 32 28 1B 04 E2 74 63 3C 7A 8A 56"

[HKCR\CLSID\{A6FF0E3A-8437-482C-8E04-4F9E15C57538}\InprocServer32]
"(Default)" = "%Program Files%\IObit\IObit Uninstaller\UninstallMenuRight32.dll"

[HKCR\Folder\shellex\ContextMenuHandlers\UnLockerMenu]
"(Default)" = "{A6FF0E3A-8437-482C-8E04-4F9E15C57538}"

[HKCR\TypeLib\{F844CB30-D8B9-4AA5-8B0D-B2229285B4AE}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\*\shellex\ContextMenuHandlers\UnLockerMenu]
"(Default)" = "{A6FF0E3A-8437-482C-8E04-4F9E15C57538}"

[HKCR\Directory\shellex\ContextMenuHandlers\UnLockerMenu]
"(Default)" = "{A6FF0E3A-8437-482C-8E04-4F9E15C57538}"

[HKCR\CLSID\{A6FF0E3A-8437-482C-8E04-4F9E15C57538}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\AppID\PfShellExtension.DLL]
"AppID" = "{59A55EF0-525F-4276-AB62-8F7E5F230399}"

[HKCR\TypeLib\{F844CB30-D8B9-4AA5-8B0D-B2229285B4AE}\1.0]
"(Default)" = "PfShellExtension 1.0 Type Library"

[HKCR\TypeLib\{F844CB30-D8B9-4AA5-8B0D-B2229285B4AE}\1.0\0\win32]
"(Default)" = "%Program Files%\IObit\IObit Uninstaller\UninstallMenuRight32.dll"

[HKCR\CLSID\{A6FF0E3A-8437-482C-8E04-4F9E15C57538}]
"(Default)" = "UnLockerMenu Class"

[HKCR\AppID\{59A55EF0-525F-4276-AB62-8F7E5F230399}]
"(Default)" = "PfShellExtension"

[HKCR\TypeLib\{F844CB30-D8B9-4AA5-8B0D-B2229285B4AE}\1.0\HELPDIR]
"(Default)" = "%Program Files%\IObit\IObit Uninstaller"

[HKCR\lnkfile\shellex\ContextMenuHandlers\UnLockerMenu]
"(Default)" = "{A6FF0E3A-8437-482C-8E04-4F9E15C57538}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{A6FF0E3A-8437-482C-8E04-4F9E15C57538}" = "UnLockerMenu"

The process SPSetup.exe:232 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 2D C8 79 56 41 B4 2E 19 1C 9D D5 11 DC 47 83"

The process MonitorDisk.exe:1932 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 03 A4 8D 0E 45 E8 6F B9 B9 2E 3E 40 52 97 9A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process Monitor.exe:3356 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 9B 5B 39 DD 7B 08 0E 26 97 49 0D 27 59 0E 4F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process register.exe:2328 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DE 15 3A 14 57 D2 07 D7 39 CD 54 41 46 7E 1C 16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process Wizard.exe:2280 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC F1 8C 16 3D E5 60 A1 72 C2 BB 60 CF 33 CA 3B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"monitor.exe" = "Advanced SystemCare 7 Monitor"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\IObit\Advanced SystemCare 7]
"HaveShowW" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"Reinforce.exe" = "Security Reinforce"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"ASCTray.exe" = "Advanced SystemCare 7"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process Homepage.exe:2864 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 CF ED 67 91 CB D7 8B 13 2F 6C 45 6C 1A 3C 70"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process UninstallPromote.exe:1336 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 82 BD D2 94 57 99 CF F7 39 BF DB C3 E7 ED 22"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\IObit\Advanced SystemCare 7]
"Version" = "7.3.0.454"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process UninstallPromote.exe:2248 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 40 19 47 91 CD 34 04 EC 5B 78 79 35 48 D3 98"

[HKLM\SOFTWARE\IObit\Uninstaller 3]
"Version" = "3.2.10.2466"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 01 00 00 00 00 00 00 00"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process MsiExec.exe:1400 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA DB A6 12 BB F6 94 47 01 D0 3F 94 5B 36 4B 68"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process MsiExec.exe:2056 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 9E 09 FD C0 A2 3C 0E CD 54 D3 DA 4D E9 91 82"

[HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.yandex.ru/?clid=1782904"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\AppDataLow\Software\Search Settings]
"GCClearExtGCSEFailed" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\AppDataLow\Software\Search Settings]
"GCClearExtGCDEAFailed" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 49 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{03EB0E9C-7A91-4381-A220-9B52B641CDB1}" = ""

[HKCU\Software\AppDataLow\Software\Search Settings]
"GCClearExtGCSAFailed" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"
"{03EB0E9C-7A91-4381-A220-9B52B641CDB1}"

The process SPUpdate.exe:3656 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 4A F2 5B 04 B0 A7 D7 6E F1 3F 8F 1C 5E 11 C9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process %original file name%.exe:2172 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\IObit\Advanced SystemCare 7]
"Wizard.exe" = "Advanced SystemCare Wizard"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\All Users\Application Data\IObit\ASCDownloader]
"ASCSetup.exe" = "Advanced SystemCare 7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 EE B8 E7 85 29 E4 FB 70 3A 87 04 23 87 33 D4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process MSIEXEC.EXE:1324 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 D4 7C 45 CF 8B 66 5D 75 CD 11 5A D6 FC 6F CE"

The process ASCService.exe:2064 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 33 5C 5C 18 28 4B C1 35 30 CA 1A 5C FA 87 27"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "about:blank"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"DisplayName" = "Яндекс"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\LocalService\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"FaviconURL" = "http://www.yandex.com/favicon.ico"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"URL" = "http://yandex.ru/yandsearch?clid=1782905&text={searchTerms}"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

The program deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\User Preferences]

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}]
"Deleted"

The process CouponsHelper.exe:3380 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 A1 0F 33 BD 02 7E 07 DB 2B 61 CD 88 64 77 CC"

[HKLM\SOFTWARE\Google\Chrome\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk]
"Version" = "2.4"
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Slick Savings\coupons.crx"

The program deletes the following value(s) in system registry:

[HKCU\Software\AppDataLow\Software\Slick Savings]
"xpi_path"

The process msfeedssync.exe:2376 makes changes in the system registry.
The program creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 D5 BE D4 F6 96 1D 30 30 50 FC 4A 2A 69 5C 5D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Internet Explorer\Suggested Sites]
"DeletePending" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 47 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Internet Explorer\Suggested Sites]
"UploadDiagInfo" = "1C 5C 00 00 71 17 00 08 00 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The program modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The program deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5 File path
85719979dc3cfe146e12e85378b70c78 c:\Documents and Settings\All Users\Application Data\IObit\ASCDownloader\ASCSetup.exe
0c3d4e504994399707fde7fdcd137e02 c:\Documents and Settings\"%CurrentUserName%"\Application Data\Slick Savings\Coupons.dll
2b371a3d2c24fde1be29f1716752243b c:\Documents and Settings\"%CurrentUserName%"\Application Data\Slick Savings\Coupons64.dll
26aeda19bb5b818f7cb16bc5e3b8d181 c:\Documents and Settings\"%CurrentUserName%"\Application Data\Slick Savings\CouponsHelper.exe
939cbe4644128b5f897751ab7bc81395 c:\Documents and Settings\"%CurrentUserName%"\Application Data\Slick Savings\Uninstall.exe
7f21451ffe0fdb8d1ad34aec92d76da7 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\ASCPlugin_Protect.dll
8425c81e817541c297e6fbcf58bcc2bf c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is-IMU9L.tmp\ToolbarAcceptRate.exe
784766e40a1c94641cba6e2900ebd4b0 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is-IMU9L.tmp\iobitappsToolbar-stub-1.exe
ca6819eb0df239d17015eee9afb0b53d c:\Program Files\Application Updater\ApplicationUpdater.exe
cc2a64f5ad5e86799d8d3183cb9e8a14 c:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
f2e678c2399f817935ef64f79ce2eb8c c:\Program Files\Common Files\Spigot\Search Settings\SearchSettings64.exe
88415ac3d1707fdf44dea40f698632f9 c:\Program Files\Common Files\Spigot\Search Settings\wth182.dll
6709f3e19f168cf7d2ed4c2f1d4e1d68 c:\Program Files\Common Files\Spigot\Search Settings\wthx182.dll
08106df55bd66ed027ff67bdb2a0f4dd c:\Program Files\Common Files\Spigot\SlickSavings\SlickSavingsSetup.exe
d277a344b346423131bfca56ebf7eaa3 c:\Program Files\IObit Apps Toolbar\FF\components\iobitappsToolbarFF.dll
5ce665641a6edd46a8c8f35004c764ff c:\Program Files\IObit Apps Toolbar\IE\9.2\iobitappsToolbarIE.dll
e76e75f79a1390a4745409a57ac5955f c:\Program Files\IObit Apps Toolbar\IE\9.2\iobitappsToolbarIE64.dll
c2d7870998b50582b99624334891488f c:\Program Files\IObit Apps Toolbar\WidgiHelper.exe
e0eb7a942405bb5a0caab5cff2c78d0c c:\Program Files\IObit\Advanced SystemCare 7\ASC.exe
d6828a4b824dfadd5b90192ecb382381 c:\Program Files\IObit\Advanced SystemCare 7\ASCComputerMenu.dll
59ddea10a26c56a6221b22e9aa3e5fe0 c:\Program Files\IObit\Advanced SystemCare 7\ASCComputerMenu_64.dll
6a30a6e6164c1ac03b4f00356ded9607 c:\Program Files\IObit\Advanced SystemCare 7\ASCDownload.exe
7af52522568d596e6312d23030c5ac66 c:\Program Files\IObit\Advanced SystemCare 7\ASCExtMenu.dll
bbeb530834d854ff9e3f9d431a4a43bf c:\Program Files\IObit\Advanced SystemCare 7\ASCExtMenu_64.dll
cc6b26c922b4480fcbdff565c9abfb6f c:\Program Files\IObit\Advanced SystemCare 7\ASCFixer.exe
22b9972eb524057c8cde6168845c579c c:\Program Files\IObit\Advanced SystemCare 7\ASCInit.exe
6c856c581ace1785ce3fc2414e9859a3 c:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
127687f1d171d0820d02851a9fa62525 c:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe
e94d75a9d6e4724075bb6e6cc6fe3dd3 c:\Program Files\IObit\Advanced SystemCare 7\ASCUpgrade.exe
0af747fc23fd2e099afca81b95f7ecfd c:\Program Files\IObit\Advanced SystemCare 7\About.dll
e13e1fc432e031c164b241e38c214949 c:\Program Files\IObit\Advanced SystemCare 7\ActionCenterDownloader.exe
16e87d5e3fea0461698b297e187ad4d9 c:\Program Files\IObit\Advanced SystemCare 7\AndroidChecker.dll
350e1ce270a22cf8d9584d508f0dc850 c:\Program Files\IObit\Advanced SystemCare 7\AutoCare.exe
212be27e48344efd78bf173c5ca27c4a c:\Program Files\IObit\Advanced SystemCare 7\AutoReactivator.exe
e382af1bebeab8ca249e0064e0b2f161 c:\Program Files\IObit\Advanced SystemCare 7\AutoSweep.exe
67cd9833ecfe329a35892321e71e9fe8 c:\Program Files\IObit\Advanced SystemCare 7\AutoUpdate.exe
f5adb51bc6ebf55b052b581fbc23c1e1 c:\Program Files\IObit\Advanced SystemCare 7\CheckDevice.exe
49f4367f0885e9a77210ea9ac5835a16 c:\Program Files\IObit\Advanced SystemCare 7\DelayLoad.exe
66ed963fba998e887c88fe6fca46e2b9 c:\Program Files\IObit\Advanced SystemCare 7\DiskDefrag.exe
f064ca847fc68c9201fb253cd3a46ed8 c:\Program Files\IObit\Advanced SystemCare 7\DiskMap.dll
25e1e369509c1135577b9fd13dc1df00 c:\Program Files\IObit\Advanced SystemCare 7\DiskScan.dll
fbc25ae0ff76fffe0fcc7f4cec5e6489 c:\Program Files\IObit\Advanced SystemCare 7\DiskScan.exe
1f98172c060a5328459a56cb7ecda779 c:\Program Files\IObit\Advanced SystemCare 7\Display.exe
448964c994ff9f6d10f8af64cab0b65f c:\Program Files\IObit\Advanced SystemCare 7\FfSweep.dll
093ce9d2c6e64f23107dfb07da1721b6 c:\Program Files\IObit\Advanced SystemCare 7\Homepage.exe
1c323b5742dee338f95cac152a0dfed9 c:\Program Files\IObit\Advanced SystemCare 7\HomepageSvc.dll
51fe288eba272b15726c226c85ff3c38 c:\Program Files\IObit\Advanced SystemCare 7\IObitLogon.dll
f0d13521b4723fd213ed9cdcb5a50f6e c:\Program Files\IObit\Advanced SystemCare 7\IObitUninstaller.exe
fab944c947e9505cf0a45569f9c452d9 c:\Program Files\IObit\Advanced SystemCare 7\InfoHelp.dll
fa149a9a6dddcc222865077d07dd1c51 c:\Program Files\IObit\Advanced SystemCare 7\LiveUpdate.exe
8e13ca0b48a1298f46f8739b95dbe4bf c:\Program Files\IObit\Advanced SystemCare 7\Monitor.exe
32ae2f1a4ceb3588f50611fd27bfa7e8 c:\Program Files\IObit\Advanced SystemCare 7\MonitorDisk.exe
3eb3b7885dd64fb1e360710790320d22 c:\Program Files\IObit\Advanced SystemCare 7\Nfeatures.exe
95f1c968198a6d17fffc0e76da1c01de c:\Program Files\IObit\Advanced SystemCare 7\NtfsData.dll
e5eb51aca1472c7824076a3ac807611f c:\Program Files\IObit\Advanced SystemCare 7\OFCommon.dll
dfba16f3983b2fb5c9b479b577bcde67 c:\Program Files\IObit\Advanced SystemCare 7\PerformUpdate.exe
6b909f053da40bc61c88e34303acd782 c:\Program Files\IObit\Advanced SystemCare 7\PowerConfig.dll
434a7e8ebe2778c9d63181cfecec9a46 c:\Program Files\IObit\Advanced SystemCare 7\ProTip.exe
716a1bc93ba66c3eec98634b14c47ce9 c:\Program Files\IObit\Advanced SystemCare 7\ProductStatistics.dll
1157313be0c81895f49b1d25ce77826a c:\Program Files\IObit\Advanced SystemCare 7\ProgramDeactivator.exe
5c74ad321fdd45d4562f6f67d9a75c84 c:\Program Files\IObit\Advanced SystemCare 7\ProjectOnUninstall.exe
d3029f71e7f453c833d28aa8cd08d14a c:\Program Files\IObit\Advanced SystemCare 7\QuickSettings.exe
0c2f9b66d80ee02a51d0cb15e2f61864 c:\Program Files\IObit\Advanced SystemCare 7\RealTimeProtector.exe
be6dab0c8ccb34af60fcc907ef371346 c:\Program Files\IObit\Advanced SystemCare 7\Register.exe
9efc08ce346349c6bfa3b25a63ff286a c:\Program Files\IObit\Advanced SystemCare 7\Reinforce.exe
d2f3674fb4bcb1244e6028755b90ac27 c:\Program Files\IObit\Advanced SystemCare 7\Report.exe
3b74149c570ad751b377132d7c28411f c:\Program Files\IObit\Advanced SystemCare 7\RescueCenter.exe
3ef183cd81f9792303812714d883fbf6 c:\Program Files\IObit\Advanced SystemCare 7\SPInit.exe
28d0247314629c67ab7f6aa2d99e1dae c:\Program Files\IObit\Advanced SystemCare 7\SPSetup.exe
4eef846a3c6e5f6cc04fa2482449d4ee c:\Program Files\IObit\Advanced SystemCare 7\SPUrlScanner.dll
c6cabbfdb1b4e7c95394a2da0b2a0c51 c:\Program Files\IObit\Advanced SystemCare 7\Scan.dll
13d946d32a1e816341d7fa3d48f5b468 c:\Program Files\IObit\Advanced SystemCare 7\SendBugReport.exe
7b44d4796e929393ec9b330ad52dff4f c:\Program Files\IObit\Advanced SystemCare 7\SendBugReportNew.exe
21db3a2fea6e43ea830925331778a980 c:\Program Files\IObit\Advanced SystemCare 7\Sua11_DiskExplorer.exe
743e8c8e1a56b6065db83bd3ee2a7901 c:\Program Files\IObit\Advanced SystemCare 7\Suc11_RegistryCleaner.exe
85cc4370fba31c5b98719a791d63603c c:\Program Files\IObit\Advanced SystemCare 7\Suc12_DiskCleaner.exe
d68b87b1f80e8c15c969b88f7bf08d4e c:\Program Files\IObit\Advanced SystemCare 7\Suo10_SmartRAM.exe
b7600792b16ca0d6811d4297be8bdda5 c:\Program Files\IObit\Advanced SystemCare 7\Suo11_InternetBooster.exe
fb095d321d05f7b9999829650b059fc6 c:\Program Files\IObit\Advanced SystemCare 7\Suo12_StartupManager.exe
5ae7353bcd47d0c04a377844a9c9ac6f c:\Program Files\IObit\Advanced SystemCare 7\Sur13_WinFix.exe
9100ea060ba3d3eec330ce791e9baca9 c:\Program Files\IObit\Advanced SystemCare 7\TbAppCaller.exe
88b7f951a2dd14bff31ad74b4e624e98 c:\Program Files\IObit\Advanced SystemCare 7\UninstallPromote.exe
a2d598483c3d21abc0b41c56704bb6c7 c:\Program Files\IObit\Advanced SystemCare 7\UpgradeTip.exe
e270e37a3eed95f1912f9fba1466e93c c:\Program Files\IObit\Advanced SystemCare 7\Wizard.exe
8036181ae2db34625238ff6ba05dd890 c:\Program Files\IObit\Advanced SystemCare 7\cxLibraryD12.bpl
12d1de9fb22f9150dbd5c5bd7d67a606 c:\Program Files\IObit\Advanced SystemCare 7\datastate.dll
2a99f3410342f2b058109cfeedf45f64 c:\Program Files\IObit\Advanced SystemCare 7\drivers\win7_amd64\RegistryDefragBootTime.exe
d2f7c7dd5828ad6aa1bd74a336833e2a c:\Program Files\IObit\Advanced SystemCare 7\drivers\win7_x86\RegistryDefragBootTime.exe
78282f48b994eb1a2e9f942df0749052 c:\Program Files\IObit\Advanced SystemCare 7\drivers\wlh_amd64\RegistryDefragBootTime.exe
9689b85c7e3c33f6c7788bc72c31c8b4 c:\Program Files\IObit\Advanced SystemCare 7\drivers\wlh_x86\RegistryDefragBootTime.exe
2ba0e72eeb74142dee05d80392dd21ab c:\Program Files\IObit\Advanced SystemCare 7\drivers\wnet_amd64\RegistryDefragBootTime.exe
cb89633c0495d54654fc5a6441eb3894 c:\Program Files\IObit\Advanced SystemCare 7\drivers\wnet_x86\RegistryDefragBootTime.exe
16be2d88119757e7b32e12901e35e58a c:\Program Files\IObit\Advanced SystemCare 7\drivers\wxp_amd64\RegistryDefragBootTime.exe
30e954bc3c98e9419dea06f42d861010 c:\Program Files\IObit\Advanced SystemCare 7\drivers\wxp_x86\RegistryDefragBootTime.exe
adc4f125408a4997d1538843c41e456e c:\Program Files\IObit\Advanced SystemCare 7\dxBarD12.bpl
004c03a0f99e4b66f54339260b9f1624 c:\Program Files\IObit\Advanced SystemCare 7\dxComnD12.bpl
73999b816158f8ca5aa723ae0008b1fb c:\Program Files\IObit\Advanced SystemCare 7\dxCoreD12.bpl
f9baff7f96ae92d8da1ae029e18d488d c:\Program Files\IObit\Advanced SystemCare 7\dxDockingD12.bpl
51d78c7811315c7779e8c2f460b53ea2 c:\Program Files\IObit\Advanced SystemCare 7\dxGDIPlusD12.bpl
9664338d853d1fbf7d643f5bf3249ff6 c:\Program Files\IObit\Advanced SystemCare 7\dxSkinOffice2007BlueD12.bpl
a62cd8cab728bca40085eae027f06e4c c:\Program Files\IObit\Advanced SystemCare 7\dxSkinsCoreD12.bpl
710e7d1c2b3b266184a08d833edb0d8c c:\Program Files\IObit\Advanced SystemCare 7\dxThemeD12.bpl
f58732600fc92413a8b2451fec5b2fc9 c:\Program Files\IObit\Advanced SystemCare 7\madbasic_.bpl
8838b1d35da190061890a8fed8596eae c:\Program Files\IObit\Advanced SystemCare 7\maddisAsm_.bpl
114cf6c8f5897162dfc00a7c920ddf16 c:\Program Files\IObit\Advanced SystemCare 7\madexcept_.bpl
ddb9bcff8cbf73638a15579fec223229 c:\Program Files\IObit\Advanced SystemCare 7\rtl120.bpl
18f7cc65b240ab651bbe290023b686ff c:\Program Files\IObit\Advanced SystemCare 7\sdcore.dll
beb0782c9e1cb10dfca13049d741713d c:\Program Files\IObit\Advanced SystemCare 7\sdlib.dll
bb1522068eb80daf4925d68881ab80e0 c:\Program Files\IObit\Advanced SystemCare 7\sqlite3.dll
c76b8e74f900e083712adc5b597a05c3 c:\Program Files\IObit\Advanced SystemCare 7\taskmgr.dll
37e24a946c409b7a0f7be1fbc02218ed c:\Program Files\IObit\Advanced SystemCare 7\unins000.exe
8290e04f8a4d9594bfb53d520b677b8a c:\Program Files\IObit\Advanced SystemCare 7\vcl120.bpl
bd4254b0c5bfb133b032885cdc1f32ee c:\Program Files\IObit\Advanced SystemCare 7\vclx120.bpl
0de5ba4cefb5bc123c45b974a182557d c:\Program Files\IObit\Advanced SystemCare 7\webres.dll
f0d13521b4723fd213ed9cdcb5a50f6e c:\Program Files\IObit\IObit Uninstaller\IObitUninstaler.exe
c098b4ea64d8c957486acd736031435c c:\Program Files\IObit\IObit Uninstaller\Install_PintoStartMenu.exe
716a1bc93ba66c3eec98634b14c47ce9 c:\Program Files\IObit\IObit Uninstaller\ProductStatistics.dll
78148dc7ba8c46551929ff7e47fa4133 c:\Program Files\IObit\IObit Uninstaller\Uninstaler_SkipUac.exe
5d4acf36cf6b3e2453c2e39216bd173b c:\Program Files\IObit\IObit Uninstaller\UninstallDisplay.exe
100c1eeb3eb296ddc9c55393330b5baf c:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll
023df3020b31bd97658d16a361031fad c:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll
88b7f951a2dd14bff31ad74b4e624e98 c:\Program Files\IObit\IObit Uninstaller\UninstallPromote.exe
31c364e11f4f37160af8716861bb5039 c:\Program Files\IObit\IObit Uninstaller\datastate.dll
f58732600fc92413a8b2451fec5b2fc9 c:\Program Files\IObit\IObit Uninstaller\madbasic_.bpl
8838b1d35da190061890a8fed8596eae c:\Program Files\IObit\IObit Uninstaller\maddisAsm_.bpl
114cf6c8f5897162dfc00a7c920ddf16 c:\Program Files\IObit\IObit Uninstaller\madexcept_.bpl
ddb9bcff8cbf73638a15579fec223229 c:\Program Files\IObit\IObit Uninstaller\rtl120.bpl
e73310d7895b2889a1f2a560285a68ee c:\Program Files\IObit\IObit Uninstaller\sqlite3.dll
c76b8e74f900e083712adc5b597a05c3 c:\Program Files\IObit\IObit Uninstaller\taskmgr.dll
8290e04f8a4d9594bfb53d520b677b8a c:\Program Files\IObit\IObit Uninstaller\vcl120.bpl
bd4254b0c5bfb133b032885cdc1f32ee c:\Program Files\IObit\IObit Uninstaller\vclx120.bpl
fa149a9a6dddcc222865077d07dd1c51 c:\Program Files\IObit\LiveUpdate\LiveUpdate.exe
716a1bc93ba66c3eec98634b14c47ce9 c:\Program Files\IObit\LiveUpdate\ProductStatistics.dll
edf9d5a6eabd82c3a6c44651a3438532 c:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll
2711591fbf552a32657be4991657b696 c:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCUrlScanner.dll
f4045a73a07a12eedf1f43021ac4f3c8 c:\Program Files\IObit\Surfing Protection\BrowerProtect\NPASCSafariPluginProtect.dll
7f21451ffe0fdb8d1ad34aec92d76da7 c:\Program Files\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\ASCPlugin_Protect.dll
6ea3310070aefd3e0ce2668db3ff8bde c:\Program Files\IObit\Surfing Protection\BrowerProtect\np_Asc_plugin.dll
fffe93851e1db6b112007ae6077ba2a5 c:\Program Files\IObit\Surfing Protection\PluginInstall.exe
497af28f6231fa74de734c9628f30fad c:\Program Files\IObit\Surfing Protection\SPUpdate.exe
7814407500c0c3373fa00d5653b02d9f c:\Program Files\IObit\Surfing Protection\sqlite3.dll
f1a522373d76b164ed357fd60314854d c:\Program Files\IObit\Surfing Protection\unins000.exe
5eb87ba0b93ca7e894fc8002e3ce4c2a c:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000004.dll
3458eda96e30fbd0477a2800d3fb1909 c:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000006.dll
44fe05b7b1394c6fc2957e65a53231b4 c:\WINDOWS\Installer\{4F5E5430-1DA8-4B2B-BB26-B29C0E7DBFDB}\ARPPRODUCTICON.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Screenshot

VersionInfo

Company Name: IObit
Product Name: Advanced SystemCare
Product Version: 7.0.0.0
Legal Copyright: Copyright? 2005-2014
Legal Trademarks: IObit
Original Filename: Downloader.exe
Internal Name: Advanced SystemCare Installer
File Version: 7.3.0.72
File Description: Advanced SystemCare Installer
Comments: Advanced SystemCare Installer
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 1904640 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 1908736 1019904 1019392 5.48983 fac12584a040083530722bdc8d6b7ccf
.rsrc 2928640 28672 28160 3.64017 c8d0fe385f079659a2abd36c50019e99

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://www.mybrowserbar.com/cgi/getcountry.cgi 174.36.215.20
hxxp://gs1.wpc.edgecastcdn.net/dl/asc730/dl-info.upt
hxxp://gs1.wpc.edgecastcdn.net/dl/asc730/asc7_setup_730_free_05161823.exe
hxxp://ascstats-iobit-com.elasticbeanstalk.com/downloader.php
hxxp://www.mybrowserbar.com/images/pixel.gif?stb=1&sds=1&shp=1&cnid=114576 174.36.215.20
hxxp://www.mybrowserbar.com/vkits/dlv1/114576/iobitappsToolbar.msi 174.36.215.20
hxxp://ascstats-iobit-com.elasticbeanstalk.com/install.php?operate=1&user=1&app=asc7&ver=7.3.0.454&pr=iobit&system=51&type=1
hxxp://ascstats-iobit-com.elasticbeanstalk.com/install.php?operate=1&user=1&app=un3&ver=3.2.10.2466&pr=asc&system=51&type=1
hxxp://gp1.adn.edgecastcdn.net/install/asc/7/en.php
hxxp://gp1.adn.edgecastcdn.net/tpl/css/reset.css
hxxp://gp1.adn.edgecastcdn.net/tpl/css/public.css
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/css/install_en.css
hxxp://googleapis.l.google.com/css?family=Open Sans:400,300,600
hxxp://gp1.wac.edgecastcdn.net/js/mapplication/2.2/mapplication.js
hxxp://gp1.adn.edgecastcdn.net/tpl/js/jquery.superbox-min.js
hxxp://gp1.adn.edgecastcdn.net/tpl/js/redirect.js
hxxp://gp1.wac.edgecastcdn.net/js/jquery/jquery-1.7.1.min.js
hxxp://gp1.adn.edgecastcdn.net/tpl/js/base.js
hxxp://gp1.adn.edgecastcdn.net/tpl/images/dropdown/banner-dbfree-300x250.jpg
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/promo_awards.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/asc7free.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/asc7pro.png
hxxp://gp1.adn.edgecastcdn.net/tpl/images/public/icons.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/itema.png
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_01.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/bluemark.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/redmark.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_05.png
hxxp://googlehosted.l.googleusercontent.com/static/fonts/opensans/v8/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_06.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_07.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_08.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_09.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_10.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_11.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_03.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_04.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_12.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_13.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_14.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/jane_mcclain.jpg
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/gordon.jpg
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/almirr.jpg
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/bob_bassett.jpg
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/mony_back.jpg
hxxp://gp1.adn.edgecastcdn.net/tpl/images/public/footer_bg.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/discount.png
hxxp://gp1.adn.edgecastcdn.net/tpl/images/public/btns.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/arr.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/itemb.png
hxxp://gp1.adn.edgecastcdn.net/tpl/images/public/logo_head.png
hxxp://gp1.adn.edgecastcdn.net/templates/install/asc/7/img/icon_02.png
hxxp://www3.l.google.com/translate_a/element.js?cb=googleTranslateElementInit
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.5.1&utms=1&utmn=59086221&utmhn=www.iobit.com&utmcs=utf-8&utmsr=1716x901&utmvp=772x419&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Thank you for installing Advanced SystemCare Free - IObit&utmhid=135091032&utmr=-&utmp=/install/asc/7/en.php&utmht=1400248624885&utmac=UA-1447202-1&utmcc=__utma=12415148.1451469242.1400248624.1400248624.1400248624.1;+__utmz=12415148.1400248624.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=qh~
hxxp://googleapis.l.google.com/translate_static/js/element/main.js
hxxp://googleapis.l.google.com/translate_static/css/translateelement.css
hxxp://googleapis.l.google.com/translate_static/js/element/23/element_main.js
hxxp://gp1.adn.edgecastcdn.net/tpl/images/public/favicon.ico
hxxp://gp1.adn.edgecastcdn.net/tpl/images/public/scrollup_telsupport.png
hxxp://gp1.adn.edgecastcdn.net/tpl/images/public/loading.gif
hxxp://googleapis.l.google.com/translate_a/l?client=te&alpha=true&hl=en&cb=_callbacks_._0hv9jvn7c
hxxp://a26.ms.akamai.net/v9/1/windowsupdate/redir/muv4wuredir.cab?1405161357
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/10/9604340_0c5db9d224cda7607c03c7692a04f114b50d48d6.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/10/9604341_ed165fc8817cd2c8175cb461a3f9979c1e7b791f.cab
hxxp://a26.ms.akamai.net/msdownload/update/software/dflt/2012/02/4913552_4a5c9563d1f58c77f30d0d5c9999e4b8bff3ab21.cab
hxxp://a26.ms.akamai.net/msdownload/update/software/dflt/2012/02/4913553_ac3a4ee80dc95dc158332edcfab906b9f1c98407.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/04/7713532_a048313f998ae00a62392b45708c4df5d25a67c5.cab
hxxp://a26.ms.akamai.net/msdownload/update/software/dflt/2010/10/4024164_4bfcd823305a2d2cefd6de1b2f423281399e1e60.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/05/8029852_e661f94f3d41f45c1741ae9eea079c69cd10f9e6.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2014/02/11119042_3621c4aa669986bf03749492daaa2c929a80c048.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2014/03/11515603_f728a5e994025c7f72ffeb309927dc83cd4297f5.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/05/5564132_7b95c88a1f13f92396b74192b823aba35be6d137.cab
hxxp://gs1.wpc.edgecastcdn.net/news/version-check.ini
hxxp://gs1.wpc.edgecastcdn.net/news/asc/v7/7_en_news_free.dat
hxxp://gs1.wpc.edgecastcdn.net/news/images/iconv7_50.png
hxxp://ascstats-iobit-com.elasticbeanstalk.com/active.php?uid=8b230885c2581ae91bcdb7f4b9fa5e57&type=1&app=asc7&ver=7.3.0.454&pr=iobit
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/11/6209138_5efaadb6bdb9a108c199c3943eea41fec24e6d10.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/10/9753935_9d9565c63a854610566e010b57ea937e5d8d7213.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/10/9753936_0d780f874c43f7ecf960e9fa48cf9e01927c86c6.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/10/9753937_c231051b393eea476ba3b283b2e0b9bf14825c66.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/06/8237551_9e4004019624b35d8eaf7e5f2f024bcf11f601cd.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/11/10112210_00f7f2ae2300a15330c2f2d1b0d2ddf823e35d24.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/01/6714603_cef25f4e4cab4b9a20050f0b35a9e9447ba1e167.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/06/8237717_a1f6cd38f200cd87c90597b4d17ef518fd78163a.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/04/7702469_c8c1bbbb4e63103fc9dbffecc5a4a0e5030e7724.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/07/5620137_3687a255bb8c4c09875d642385d75b2feefdc86d.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2014/02/11119041_ea303f6d073d4b03f283eb6accb85e0af43f31c2.cab
hxxp://gs1.wpc.edgecastcdn.net/infofiles/asc7/update.ini
hxxp://a26.ms.akamai.net/msdownload/update/common/2014/04/11836921_c05de51c64c3389d2a69f0652aa9b69e3bbdaf47.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2014/05/12124517_c25491546d9eb26b6ab3d471ffc12a7a2ea71f2e.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/05/5528367_0a979fc5090b0d30186ca6efed3b5615d839010e.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/05/5528368_15aadc728b34379c3634b5bea68cc71d1575ef8c.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/08/9135386_21712423b63a5b10201f565110e92be5b11203fa.cab
hxxp://a26.ms.akamai.net/msdownload/update/software/dflt/2011/08/4795498_00b016a367b61b9f2b2502b3fbbe920238d79fa4.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/12/10254369_498a6cb8a5004c77aa6ab4eac10ae707b38c1df0.cab
hxxp://a26.ms.akamai.net/msdownload/update/software/dflt/2011/08/4795508_f50782ed017052ac3e266a7449c76c184bfdb06f.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/12/10254389_b60ff292bb728dabee22c72f065f46e44a0a5a65.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/05/5564131_f86ea026f581bb040672a26ac8d74b1d1556278b.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/10/9604337_0729cf0fe7675971fd7cc3454baffc29a774ec1c.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/01/6715515_763ba89cd5f4536ca6991e9159e3ddc8ae5d8599.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/05/5564113_89a37169c3e0a55a7c64536175abe6d2fba0a857.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/11/9991186_601f61c20666afe79f3aafdaeb8854cc323ad364.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/11/9991206_d8756635615636b1d642df9f52d78c6f2c7f1421.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/11/6209433_d5e3ec1ad613892f31feaddb3629c861825374f2.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/11/6209434_ef143fdf2760eb3a2d7248d126abbd5388caf296.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/06/8237550_a6b07a34e0b146ad8b3f794cd5c0d817a0e5b4af.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/07/5620136_0cfbe8351461f278e16b2632d83b8f28a2eb65b5.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/07/8488812_b964589baa41b78f80ae5cd0899217e9b9811f43.cab
hxxp://www.go.microsoft.akadns.net/fwlink/?LinkId=121315
hxxp://iegallery.com/en/ie8slice/default.aspx 157.55.184.162
hxxp://www.go.microsoft.akadns.net/fwlink/?LinkId=68929
hxxp://az307127.vo.msecnd.net/webslices/ie8?culture=en-us&r=asdf9488 68.232.34.200
hxxp://lb1.www.ms.akadns.net/atwork/community/rss.xml
hxxp://www.go.microsoft.akadns.net/fwlink/?LinkId=68928
hxxp://lb1.www.ms.akadns.net/athome/community/rss.xml
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/07/8488784_d53528d30a9637f7039aa477140899acca01527a.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/07/8488785_131639c0b6410eb7fa219d3bfe16714f6474a804.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/06/8237736_b1c5a4e1ed93aabd218ec2a9fa0cdd71289c6a5c.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2014/02/11117585_38910c838c8bfec6fdbb9b493971d1e64a38480a.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/04/7702450_12138692d032372880efac823b339b3df4d8756f.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/11/9990883_419fe69b15353c8e422af2e43f898de896bf204d.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/10/9792613_272415a27f02b0988b5bab0a24bb26d82893b82e.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/11/6209137_e308a833ad92c6d2d33a14eceeb4f4b5bca2298e.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/10/9605649_3e1d843c9c150bcf8bcdb2fd2c6f0b03f81498a5.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2014/03/11502131_e02562c9316bcd4202f06d4ed53b176c8eb03066.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/01/6715516_2b4d9f954c7bd6525a099799dc55fa71ab9e1497.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/01/6714683_33195582ccd32555439f3e4d9d8039ec3bfaf478.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/10/9604338_8adc65b64d80f6fa9396f0a5e7c90e013825d256.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/05/8023447_535766bc83162b5e6836b322d94af4e08b542261.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/05/8044982_a9ae62cdac168c8d2ede6caf824b634c26a2089e.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/07/8490218_028a33804a43d782431b5398456a54bf40c90485.cab
hxxp://a26.ms.akamai.net/msdownload/update/software/dflt/2011/12/4888075_94656c9b348179ab25ab2f76bad55c00f65aef50.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/07/8490237_75712a27141bc73139aea3a464a19c3fb8d64ec2.cab
hxxp://a26.ms.akamai.net/msdownload/update/software/dflt/2011/12/4888074_81a32e075ffea721e751881afe4b61ec6e12a4b7.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2012/05/5564112_1cac752b2905368b2f1e44dba61a2dd5830b1e83.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/09/9234520_bbbb0260395e06ef86927f9316c6f1261abf4ec6.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2014/02/11168660_b205ddcda9b2a2ae614c36069cd5e1822e9b0a0d.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2014/02/11168680_990b04cd1c5b5d0d22a8ad3c292ecb90e46401ef.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/08/8827627_2d29df498412cafcf92d89a145f7a9e5d9f1510e.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2014/02/11117586_9f19f48a64e6020e63972b000aeb9ad22cce9f3d.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/08/8827608_800c359fe55d13e693c98173729421be04a5874c.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/09/9234540_ab0e6f0ebcc61aba56f9df0a80eb37c67d510806.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/01/6714684_2a98a5fd78784b4aaa3fbba8a5c7c3c5654e8eb3.cab
hxxp://e6845.ce.akamaiedge.net/pca3-g5.crl
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/10/9605669_58f88240b9a3064af7111aeaf4cc7e87c53c7778.cab
hxxp://a26.ms.akamai.net/msdownload/update/software/dflt/2011/08/4795507_8d99e78ef861cb5ac870cd806f6f636d1e210947.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/07/8488813_c0fca05893b48587fe3aac536d7862071ea50297.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/01/6714604_9fef2d02229f82e8815ba832c198ffc16b89d360.cab
hxxp://e6845.ce.akamaiedge.net/CSC3-2010.crl
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/05/8023428_e2e9cf5aaf1e27d3041b19ac6a6c68556ce1c7f6.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/08/8828314_e5891b716842f8ab3ed2ac3e3ca632a6a43b6c96.cab
hxxp://a26.ms.akamai.net/msdownload/update/common/2013/08/8828315_e8282eaddcf3c8db412a1bc3d421816c12030065.cab
hxxp://a26.ms.akamai.net/msdownload/update/software/dflt/2011/08/4795499_5062707b2be6d5db6c506f5538cb08cfde487a10.cab
hxxp://a26.ms.akamai.net/msdownload/update/v5/eula/windowsie7.0-enu-d0ce5c0e-a2fd-4f4e-b53c-44e562026ce0.txt?1405161357
hxxp://update.mybrowserbar.com/update/wt/ie/coupons/update.xml 108.59.13.13
hxxp://a26.ms.akamai.net/msdownload/update/v5/eula/ie8rtmeula-enu-ac95a9ce-9522-47a1-b0d3-09f0d26e41f5.txt?1405161357
hxxp://gs1.wpc.edgecastcdn.net/infofiles/liveupdate/update/update.ini
hxxp://www.yandex.com/favicon.ico 213.180.204.62
hxxp://gs1.wpc.edgecastcdn.net/asc-spupdate/spupdate.utp
hxxp://gs1.wpc.edgecastcdn.net/asc-spupdate/201405/14/base_upt_add
hxxp://download.windowsupdate.com/msdownload/update/software/dflt/2011/12/4888074_81a32e075ffea721e751881afe4b61ec6e12a4b7.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/10/9753937_c231051b393eea476ba3b283b2e0b9bf14825c66.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/software/dflt/2012/02/4913552_4a5c9563d1f58c77f30d0d5c9999e4b8bff3ab21.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2014/02/11117585_38910c838c8bfec6fdbb9b493971d1e64a38480a.cab 212.30.134.169
hxxp://www.iobit.com/tpl/js/base.js 93.184.219.20
hxxp://update.iobit.com/infofiles/asc7/update.ini 93.184.221.133
hxxp://www.iobit.com/templates/install/asc/7/img/mony_back.jpg 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/software/dflt/2011/12/4888075_94656c9b348179ab25ab2f76bad55c00f65aef50.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/04/7713532_a048313f998ae00a62392b45708c4df5d25a67c5.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/08/8827627_2d29df498412cafcf92d89a145f7a9e5d9f1510e.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/06/8237736_b1c5a4e1ed93aabd218ec2a9fa0cdd71289c6a5c.cab 212.30.134.169
hxxp://www.iobit.com/tpl/images/public/footer_bg.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2014/03/11515603_f728a5e994025c7f72ffeb309927dc83cd4297f5.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/09/9234540_ab0e6f0ebcc61aba56f9df0a80eb37c67d510806.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/10/9753936_0d780f874c43f7ecf960e9fa48cf9e01927c86c6.cab 212.30.134.169
hxxp://www.iobit.com/install/asc/7/en.php 93.184.219.20
hxxp://update.iobit.com/dl/asc730/asc7_setup_730_free_05161823.exe 93.184.221.133
hxxp://go.microsoft.com/fwlink/?LinkId=68928 64.4.11.25
hxxp://download.windowsupdate.com/msdownload/update/common/2014/02/11168660_b205ddcda9b2a2ae614c36069cd5e1822e9b0a0d.cab 212.30.134.169
hxxp://iobitapps.mybrowserbar.com/cgi/api.cgi/114576/8C9A823EF2F54A2DA307F9A0DD862C57/vloc/4 174.36.215.20
hxxp://download.iobit.com/news/asc/v7/7_en_news_free.dat 93.184.221.133
hxxp://www.iobit.com/templates/install/asc/7/img/icon_03.png 93.184.219.20
hxxp://www.iobit.com/templates/install/asc/7/img/icon_10.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/01/6714603_cef25f4e4cab4b9a20050f0b35a9e9447ba1e167.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/icon_06.png 93.184.219.20
hxxp://update.iobit.com/infofiles/liveupdate/update/update.ini 93.184.221.133
hxxp://download.windowsupdate.com/msdownload/update/common/2012/11/6209137_e308a833ad92c6d2d33a14eceeb4f4b5bca2298e.cab 212.30.134.169
hxxp://themes.googleusercontent.com/static/fonts/opensans/v8/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot 173.194.71.132
hxxp://download.windowsupdate.com/msdownload/update/common/2012/05/5528367_0a979fc5090b0d30186ca6efed3b5615d839010e.cab 212.30.134.169
hxxp://www.download.windowsupdate.com/msdownload/update/v5/eula/ie8rtmeula-enu-ac95a9ce-9522-47a1-b0d3-09f0d26e41f5.txt?1405161357 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/icon_09.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/10/9753935_9d9565c63a854610566e010b57ea937e5d8d7213.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/css/install_en.css 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/06/8237717_a1f6cd38f200cd87c90597b4d17ef518fd78163a.cab 212.30.134.169
hxxp://update.iobit.com/dl/asc730/dl-info.upt 93.184.221.133
hxxp://translate.googleapis.com/translate_static/js/element/23/element_main.js 74.125.143.95
hxxp://www.iobit.com/tpl/css/reset.css 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/12/10254389_b60ff292bb728dabee22c72f065f46e44a0a5a65.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2012/05/5528368_15aadc728b34379c3634b5bea68cc71d1575ef8c.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/05/8029852_e661f94f3d41f45c1741ae9eea079c69cd10f9e6.cab 212.30.134.169
hxxp://www.microsoft.com/atwork/community/rss.xml 1.103.192.54
hxxp://ascstats.iobit.com/active.php?uid=8b230885c2581ae91bcdb7f4b9fa5e57&type=1&app=asc7&ver=7.3.0.454&pr=iobit 54.225.135.129
hxxp://download.windowsupdate.com/msdownload/update/software/dflt/2011/08/4795508_f50782ed017052ac3e266a7449c76c184bfdb06f.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/gordon.jpg 93.184.219.20
hxxp://ascstats.iobit.com/install.php?operate=1&user=1&app=un3&ver=3.2.10.2466&pr=asc&system=51&type=1 54.225.135.129
hxxp://download.windowsupdate.com/msdownload/update/common/2013/10/9792613_272415a27f02b0988b5bab0a24bb26d82893b82e.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/software/dflt/2010/10/4024164_4bfcd823305a2d2cefd6de1b2f423281399e1e60.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/10/9604341_ed165fc8817cd2c8175cb461a3f9979c1e7b791f.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/08/9135386_21712423b63a5b10201f565110e92be5b11203fa.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/icon_11.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/05/8023428_e2e9cf5aaf1e27d3041b19ac6a6c68556ce1c7f6.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/redmark.png 93.184.219.20
hxxp://www.download.windowsupdate.com/msdownload/update/v5/eula/windowsie7.0-enu-d0ce5c0e-a2fd-4f4e-b53c-44e562026ce0.txt?1405161357 212.30.134.169
hxxp://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit 173.194.32.167
hxxp://download.windowsupdate.com/msdownload/update/common/2012/11/6209433_d5e3ec1ad613892f31feaddb3629c861825374f2.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/icon_12.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2012/11/6209138_5efaadb6bdb9a108c199c3943eea41fec24e6d10.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/07/8488812_b964589baa41b78f80ae5cd0899217e9b9811f43.cab 212.30.134.169
hxxp://www.mybrowserbar.com/cgi/api.cgi/114576/8C9A823EF2F54A2DA307F9A0DD862C57/vaus/14/ 174.36.215.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/12/10254369_498a6cb8a5004c77aa6ab4eac10ae707b38c1df0.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/01/6714684_2a98a5fd78784b4aaa3fbba8a5c7c3c5654e8eb3.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/bluemark.png 93.184.219.20
hxxp://download.windowsupdate.com/v9/1/windowsupdate/redir/muv4wuredir.cab?1405161357 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/07/8488813_c0fca05893b48587fe3aac536d7862071ea50297.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/07/8490218_028a33804a43d782431b5398456a54bf40c90485.cab 212.30.134.169
hxxp://www.mybrowserbar.com/cgi/api.cgi/114576/8C9A823EF2F54A2DA307F9A0DD862C57/ping/14/73/ 174.36.215.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/01/6714683_33195582ccd32555439f3e4d9d8039ec3bfaf478.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/promo_awards.png 93.184.219.20
hxxp://translate.googleapis.com/translate_a/l?client=te&alpha=true&hl=en&cb=_callbacks_._0hv9jvn7c 74.125.143.95
hxxp://download.windowsupdate.com/msdownload/update/common/2012/07/5620136_0cfbe8351461f278e16b2632d83b8f28a2eb65b5.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/08/8828315_e8282eaddcf3c8db412a1bc3d421816c12030065.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/10/9605669_58f88240b9a3064af7111aeaf4cc7e87c53c7778.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/08/8827608_800c359fe55d13e693c98173729421be04a5874c.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2014/02/11117586_9f19f48a64e6020e63972b000aeb9ad22cce9f3d.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/01/6714604_9fef2d02229f82e8815ba832c198ffc16b89d360.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2014/04/11836921_c05de51c64c3389d2a69f0652aa9b69e3bbdaf47.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/08/8828314_e5891b716842f8ab3ed2ac3e3ca632a6a43b6c96.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2012/05/5564131_f86ea026f581bb040672a26ac8d74b1d1556278b.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/11/9991186_601f61c20666afe79f3aafdaeb8854cc323ad364.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/04/7702469_c8c1bbbb4e63103fc9dbffecc5a4a0e5030e7724.cab 212.30.134.169
hxxp://www.google-analytics.com/ga.js 173.194.71.139
hxxp://download.windowsupdate.com/msdownload/update/common/2012/05/5564112_1cac752b2905368b2f1e44dba61a2dd5830b1e83.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/software/dflt/2011/08/4795499_5062707b2be6d5db6c506f5538cb08cfde487a10.cab 212.30.134.169
hxxp://download.mybrowserbar.com/vkits/dlv1/114576/iobitappsToolbar.msi 174.36.215.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/10/9604337_0729cf0fe7675971fd7cc3454baffc29a774ec1c.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/09/9234520_bbbb0260395e06ef86927f9316c6f1261abf4ec6.cab 212.30.134.169
hxxp://ascstats.iobit.com/install.php?operate=1&user=1&app=asc7&ver=7.3.0.454&pr=iobit&system=51&type=1 54.225.135.129
hxxp://translate.googleapis.com/translate_static/js/element/main.js 74.125.143.95
hxxp://download.windowsupdate.com/msdownload/update/common/2012/05/5564132_7b95c88a1f13f92396b74192b823aba35be6d137.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2014/05/12124517_c25491546d9eb26b6ab3d471ffc12a7a2ea71f2e.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/discount.png 93.184.219.20
hxxp://crl.verisign.com/pca3-g5.crl 23.37.37.163
hxxp://www.iobit.com/templates/install/asc/7/img/icon_04.png 93.184.219.20
hxxp://www.iobit.com/templates/install/asc/7/img/itema.png 93.184.219.20
hxxp://www.iobit.com/templates/install/asc/7/img/icon_01.png 93.184.219.20
hxxp://www.iobit.com/tpl/images/public/loading.gif 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2014/03/11502131_e02562c9316bcd4202f06d4ed53b176c8eb03066.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/01/6715515_763ba89cd5f4536ca6991e9159e3ddc8ae5d8599.cab 212.30.134.169
hxxp://ascstats.iobit.com/downloader.php 54.225.135.129
hxxp://www.iobit.com/templates/install/asc/7/img/arr.png 93.184.219.20
hxxp://api.mybrowserbar.com/cgi/getcountry.cgi 174.36.215.20
hxxp://www.iobit.com/templates/install/asc/7/img/almirr.jpg 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/software/dflt/2011/08/4795498_00b016a367b61b9f2b2502b3fbbe920238d79fa4.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/asc7free.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/10/9605649_3e1d843c9c150bcf8bcdb2fd2c6f0b03f81498a5.cab 212.30.134.169
hxxp://download.iobit.com/asc-spupdate/spupdate.utp 93.184.221.133
hxxp://download.windowsupdate.com/msdownload/update/common/2013/11/10112210_00f7f2ae2300a15330c2f2d1b0d2ddf823e35d24.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/icon_13.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/07/8490237_75712a27141bc73139aea3a464a19c3fb8d64ec2.cab 212.30.134.169
hxxp://www.iobit.com/tpl/images/public/icons.png 93.184.219.20
hxxp://www.iobit.com/templates/install/asc/7/img/icon_02.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2014/02/11119042_3621c4aa669986bf03749492daaa2c929a80c048.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/01/6715516_2b4d9f954c7bd6525a099799dc55fa71ab9e1497.cab 212.30.134.169
hxxp://www.iobit.com/tpl/js/jquery.superbox-min.js 93.184.219.20
hxxp://fonts.googleapis.com/css?family=Open Sans:400,300,600 173.194.71.95
hxxp://download.windowsupdate.com/msdownload/update/common/2014/02/11168680_990b04cd1c5b5d0d22a8ad3c292ecb90e46401ef.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/icon_08.png 93.184.219.20
hxxp://www.iobit.com/tpl/images/public/scrollup_telsupport.png 93.184.219.20
hxxp://go.microsoft.com/fwlink/?LinkId=121315 64.4.11.25
hxxp://www.iobit.com/templates/install/asc/7/img/icon_14.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2012/11/6209434_ef143fdf2760eb3a2d7248d126abbd5388caf296.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/11/9990883_419fe69b15353c8e422af2e43f898de896bf204d.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/10/9604338_8adc65b64d80f6fa9396f0a5e7c90e013825d256.cab 212.30.134.169
hxxp://codes.iobit.com/js/jquery/jquery-1.7.1.min.js 93.184.220.20
hxxp://download.windowsupdate.com/msdownload/update/common/2014/02/11119041_ea303f6d073d4b03f283eb6accb85e0af43f31c2.cab 212.30.134.169
hxxp://download.iobit.com/news/images/iconv7_50.png 93.184.221.133
hxxp://www.iobit.com/templates/install/asc/7/img/itemb.png 93.184.219.20
hxxp://download.iobit.com/asc-spupdate/201405/14/base_upt_add 93.184.221.133
hxxp://download.windowsupdate.com/msdownload/update/common/2013/05/8044982_a9ae62cdac168c8d2ede6caf824b634c26a2089e.cab 212.30.134.169
hxxp://go.microsoft.com/fwlink/?LinkId=68929 64.4.11.25
hxxp://www.iobit.com/templates/install/asc/7/img/jane_mcclain.jpg 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/07/8488785_131639c0b6410eb7fa219d3bfe16714f6474a804.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/06/8237550_a6b07a34e0b146ad8b3f794cd5c0d817a0e5b4af.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2012/07/5620137_3687a255bb8c4c09875d642385d75b2feefdc86d.cab 212.30.134.169
hxxp://download.iobit.com/news/version-check.ini 93.184.221.133
hxxp://www.iobit.com/templates/install/asc/7/img/icon_07.png 93.184.219.20
hxxp://www.iobit.com/tpl/images/public/btns.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/11/9991206_d8756635615636b1d642df9f52d78c6f2c7f1421.cab 212.30.134.169
hxxp://codes.iobit.com/js/mapplication/2.2/mapplication.js 93.184.220.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/07/8488784_d53528d30a9637f7039aa477140899acca01527a.cab 212.30.134.169
hxxp://www.iobit.com/tpl/css/public.css 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/04/7702450_12138692d032372880efac823b339b3df4d8756f.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/common/2013/05/8023447_535766bc83162b5e6836b322d94af4e08b542261.cab 212.30.134.169
hxxp://download.windowsupdate.com/msdownload/update/software/dflt/2011/08/4795507_8d99e78ef861cb5ac870cd806f6f636d1e210947.cab 212.30.134.169
hxxp://iobitapps.mybrowserbar.com/cgi/api.cgi/114576/8C9A823EF2F54A2DA307F9A0DD862C57/vrst/4 174.36.215.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/10/9604340_0c5db9d224cda7607c03c7692a04f114b50d48d6.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/bob_bassett.jpg 93.184.219.20
hxxp://csc3-2010-crl.verisign.com/CSC3-2010.crl 23.37.37.163
hxxp://www.iobit.com/tpl/js/redirect.js 93.184.219.20
hxxp://www.iobit.com/tpl/images/dropdown/banner-dbfree-300x250.jpg 93.184.219.20
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.5.1&utms=1&utmn=59086221&utmhn=www.iobit.com&utmcs=utf-8&utmsr=1716x901&utmvp=772x419&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Thank you for installing Advanced SystemCare Free - IObit&utmhid=135091032&utmr=-&utmp=/install/asc/7/en.php&utmht=1400248624885&utmac=UA-1447202-1&utmcc=__utma=12415148.1451469242.1400248624.1400248624.1400248624.1;+__utmz=12415148.1400248624.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=qh~ 173.194.71.139
hxxp://download.windowsupdate.com/msdownload/update/software/dflt/2012/02/4913553_ac3a4ee80dc95dc158332edcfab906b9f1c98407.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/icon_05.png 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2012/05/5564113_89a37169c3e0a55a7c64536175abe6d2fba0a857.cab 212.30.134.169
hxxp://www.iobit.com/templates/install/asc/7/img/asc7pro.png 93.184.219.20
hxxp://www.iobit.com/tpl/images/public/logo_head.png 93.184.219.20
hxxp://www.iobit.com/tpl/images/public/favicon.ico 93.184.219.20
hxxp://download.windowsupdate.com/msdownload/update/common/2013/06/8237551_9e4004019624b35d8eaf7e5f2f024bcf11f601cd.cab 212.30.134.169
hxxp://translate.googleapis.com/translate_static/css/translateelement.css 74.125.143.95
hxxp://www.microsoft.com/athome/community/rss.xml 1.103.192.54
ieonlinews.microsoft.com 131.253.34.240
update.microsoft.com 65.55.138.125
www.google.com 173.194.32.178


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET MALWARE User-Agent (Mozilla/4.0 (compatible ICS))
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET program VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

POST /news/version-check.ini HTTP/1.0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Host: download.iobit.com
Accept: text/html, */*
Accept-Encoding: identity
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:15 GMT
Etag: "4039205609"
Expires: Fri, 23 May 2014 13:57:15 GMT
Last-Modified: Fri, 28 Mar 2014 01:34:40 GMT
Server: EOS (cpm001/F927)
Content-Length: 83
Connection: keep-alive
asc=7.2.0.360|.gb=3.4.0.1491|.imf=2.3.0.8|.sd=3.1.0.289|.un3=3.2.0.0|.
db=1.3.0.466|..



GET /dl/asc730/asc7_setup_730_free_05161823.exe HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=28703061-38270744


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 28703061-38270743/38270744
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:55:11 GMT
Etag: "3919716597"
Expires: Fri, 23 May 2014 13:55:11 GMT
Last-Modified: Fri, 16 May 2014 10:33:22 GMT
Server: ECAcc (fra/D449)
X-Cache: HIT
Content-Length: 9567683
Connection: close
.]..7.uUi].1..w...K.:.\............1.b.R..u1....<...m...U$..?......
..9 ........$...&..eR[..`.H...>a_9...yQu3xI...aI.0b.....nX.|..7/...
....f.F.........4.\...&........j:.........|.u7.Y.....AL.N\......cs7.8R
3...I1.L.S..`....xF..}3pB6?F. ".1.n..\..=..l.......f....ZG%..)j.9.....
r..qP..=...#p..w .../.Z..u..........Z..1.'....i......a.....y=...^..-..
?...a'.\....N.....2w....U..k......../.Y.9c.yi....y...3]..].$..N....%.$
x...R...O<...Y..V.J...........f......{6....,..= _.........W........
.uz.V...b.......}....Y....\..`../.oqV:(..C#w...J..~.. ..?..~..o.......
.n..r4.Yz|...4{......{..l.N..K..}.._..FS..&e...y.B..b.!...4t.=.$..Ki&g
t;....Y...}X.Y.;..5.....G.$a...|/.U....Z..........a... fJ.X.....i...0.
....6...p/Z..... ..........-.g.4..<...J.. ..P.X.:....7."~h*-...a...
4..w...,n).c`.k......ZYH/.zh.._/Q.....f...c:A.....,.f....Z..Z..w.g....
...hW.......RA.5.:7.a..W.h.....g.......k8..P.....w.\.j{.[[e.._ ...... 
u...|.d.[Nv.)=.V...k......?...|.`..}. Y~s..../N.b.laM...-'/=.F...S.w.-
..\...f.b.....<.LT..!N..#.....H.....o.{...K.}..u.o...;..0...@.IV...
*n5a.%.....e..{Y!L..Mg.S.......L....zofZV.._......I......Ft.jP.A......
.........k?i.]K_...c...XJI....`;........&...........=uA\.(...4.....u[.
.].......RhD=..hX...i..?.0N..&T8..}.%{i>."D......0..2..Y|...nk.$.(.
...9IL.....q..y.b.....Q.a..Z&..Rb/......B...),.Z`.../6u..U...M.Mvo....
..z..........O.9i...y.M....:.m]1^.....?......#.vq..=...A..[H....L'...s
..Jc.@..[(U......].O....-...5.....pAl..Z........r....l...[:..,..Z.J.?.
.....?....0...u....\.....WT..@I...x<..-......0x..y.}.GdJj.U....
<<< skipped >>>


GET /infofiles/asc7/update.ini HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=4260-5678


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 4260-5677/5678
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:20 GMT
Etag: "955381131"
Expires: Fri, 23 May 2014 13:57:20 GMT
Last-Modified: Wed, 14 May 2014 04:26:50 GMT
Server: ECAcc (fra/D4B8)
X-Cache: HIT
Content-Length: 1418
Connection: close
ian].Version=201404231656.Url=hXXp://update.iobit.com/infofiles/asc7/V
ulXP_Russian0423.upt.md5=63D69ABDB55E39324DE6394B30ECED37.BI=..[VulXP_
Arabic].Version=201404231656.Url=hXXp://update.iobit.com/infofiles/asc
7/VulXP_Arabic0423.upt.md5=D4BA282CF1E3F3964A02B1178F622532.BI=..[VulX
P_Danish].Version=201404231656.Url=hXXp://update.iobit.com/infofiles/a
sc7/VulXP_Danish0423.upt.md5=9B22EDC2324DF75E38A5015153C3699F.BI=..[Vu
lXP_Swedish].Version=201404231656.Url=hXXp://update.iobit.com/infofile
s/asc7/VulXP_Swedish0423.upt.md5=C71958C9A41AB82206B05F07948E8429.BI=.
.[VulXP_Polish].Version=201404231656.Url=hXXp://update.iobit.com/infof
iles/asc7/VulXP_Polish0423.upt.md5=E8504265AE9EF8BAC750288715BD09D1.BI
=...[VulXP_French].Version=201404231656.Url=hXXp://update.iobit.com/in
fofiles/asc7/VulXP_French0423.upt.md5=3E3847856F7CD83400B5BA2C65AF5B25
.BI=..[VulXP_Greek].Version=201404231656.Url=hXXp://update.iobit.com/i
nfofiles/asc7/VulXP_Greek0423.upt.md5=5F35AF1E5871A346690735DC8F039D9A
.BI=..[VulXP_Hebrew].Version=201404231656.Url=hXXp://update.iobit.com/
infofiles/asc7/VulXP_Hebrew0423.upt.md5=21BD8EF5465A27F49376A008C44D87
8B.BI=..[VulXP_Turkish].Version=201404231656.Url=hXXp://update.iobit.c
om/infofiles/asc7/VulXP_Turkish0423.upt.md5=AE92D15AA75C8422E1DDCB5FE4
C4CD06.BI=..[VulXP_Hungarian].Version=201404231656.Url=hXXp://update.i
obit.com/infofiles/asc7/VulXP_Hungarian0423.upt.md5=21BD8EF5465A27F493
76A008C44D878B.BI=..
<<< skipped >>>


GET /css?family=Open Sans:400,300,600 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: fonts.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/css
Timing-Allow-Origin: *
Expires: Fri, 16 May 2014 13:57:02 GMT
Date: Fri, 16 May 2014 13:57:02 GMT
Cache-Control: private, max-age=86400
Content-Encoding: gzip
Content-Length: 262
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 80:quic
.............N.@...}..A.aHil..c..6.F.........2.Rb|w...}.].ss..r.K.1(..
.5!....CB.M...1m..... !!........jL.<.F..<!] ...I(.....2...Yh.{..
!7.Zd(8.s,5...BzXR......Z=....Od.,..o.Y..]..z...#{..4...K.4.I..~zs....
.t[....@}@Q@..i84.w8.e...:.A....gy...ao...gT...{...$mM....HTTP/1.1 200
 OK..Content-Type: text/css..Timing-Allow-Origin: *..Expires: Fri, 16 
May 2014 13:57:02 GMT..Date: Fri, 16 May 2014 13:57:02 GMT..Cache-Cont
rol: private, max-age=86400..Content-Encoding: gzip..Content-Length: 2
62..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X-XS
S-Protection: 1; mode=block..Server: GSE..Alternate-Protocol: 80:quic.
..............N.@...}..A.aHil..c..6.F.........2.Rb|w...}.].ss..r.K.1(.
..5!....CB.M...1m..... !!........jL.<.F..<!] ...I(.....2...Yh.{.
.!7.Zd(8.s,5...BzXR......Z=....Od.,..o.Y..]..z...#{..4...K.4.I..~zs...
..t[....@}@Q@..i84.w8.e...:.A....gy...ao...gT...{...$mM......



GET /tpl/js/jquery.superbox-min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Encoding: gzip
Accept-Ranges: bytes
Content-Type: application/x-javascript
Date: Fri, 16 May 2014 13:57:02 GMT
Last-Modified: Thu, 10 Jan 2013 03:35:51 GMT
Server: ECD (fcn/4027)
Vary: Accept-Encoding
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 2053
.....7.P...X_s.8...Sx.{D...d.nw N.8$...........2X.2..X"....k..1..pu{y.
....?.n.t............2.i?^.r..-;../N6.....'..h..:..OS..y.8L'.sl.X.....
b.#..g..<u..;.|.......;o....SkM.x}...e4Q".. ..?uB.hJ.Q.&tNczOWt.n..
.].AR .cD....Rr.A...<.....?.j.i..5..E.....v...qmL..U....|Z..{..h..C
t....YO.....x.h...3}.|...............l..q.?..U...l....mF....%...x8"..`
.5n.|....x.``.....\).T...b..i..<e.)x....WH.u...JW2?.0.<...H#.=..
`.u.=......a../n....)?.C.q.2..}u...$5.......J...#".........K!........}
..Z....Gt.d)OB..q%.....x......<>.G.sW.`.....E...b..........V.5`.
..0..B#.kW.v.hi.-..7M...c,..6='..~@d....9..C..H...Z.rP.B.e..h.....Sb..
....CH.G1M.......B=.....3..=='.....Om.x...e.PF2..Q.....:.An.S.......-.
f..n.N.F...=......w.=6......y....x.l..#.D...;. ....3.Q.yl......n......
o\.....`....n..;.u...m.A{g..Vs]...@W&.P....n..'.b1sd:q.I.....|.H9A..*.
z..kf..2=..S...........S.bf@..x[-f....^..4.l/.:.e..L..$..O1.QD......2j
=....6.s5.lL....C.<4"[;p....Y..s......{...4^&......!.fj......s..t..
...~Q=.. ....O..c.$.76..m...q....7.}..L......>>......q.@.K...c..
.XU....0......q.....6r.$..........3.p.q....h1;........U.....\/.....~cF
 .HC.x.[....qUnNr.......x..9vm.{..Gb.Q...-F94.....2..#cP....._...B..8.
..{LB...>....Q%E._.0....:....oFy......e...A.........V. ...)..i..z..
aX6fS..O.Z....kev]......jd%...3xgw.KZ;E.DJ....A.{>...I.(.n......%.M
;..u.3. ?i.p.C.^..a......YArnH..UE....."g.&..^....y...W.K........Y....
...Vu=...{...z....L.0....!...e4...F&....E ...l....t9..._.....A..?G..Se
..Sf.c.....'. j.L..D.....U...........n..|......as.@.........m.K.Eu
<<< skipped >>>

GET /templates/install/asc/7/img/promo_awards.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Thu, 20 Feb 2014 03:32:32 GMT
Server: ECD (fcn/4036)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 9881
.PNG........IHDR.......\.....P..m....tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Windows)" xmpMM:InstanceID="xmp.iid:7A0786D399DF11E3A510E98B0
7438FBC" xmpMM:DocumentID="xmp.did:7A0786D499DF11E3A510E98B07438FBC"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7A0786D199DF11E3A51
0E98B07438FBC" stRef:documentID="xmp.did:7A0786D299DF11E3A510E98B07438
FBC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>:.N.....PLTE..i......R.)`^_....zx....*,....n
.......l.5......k.QJj .............................6..................
...............9w...................4V...................F.#..........
..<C5.....B.................5............9..[.-ooq..G............((
&.A....e.0.*1.6D.....x.JK....|..ou.GJ.g_.R`.ni....Zba.................
..............z.....B..lMIH..`...........<..u..K..e..m...3BO..0..!.
.........]......tRNS..................................................
......................................................................
........8.Kg.. .IDATx..}._.J.6bB.P...."..%.u..K..=R5.H.....k.QzZ..
<<< skipped >>>

GET /templates/install/asc/7/img/bluemark.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:53 GMT
Server: ECD (fcn/402F)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 441
.PNG........IHDR...............mJ....tEXtSoftware.Adobe ImageReadyq.e&
lt;...[IDATx.b...?.%.g%.. e.D.!.@*...1..".!r@.....&....%~ ^.%........R
.@....@bLd.......V.k..l...f 5.......&G..r.........L..{...@.2..!K`q.:.:
...@|....Y...Do .@..@....\t5 ......Lhl`..@l.e..E7.A@.kH.6.h...k..T#...
.&l6.....A....j.f..!l@j....G7V.......B@..h.(.V..1T..rt......|.H.@.....
.5.@.7.2.=..Bc.....9.........|..M.E..XA..Y....Ah.......;8.6`....e..;.1
. ....ej0.......IEND.B`.....


GET /templates/install/asc/7/img/icon_08.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:18 GMT
Server: ECD (fcn/402E)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 556
.PNG........IHDR..............T<.....tEXtSoftware.Adobe ImageReadyq
.e<....IDATx...AD.Q...ZK..D.!.F."u.Z.N..".Ct...i..H......R,..N.)..S
...)bX.....i...kg?~..y...|.{.....tD....ta....x./`..5.......@.0....A...
(.'....r.8..C ...>d.6..9p.......0....Z.J..GR..N....F.7.V,.Mo..p.
.9N........|.,x.....q..G.~Vnd...A....,.....[..........(......{.Zg..d;v
m..<./........vA..g!..Y}~..u.W../.....xv..\s ......N"w..-...j(Vtd..
A..I....*.Ur...U}..(..N...W...W...-...H.D.l.......5..q.l....`.._.0....
..4Rg........j.D.....l:B....a|7Q~.'...cS5...mQ..%.._....`.-.de........
IEND.B`.....


GET /templates/install/asc/7/img/icon_03.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:28 GMT
Server: ECD (fcn/402F)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 1096
.PNG........IHDR...!.........i.......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx...qdUq..o{.......1...eSJ)KSJ.X.KY.e)..YJS6.XJ4RJ.,f#.....
l.i.....c<.1u~..9.....v.........w~.|...zzz.<.........E..`R0....e
.Tj.Z.....7.....-.j.3.K.t.>..1.....y;;.E"!...g...y.UHL1..{$x,x-8.X.
..,@..H..f.9...._p]..1..<g<......u.....y1..0....92vwV.,..:...u..
\P"............@.O.g...w..a.&...-......j.....JEooo.E.]..n...J.....A"C.
......Y....?`.0....K.W.;..[......7).G.Gp[e.{...&....B...m3.....'..../!
.n.E...j...5.r..,r..X.kWHMmIHt[.TD......n...h..O..k...CY...=.[$......c
b5..og..o..X2...80.6.0..kz....`.....HH.)Q.....R.;.U..-i.rn..kU...a.,..
..4".D.?- ...e..c..p..j..X......c......=.f.....#{.... ..8.$.K..y.d....
...,..T....2mZ..sd.&0....z9,..(_ ..).!...._'..iZ7....Q...../..../.....
A$.Dy..Z...n..>....C...u_.VU.b..........0*......,C....g...H. .X?3..
...14K....j.oD...r..x.OS..Uz....#....Q..;.j.....{....nz...}..&`..32...
i..(.lQ........... ..~....u'...Iz....P..mM......G).L../|...Q^.P7F.....
.....!.....dK...".c.(..../.6.J..y...X'..N., X....5Q5S|....R.D ..Z.&...
....U.........y_..,.... ..9.sx.V.X.E. =.O;.O....... .l.....IEND.B`.ont>....


GET /templates/install/asc/7/img/gordon.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/jpeg
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:35 GMT
Server: ECD (fcn/4033)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 5269
......Exif..II*.................Ducky.......P.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C82B6B95C64FE211A
CA6CFE47D057EFB" xmpMM:DocumentID="xmp.did:0764DE32653711E28CADC0529F0
F2AED" xmpMM:InstanceID="xmp.iid:0764DE31653711E28CADC0529F0F2AED" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:0998E05D5ED611E29D249D22A7AB4DBF" stRef:doc
umentID="xmp.did:0998E05E5ED611E29D249D22A7AB4DBF"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................P.P.................................................
...........................................!....1".AQ2.aq....8tBR3$5U.
......br#C4d%..&..(.......................!1A.Q.aq.."2........Rbr#....
...........?........z'.>...k5....?..,@..q....~^O,........V.i\.(...8
.o........_j.W.^...U.kL.{.......'.3.>.z.....8R;]d..........31).....
W..$J......~oM..>...|W...]....C.Okl...?.:.W.W..Wr.W.\D.AOkL..$.
<<< skipped >>>

GET /tpl/images/public/btns.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Thu, 06 Mar 2014 09:55:50 GMT
Server: ECD (fcn/402D)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 5796
.PNG........IHDR..............5M.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...FIDATx...{.\e.....;.."..V.(..5...#...xI....4...Ü4.b..T"(^.....
...H.1DCLH..D.Th..Q... BD......<.......s....>...Nvv.g...|....)v.
.`Dl......e6...H.&&....:. .............:. .............:. .. .........
.:..:. .............:. .............:. .. ........S[.......t.ds..q..7.
..~ .O.3  .@..sL........3.....rc.......N....-.s.eq|g...A.Jv..7.}/.)...
f.....ls.....K.....9.....%....{o......^; .@.z!....-..U.... ...(Y..._..
....7N.k@.t...>,...~[..t.........o......G..!.Jv.....]....;canz.0%..
....Ow....].W...xbs7.s.D,..P.......yI...p,l..H...A7.@)z..........Q..MG
..o.A...|......sy<z...x....A.J..........O...',..O..@..b.>.......
.........z.A.....=....-.J.....>........?.....<=m0@..R...1....(..
W..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........
t.@...A..A.....g..=.  ...p.{.......t.@...A..A......t.@..@...A......t..
t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A..r'Ln..M.f 
@.......W...Ol~O.O....:P....4..mzW.q.u.../3& .@..?.-n.ze\3wq<wr....
.%{..7...|7...F.....l..q........>......%....{o.c..]~...t.P...|.yq..
...3/1 ..!.Jv....q.W._..8.........a.....QG..Jv..7..o{w.]x.`pT....d.xjw
|.............S.AA..J.tw>...k...]...R.cf....P._..3.......Gbq...r.t.
$O,<.....q..7....#O......E..#..E.]......v.d.A....?.........]..m&b._
..A......W..!..}u.;>E.......%y|qO...w.=..}....(.cyO<.9G^.Co .@.r
g......F.O..........:. .. ..........:..:. .............:. ............
.:. .. ..........:..:. .......u..S....-.......K.. ..........:..:. 
<<< skipped >>>

GET /tpl/images/public/scrollup_telsupport.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive
Cookie: __utma=12415148.1451469242.1400248624.1400248624.1400248624.1; __utmb=12415148.1.10.1400248624; __utmc=12415148; __utmz=12415148.1400248624.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:06 GMT
Last-Modified: Wed, 28 Aug 2013 06:15:08 GMT
Server: ECD (fcn/4033)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 5637
.PNG........IHDR...^...^........n....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx....|.E....=3..L&..!@..\.E.> O...*O.....*..............
.o.[..CAP.VYNY..9....r.;.I...W..5...If&...>.JwO.>......_.5.h..r.
.)......eQ.|..>.,.-.}E.U......o..c.@..X.eq....kZ..I.`0........4.. .
....~..@q......u......8..y.vvzz~?.jYItA.&..J.:......`.z9.}.......&.!J.
......@...S.N.L?.i..V.......^... G"..d$Y&A.3........%........D?.h..WM.
..9p1.V.0b..H.N.d.rJ...}..e. ..|@6/...x.B...:.. ..?.....-......:TK..u.
..XY....o...O...@..OoF....&...S0Y.h3....p..d....9d.7e..(....... ..x#l]
.@.z.tJ~o)9.}..F."zT....H......*g.`.........i.]u.M.B.... [...>6.~.B
s.{...Nj*...oBJ......a....OQ7t1=rh..C..J....7<e.^.....3..JG....~Kz~
.....d.OX;e......n@..([..Wk.?....)..d.w..)\x}.fzL..O.x...e..Ac.S.."..)
..'...ba.......l<. .~. #g)5-.q6%...|..Te...:..$\.:. .:.,..2.K../...
.....Q...<.U_M.i8[.dH....wh..f'Z.b......u.r..8 ..F...O}$....zdc..q.
.m....?j.z._B].\t.@2Yz.._x.z=.5W...[.xI.b....{.6Y..J..}...3..|.&^.....
H.d?=..=p.x....^...Jq.WM..e..0@g........Hr..E.....Bv..........N.&.....
...:...L.:..2..F.w.1.........;_K.&..N.........rZ.r. .Q8..g:..X.{s.p...
..Zss..f:J9.G...b...1.....s#.^.....gt.1...D.,\...H.7.......)...p..M^$.
.....%.'1(.2...s.m......j.........B....>;.j......mu......'.W.>..
{.S...`@...(...^.&..#IF..@.Ez .IY..,......2P.2.........&.@je).....[..w
..GN4N...^B.uJ"..).<...[....A.d..$...[Sp.Af.........E.nm4g.(.I....,
...W.J....m.$..aE.......6.n....fWX...H...E;..$B.........4..FI.k0.i6h..
-.z.|.>L......[.......G....e...z..........P-..\.d{.p..#.7..D`..
<<< skipped >>>


GET /cgi/getcountry.cgi HTTP/1.1
Accept: */*
User-Agent: THttpDownload
Host: api.mybrowserbar.com


HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:55:03 GMT
Server: Apache
Content-Length: 2
Content-Type: text/plain
UAHTTP/1.1 200 OK..Date: Fri, 16 May 2014 13:55:03 GMT..Server: Apache
..Content-Length: 2..Content-Type: text/plain..UA..



GET /ga.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 16 May 2014 08:18:29 GMT
Expires: Fri, 16 May 2014 20:18:29 GMT
Last-Modified: Thu, 08 May 2014 18:54:47 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15790
Cache-Control: public, max-age=43200
Age: 20314
Alternate-Protocol: 80:quic
...........}kw.:............Io@R..........l.,.iH.....$...3#......s.z7.
.<..e4....x2.Y/.....>^.<.C.D......j...0c!...qo.....A*....L&..
x.K..w.*8..%.<..|..)d.X.......&..*... .Q...(.....8..q..\.!...a..0..
.$.tX..N&..a?!..zB:l.8c9.p.....;l..x.$c.]AP\..>..B...&..:pz.H......
..g...Ap..!.5..K......V;l.H.....V.a.....s.$p......39...a.a.P'9.b.;H>
;N.$..A..... ..^..{h.h...2l_..N...w9..d.@.`._.N..7..|....%.d.%......%.
{.....&.@.I..:....F.{..c.nzP*..a..LzP.sl...V..y.U8*&.......}.BH@..ZC..
.Ty. u.Y...!..R.h.V..h./>3...*.P..(..:A.}..v.C ..M..Vk.......\..d..
..he.q..u.u..yE./J.Re..|:u..L...B..E..Tn/v \.<...8..MU.g.....{.`..}
.;n.....x................4...kG..[q....0r7.....l.n?..@|.%W.g....V..../
.a......P`....t W.VNq.#.......}.WL....,X.a....{..*..!<W.......e.{.$
.e......[......S....(.).K..........>....X5o{i&.X..A.F.T"h.....KB...
^]..f..z3.jyYcy......@..#Y*.z.Jl.#w...S...^..a..A..F....q.!...6~...1..
..P.......`..= .M.(.^.@.5.L...y..P.".v.........L...R.....[...fx....o..
.K...s..!..........oa.F..V......)..ym...;......a..r..N. ....Y.5o.u|..K
...}l[i.....N.-%...4.I..(..'.....PR..gnAx...A.D.....w..5W..m. .....Zno
........d<hpf...s.e#..v...p..g...[.G.k.2.c.6.....5..Lcc.fUm/.P!....
!U.c.......d78!7.......V>&."..Q$.....&.sS..Kq....].UySz=..3..$.".;.
.".'.Kar\[...t\....;...h._.O..b...2....{=H9@...v0l)2!..xD7...T..Di.w.R
C`.m.8.\....J....h..u{{.....p..)..O3.W.........k...y.`^ ....&1..f"..D.
W.}.;D:d.F....p#... ......d...T..iU7n.;-hh..T..^P....U.....>...T..m
....fC....>..>d..Q..!....X1......7L...[.........;.w...[L.LB.
<<< skipped >>>

GET /__utm.gif?utmwv=5.5.1&utms=1&utmn=59086221&utmhn=VVV.iobit.com&utmcs=utf-8&utmsr=1716x901&utmvp=772x419&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Thank you for installing Advanced SystemCare Free - IObit&utmhid=135091032&utmr=-&utmp=/install/asc/7/en.php&utmht=1400248624885&utmac=UA-1447202-1&utmcc=__utma=12415148.1451469242.1400248624.1400248624.1400248624.1;+__utmz=12415148.1400248624.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=qh~ HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 15 May 2014 08:29:12 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 106072
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 15 May 2014 08:29:12 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 106072..Alternate-Protocol: 80:quic..GIF89a............
.,...........D..;..



GET /infofiles/asc7/update.ini HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=1420-2839


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 1420-2839/5678
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:20 GMT
Etag: "955381131"
Expires: Fri, 23 May 2014 13:57:20 GMT
Last-Modified: Wed, 14 May 2014 04:26:50 GMT
Server: ECAcc (fra/D4B8)
X-Cache: HIT
Content-Length: 1420
Connection: close
ion=1..EnableIngoreVer=1 .FreeDays=10..TechSupport=1..SPFixEnable=1..[
Toolbox].Version=201404021543.Url=hXXp://update.iobit.com/infofiles/as
c7/Toolbox20140402-700.upt.md5=34CEE869BB6FD93F738D05CCF755AE0E.[Toolb
ox_N].Version=201404021543.Url=hXXp://update.iobit.com/infofiles/asc7/
Toolbox20140402-710.upt.md5=27D44334F65591CBE9A8A3684B17E207..[Toolbox
_NN].Version=201405061755.Url=hXXp://update.iobit.com/infofiles/asc7/T
oolbox20140506-730.upt.md5=FFEFAF9790D97D33801AE5AB49416BB0..[Free].Ve
rsion=201405056666.Url=hXXp://update.iobit.com/infofiles/asc7/Freeware
20140505.upt.md5=0B24B5D63B5598C5B002D84F31CD2778....[RegOption].LD=3.
FGLEnable=0.Save=70%...[RegList].2057=1.1033=1.1043=1.1031=1.1040=1.10
36=1...[AutoCleanOption].AutoCleanTime=3.AutoCleanNum=150.AutoCleanSiz
e=500...[NotificationCW]..[NotificationCB]...[UseASCOption].UseASCEnab
le=1.UseASCTime=7...[ErrorOpt].Nol=0.ECount=1.Sep=60.CouW=1033;2057;30
81;4105;6153..[LatestNews].MultiMode=0...[SP].ShowAD=0.URL=//test.iobi
t.com/plug/data/js/data.js...[Mobile].MobileTip=0...[ASmeTiCQaM].PRTi=
7.QSTi=7.SATi=1..[VulXPSer].LocalScan=0..[VulXP_English].Version=20140
4231656.Url=hXXp://update.iobit.com/infofiles/asc7/VulXP_English0423.u
pt.md5=55421BC69997D0319C8F78E2ED3BE410.BI=..[VulXP_Japanese].Version=
201404231656.Url=hXXp://update.iobit.com/infofiles/asc7/VulXP_Japanese
0423.upt.md5=9F9876B38FB66C7D074D782AD297C1E4.BI=..[VulXP_Portuguese(B
ra)].Version=2014042..
<<< skipped >>>


HEAD /v9/1/windowsupdate/redir/muv4wuredir.cab?1405161357 HTTP/1.1
Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 16873
Content-Type: application/octet-stream
Last-Modified: Tue, 10 Jul 2012 01:49:07 GMT
Accept-Ranges: bytes
ETag: "23754f313e5ecd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 16 May 2014 13:57:07 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
HTTP/1.1 200 OK..Content-Length: 16873..Content-Type: application/octe
t-stream..Last-Modified: Tue, 10 Jul 2012 01:49:07 GMT..Accept-Ranges:
 bytes..ETag: "23754f313e5ecd1:0"..Server: Microsoft-IIS/7.5..X-Powere
d-By: ASP.NET..Date: Fri, 16 May 2014 13:57:07 GMT..Connection: keep-a
live..X-CCC: RU..X-CID: 2......


GET /msdownload/update/common/2013/10/9604340_0c5db9d224cda7607c03c7692a04f114b50d48d6.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 02 Oct 2013 20:23:06 GMT
Accept-Ranges: bytes
ETag: "071d233adbfce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7468
Date: Fri, 16 May 2014 13:57:13 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....,.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/10/9604341_ed165fc8817cd2c8175cb461a3f9979c1e7b791f.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 02 Oct 2013 20:23:06 GMT
Accept-Ranges: bytes
ETag: "071d233adbfce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7476
Date: Fri, 16 May 2014 13:57:14 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....4.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/software/dflt/2012/02/4913552_4a5c9563d1f58c77f30d0d5c9999e4b8bff3ab21.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 09 Feb 2012 05:59:10 GMT
Accept-Ranges: bytes
ETag: "0cbe4f0efe6cc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7490
Date: Fri, 16 May 2014 13:57:14 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....B.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/software/dflt/2012/02/4913553_ac3a4ee80dc95dc158332edcfab906b9f1c98407.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 09 Feb 2012 05:59:10 GMT
Accept-Ranges: bytes
ETag: "0cbe4f0efe6cc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7494
Date: Fri, 16 May 2014 13:57:14 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....F.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/04/7713532_a048313f998ae00a62392b45708c4df5d25a67c5.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 04 Apr 2013 17:04:55 GMT
Accept-Ranges: bytes
ETag: "801577875631ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7980
Date: Fri, 16 May 2014 13:57:14 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....,.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/software/dflt/2010/10/4024164_4bfcd823305a2d2cefd6de1b2f423281399e1e60.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 06 Oct 2010 04:02:04 GMT
Accept-Ranges: bytes
ETag: "063f3cb65cb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7688
Date: Fri, 16 May 2014 13:57:14 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/05/8029852_e661f94f3d41f45c1741ae9eea079c69cd10f9e6.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 07 May 2013 22:38:22 GMT
Accept-Ranges: bytes
ETag: "0c33294734bce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7998
Date: Fri, 16 May 2014 13:57:14 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....>.......0..................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2014/02/11119042_3621c4aa669986bf03749492daaa2c929a80c048.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 06 Feb 2014 01:02:32 GMT
Accept-Ranges: bytes
ETag: "0842f1dd722cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7393
Date: Fri, 16 May 2014 13:57:14 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2014/03/11515603_f728a5e994025c7f72ffeb309927dc83cd4297f5.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 06 Mar 2014 08:30:10 GMT
Accept-Ranges: bytes
ETag: "0155e491639cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7981
Date: Fri, 16 May 2014 13:57:14 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....-.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/05/5564132_7b95c88a1f13f92396b74192b823aba35be6d137.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 17 May 2012 01:17:27 GMT
Accept-Ranges: bytes
ETag: "802d67d2ca33cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7176
Date: Fri, 16 May 2014 13:57:14 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/11/6209138_5efaadb6bdb9a108c199c3943eea41fec24e6d10.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 08 Nov 2012 01:54:30 GMT
Accept-Ranges: bytes
ETag: "04fb4fd53bdcd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7442
Date: Fri, 16 May 2014 13:57:19 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/10/9753935_9d9565c63a854610566e010b57ea937e5d8d7213.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 15 Oct 2013 22:34:56 GMT
Accept-Ranges: bytes
ETag: "068ebc5f6c9ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7454
Date: Fri, 16 May 2014 13:57:19 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/10/9753936_0d780f874c43f7ecf960e9fa48cf9e01927c86c6.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 15 Oct 2013 22:34:57 GMT
Accept-Ranges: bytes
ETag: "80fe83c6f6c9ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7424
Date: Fri, 16 May 2014 13:57:19 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/10/9753937_c231051b393eea476ba3b283b2e0b9bf14825c66.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 15 Oct 2013 22:34:57 GMT
Accept-Ranges: bytes
ETag: "80fe83c6f6c9ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7416
Date: Fri, 16 May 2014 13:57:20 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/06/8237551_9e4004019624b35d8eaf7e5f2f024bcf11f601cd.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 05 Jun 2013 22:32:28 GMT
Accept-Ranges: bytes
ETag: "0662d8f3c62ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7398
Date: Fri, 16 May 2014 13:57:20 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/11/10112210_00f7f2ae2300a15330c2f2d1b0d2ddf823e35d24.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 20 Nov 2013 07:14:51 GMT
Accept-Ranges: bytes
ETag: "80e7b34c0e5ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7143
Date: Fri, 16 May 2014 13:57:20 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/01/6714603_cef25f4e4cab4b9a20050f0b35a9e9447ba1e167.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 01 Jan 2013 00:51:57 GMT
Accept-Ranges: bytes
ETag: "8074c33bae7cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7512
Date: Fri, 16 May 2014 13:57:20 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....X.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/06/8237717_a1f6cd38f200cd87c90597b4d17ef518fd78163a.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 05 Jun 2013 22:44:18 GMT
Accept-Ranges: bytes
ETag: "0cd5e363e62ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7970
Date: Fri, 16 May 2014 13:57:20 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....".......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/04/7702469_c8c1bbbb4e63103fc9dbffecc5a4a0e5030e7724.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 03 Apr 2013 20:36:07 GMT
Accept-Ranges: bytes
ETag: "801527deaa30ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8190
Date: Fri, 16 May 2014 13:57:20 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/07/5620137_3687a255bb8c4c09875d642385d75b2feefdc86d.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Mon, 02 Jul 2012 21:23:53 GMT
Accept-Ranges: bytes
ETag: "80bad2fa9858cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7180
Date: Fri, 16 May 2014 13:57:20 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2014/02/11119041_ea303f6d073d4b03f283eb6accb85e0af43f31c2.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 06 Feb 2014 01:02:32 GMT
Accept-Ranges: bytes
ETag: "0842f1dd722cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7391
Date: Fri, 16 May 2014 13:57:20 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2014/04/11836921_c05de51c64c3389d2a69f0652aa9b69e3bbdaf47.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 02 Apr 2014 23:45:03 GMT
Accept-Ranges: bytes
ETag: "80694c91cd4ecf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7987
Date: Fri, 16 May 2014 13:57:22 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....3.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2014/05/12124517_c25491546d9eb26b6ab3d471ffc12a7a2ea71f2e.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 01 May 2014 04:47:49 GMT
Accept-Ranges: bytes
ETag: "808a580f864cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7565
Date: Fri, 16 May 2014 13:57:22 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/05/5528367_0a979fc5090b0d30186ca6efed3b5615d839010e.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 01 May 2012 20:29:27 GMT
Accept-Ranges: bytes
ETag: "802d861ad927cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7504
Date: Fri, 16 May 2014 13:57:23 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....P.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/05/5528368_15aadc728b34379c3634b5bea68cc71d1575ef8c.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 01 May 2012 20:29:27 GMT
Accept-Ranges: bytes
ETag: "802d861ad927cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7504
Date: Fri, 16 May 2014 13:57:23 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....P.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/08/9135386_21712423b63a5b10201f565110e92be5b11203fa.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 28 Aug 2013 23:53:12 GMT
Accept-Ranges: bytes
ETag: "02420c149a4ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 18710
Date: Fri, 16 May 2014 13:57:23 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF.....I......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/software/dflt/2011/08/4795498_00b016a367b61b9f2b2502b3fbbe920238d79fa4.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 24 Aug 2011 22:14:41 GMT
Accept-Ranges: bytes
ETag: "80de4638ab62cc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7488
Date: Fri, 16 May 2014 13:57:23 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....@.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/12/10254369_498a6cb8a5004c77aa6ab4eac10ae707b38c1df0.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 05 Dec 2013 00:20:12 GMT
Accept-Ranges: bytes
ETag: "0634c34ff1ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7983
Date: Fri, 16 May 2014 13:57:23 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF..../.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/software/dflt/2011/08/4795508_f50782ed017052ac3e266a7449c76c184bfdb06f.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 24 Aug 2011 22:15:29 GMT
Accept-Ranges: bytes
ETag: "8016e354ab62cc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7542
Date: Fri, 16 May 2014 13:57:23 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....v.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/12/10254389_b60ff292bb728dabee22c72f065f46e44a0a5a65.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 05 Dec 2013 00:20:14 GMT
Accept-Ranges: bytes
ETag: "03365c44ff1ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8419
Date: Fri, 16 May 2014 13:57:23 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF..... ......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/05/5564131_f86ea026f581bb040672a26ac8d74b1d1556278b.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 17 May 2012 01:17:27 GMT
Accept-Ranges: bytes
ETag: "802d67d2ca33cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7186
Date: Fri, 16 May 2014 13:57:23 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/10/9604337_0729cf0fe7675971fd7cc3454baffc29a774ec1c.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 02 Oct 2013 20:22:54 GMT
Accept-Ranges: bytes
ETag: "063ab2cadbfce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7314
Date: Fri, 16 May 2014 13:57:23 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/01/6715515_763ba89cd5f4536ca6991e9159e3ddc8ae5d8599.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 01 Jan 2013 03:49:21 GMT
Accept-Ranges: bytes
ETag: "80f65dfbd2e7cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7402
Date: Fri, 16 May 2014 13:57:27 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/05/5564113_89a37169c3e0a55a7c64536175abe6d2fba0a857.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 17 May 2012 01:10:46 GMT
Accept-Ranges: bytes
ETag: "06f63e3c933cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7178
Date: Fri, 16 May 2014 13:57:27 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/11/9991186_601f61c20666afe79f3aafdaeb8854cc323ad364.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 07 Nov 2013 07:45:08 GMT
Accept-Ranges: bytes
ETag: "05ab1478ddbce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7986
Date: Fri, 16 May 2014 13:57:27 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....2.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/11/9991206_d8756635615636b1d642df9f52d78c6f2c7f1421.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 07 Nov 2013 07:45:10 GMT
Accept-Ranges: bytes
ETag: "087e2488ddbce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8392
Date: Fri, 16 May 2014 13:57:27 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF..... ......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/11/6209433_d5e3ec1ad613892f31feaddb3629c861825374f2.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 08 Nov 2012 03:12:11 GMT
Accept-Ranges: bytes
ETag: "8077e0d75ebdcd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7180
Date: Fri, 16 May 2014 13:57:28 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/11/6209434_ef143fdf2760eb3a2d7248d126abbd5388caf296.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 08 Nov 2012 03:12:11 GMT
Accept-Ranges: bytes
ETag: "8077e0d75ebdcd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7176
Date: Fri, 16 May 2014 13:57:28 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/06/8237550_a6b07a34e0b146ad8b3f794cd5c0d817a0e5b4af.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 05 Jun 2013 22:32:28 GMT
Accept-Ranges: bytes
ETag: "0662d8f3c62ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7396
Date: Fri, 16 May 2014 13:57:28 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/07/5620136_0cfbe8351461f278e16b2632d83b8f28a2eb65b5.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Mon, 02 Jul 2012 21:23:53 GMT
Accept-Ranges: bytes
ETag: "80bad2fa9858cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7176
Date: Fri, 16 May 2014 13:57:28 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/07/8488812_b964589baa41b78f80ae5cd0899217e9b9811f43.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 03 Jul 2013 01:43:46 GMT
Accept-Ranges: bytes
ETag: "075c0c18e77ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7318
Date: Fri, 16 May 2014 13:57:28 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/07/8488784_d53528d30a9637f7039aa477140899acca01527a.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 03 Jul 2013 01:41:57 GMT
Accept-Ranges: bytes
ETag: "8060c8808e77ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7240
Date: Fri, 16 May 2014 13:57:31 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....H.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/07/8488785_131639c0b6410eb7fa219d3bfe16714f6474a804.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 03 Jul 2013 01:41:57 GMT
Accept-Ranges: bytes
ETag: "8060c8808e77ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7240
Date: Fri, 16 May 2014 13:57:31 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....H.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/06/8237736_b1c5a4e1ed93aabd218ec2a9fa0cdd71289c6a5c.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 05 Jun 2013 22:44:20 GMT
Accept-Ranges: bytes
ETag: "0fa8f373e62ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8270
Date: Fri, 16 May 2014 13:57:32 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....N ......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2014/02/11117585_38910c838c8bfec6fdbb9b493971d1e64a38480a.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 05 Feb 2014 22:41:09 GMT
Accept-Ranges: bytes
ETag: "8070ec5cc322cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7393
Date: Fri, 16 May 2014 13:57:32 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/04/7702450_12138692d032372880efac823b339b3df4d8756f.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 03 Apr 2013 20:36:05 GMT
Accept-Ranges: bytes
ETag: "80e8f5dcaa30ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8270
Date: Fri, 16 May 2014 13:57:32 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....N ......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/11/9990883_419fe69b15353c8e422af2e43f898de896bf204d.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 07 Nov 2013 07:14:44 GMT
Accept-Ranges: bytes
ETag: "0a81889dbce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 13578
Date: Fri, 16 May 2014 13:57:32 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF.....5......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/10/9792613_272415a27f02b0988b5bab0a24bb26d82893b82e.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Fri, 18 Oct 2013 23:19:36 GMT
Accept-Ranges: bytes
ETag: "034908258ccce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7400
Date: Fri, 16 May 2014 13:57:32 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/11/6209137_e308a833ad92c6d2d33a14eceeb4f4b5bca2298e.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 08 Nov 2012 01:54:30 GMT
Accept-Ranges: bytes
ETag: "04fb4fd53bdcd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7448
Date: Fri, 16 May 2014 13:57:32 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/10/9605649_3e1d843c9c150bcf8bcdb2fd2c6f0b03f81498a5.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 02 Oct 2013 22:26:38 GMT
Accept-Ranges: bytes
ETag: "0e3b775bebfce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7978
Date: Fri, 16 May 2014 13:57:32 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....*.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2014/03/11502131_e02562c9316bcd4202f06d4ed53b176c8eb03066.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 05 Mar 2014 08:48:52 GMT
Accept-Ranges: bytes
ETag: "0f2b7bb4f38cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8141
Date: Fri, 16 May 2014 13:57:32 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/01/6715516_2b4d9f954c7bd6525a099799dc55fa71ab9e1497.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 01 Jan 2013 03:49:21 GMT
Accept-Ranges: bytes
ETag: "80f65dfbd2e7cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7400
Date: Fri, 16 May 2014 13:57:32 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/01/6714683_33195582ccd32555439f3e4d9d8039ec3bfaf478.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 01 Jan 2013 01:02:25 GMT
Accept-Ranges: bytes
ETag: "80a65da9bbe7cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7166
Date: Fri, 16 May 2014 13:57:35 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/10/9604338_8adc65b64d80f6fa9396f0a5e7c90e013825d256.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 02 Oct 2013 20:22:54 GMT
Accept-Ranges: bytes
ETag: "063ab2cadbfce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7312
Date: Fri, 16 May 2014 13:57:35 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/05/8023447_535766bc83162b5e6836b322d94af4e08b542261.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 07 May 2013 16:37:58 GMT
Accept-Ranges: bytes
ETag: "0374a3b414bce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8222
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF..... ......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/05/8044982_a9ae62cdac168c8d2ede6caf824b634c26a2089e.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 08 May 2013 22:28:42 GMT
Accept-Ranges: bytes
ETag: "089e7643b4cce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7492
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....D.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/07/8490218_028a33804a43d782431b5398456a54bf40c90485.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 03 Jul 2013 06:55:13 GMT
Accept-Ranges: bytes
ETag: "a187a244ba77ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7964
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/software/dflt/2011/12/4888075_94656c9b348179ab25ab2f76bad55c00f65aef50.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 28 Dec 2011 22:53:45 GMT
Accept-Ranges: bytes
ETag: "8062758db3c5cc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7464
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....(.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/07/8490237_75712a27141bc73139aea3a464a19c3fb8d64ec2.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 03 Jul 2013 06:55:15 GMT
Accept-Ranges: bytes
ETag: "808b4345ba77ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8286
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....^ ......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/software/dflt/2011/12/4888074_81a32e075ffea721e751881afe4b61ec6e12a4b7.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 28 Dec 2011 22:53:45 GMT
Accept-Ranges: bytes
ETag: "8062758db3c5cc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7470
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2012/05/5564112_1cac752b2905368b2f1e44dba61a2dd5830b1e83.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 17 May 2012 01:10:46 GMT
Accept-Ranges: bytes
ETag: "06f63e3c933cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7186
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/09/9234520_bbbb0260395e06ef86927f9316c6f1261abf4ec6.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 05 Sep 2013 17:23:24 GMT
Accept-Ranges: bytes
ETag: "5b3794a05caace1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7986
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....2.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2014/02/11168660_b205ddcda9b2a2ae614c36069cd5e1822e9b0a0d.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Fri, 07 Feb 2014 23:22:51 GMT
Accept-Ranges: bytes
ETag: "80d7e855b24cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7985
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....1.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2014/02/11168680_990b04cd1c5b5d0d22a8ad3c292ecb90e46401ef.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Fri, 07 Feb 2014 23:22:53 GMT
Accept-Ranges: bytes
ETag: "80440865b24cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7977
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....).......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/08/8827627_2d29df498412cafcf92d89a145f7a9e5d9f1510e.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 06 Aug 2013 20:47:03 GMT
Accept-Ranges: bytes
ETag: "807dcb1ae692ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8318
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....~ ......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2014/02/11117586_9f19f48a64e6020e63972b000aeb9ad22cce9f3d.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 05 Feb 2014 22:41:09 GMT
Accept-Ranges: bytes
ETag: "8070ec5cc322cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7391
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/08/8827608_800c359fe55d13e693c98173729421be04a5874c.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 06 Aug 2013 20:47:01 GMT
Accept-Ranges: bytes
ETag: "80509a19e692ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7960
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/09/9234540_ab0e6f0ebcc61aba56f9df0a80eb37c67d510806.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 05 Sep 2013 17:23:27 GMT
Accept-Ranges: bytes
ETag: "8051e2a15caace1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8344
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF..... ......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/01/6714684_2a98a5fd78784b4aaa3fbba8a5c7c3c5654e8eb3.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 01 Jan 2013 01:02:25 GMT
Accept-Ranges: bytes
ETag: "80a65da9bbe7cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7172
Date: Fri, 16 May 2014 13:57:36 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/10/9605669_58f88240b9a3064af7111aeaf4cc7e87c53c7778.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 02 Oct 2013 22:26:40 GMT
Accept-Ranges: bytes
ETag: "010e976bebfce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8380
Date: Fri, 16 May 2014 13:57:39 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF..... ......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/software/dflt/2011/08/4795507_8d99e78ef861cb5ac870cd806f6f636d1e210947.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 24 Aug 2011 22:15:29 GMT
Accept-Ranges: bytes
ETag: "8016e354ab62cc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7550
Date: Fri, 16 May 2014 13:57:39 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....~.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/07/8488813_c0fca05893b48587fe3aac536d7862071ea50297.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 03 Jul 2013 01:43:46 GMT
Accept-Ranges: bytes
ETag: "075c0c18e77ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7314
Date: Fri, 16 May 2014 13:57:39 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/01/6714604_9fef2d02229f82e8815ba832c198ffc16b89d360.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 01 Jan 2013 00:51:57 GMT
Accept-Ranges: bytes
ETag: "8074c33bae7cd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7512
Date: Fri, 16 May 2014 13:57:39 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....X.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/05/8023428_e2e9cf5aaf1e27d3041b19ac6a6c68556ce1c7f6.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 07 May 2013 16:37:56 GMT
Accept-Ranges: bytes
ETag: "0a193a414bce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7958
Date: Fri, 16 May 2014 13:57:39 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/08/8828314_e5891b716842f8ab3ed2ac3e3ca632a6a43b6c96.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 06 Aug 2013 22:13:41 GMT
Accept-Ranges: bytes
ETag: "8058b35f292ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7416
Date: Fri, 16 May 2014 13:57:39 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/common/2013/08/8828315_e8282eaddcf3c8db412a1bc3d421816c12030065.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 06 Aug 2013 22:13:41 GMT
Accept-Ranges: bytes
ETag: "8058b35f292ce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7414
Date: Fri, 16 May 2014 13:57:40 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /msdownload/update/software/dflt/2011/08/4795499_5062707b2be6d5db6c506f5538cb08cfde487a10.cab HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 24 Aug 2011 22:14:41 GMT
Accept-Ranges: bytes
ETag: "80de4638ab62cc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 7480
Date: Fri, 16 May 2014 13:57:40 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF....8.......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

HEAD /v9/1/windowsupdate/redir/muv4wuredir.cab?1405161357 HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 16873
Content-Type: application/octet-stream
Last-Modified: Tue, 10 Jul 2012 01:49:07 GMT
Accept-Ranges: bytes
ETag: "23754f313e5ecd1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 16 May 2014 13:57:44 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
HTTP/1.1 200 OK..Content-Length: 16873..Content-Type: application/octe
t-stream..Last-Modified: Tue, 10 Jul 2012 01:49:07 GMT..Accept-Ranges:
 bytes..ETag: "23754f313e5ecd1:0"..Server: Microsoft-IIS/7.5..X-Powere
d-By: ASP.NET..Date: Fri, 16 May 2014 13:57:44 GMT..Connection: keep-a
live..X-CCC: RU..X-CID: 2..



GET /fwlink/?LinkId=121315 HTTP/1.1
Accept: */*
If-Modified-Since: Wed, 14 May 2014 09:05:09 GMT
A-IM: feed
Accept-Language: en-us
User-Agent: Windows-RSS-Platform/2.0 (MSIE 8.0; Windows NT 5.1)
Accept-Encoding: gzip, deflate
Host: go.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: MC1=V=4&GUID=489b59b88cff45798f407a73595398d1&HASH=&LV=&LU=1399967980436; MUID=0A913FA9C8A8659523DB3BDACCA8654E; A=I&I=AxUFAAAAAADeCAAAHzo oRxHEvEmTSqmQz02rg!!&V=4; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20140513


HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Expires: Fri, 16 May 2014 13:56:29 GMT
Location: hXXp://iegallery.com/en/ie8slice/default.aspx
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Fri, 16 May 2014 13:57:29 GMT
Content-Length: 162
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://iegal
lery.com/en/ie8slice/default.aspx">here</a>.</h2>..<
/body></html>..HTTP/1.1 302 Found..Cache-Control: private..Co
ntent-Type: text/html; charset=utf-8..Expires: Fri, 16 May 2014 13:56:
29 GMT..Location: hXXp://iegallery.com/en/ie8slice/default.aspx..Serve
r: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.N
ET..Date: Fri, 16 May 2014 13:57:29 GMT..Content-Length: 162..<html
><head><title>Object moved</title></head>&l
t;body>..<h2>Object moved to <a href="hXXp://iegallery.com
/en/ie8slice/default.aspx">here</a>.</h2>..</body>
;</html>......


GET /fwlink/?LinkId=68929 HTTP/1.1


Accept: */*
If-Modified-Since: Mon, 05 May 2014 17:21:30 GMT
If-None-Match: "091d748668cf1:0"
A-IM: feed
Accept-Language: en-us
User-Agent: Windows-RSS-Platform/2.0 (MSIE 8.0; Windows NT 5.1)
Accept-Encoding: gzip, deflate
Host: go.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: MC1=V=4&GUID=489b59b88cff45798f407a73595398d1&HASH=&LV=&LU=1399967980436; MUID=0A913FA9C8A8659523DB3BDACCA8654E; A=I&I=AxUFAAAAAADeCAAAHzo oRxHEvEmTSqmQz02rg!!&V=4; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20140513


HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Expires: Fri, 16 May 2014 13:56:30 GMT
Location: hXXp://VVV.microsoft.com/atwork/community/rss.xml
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Fri, 16 May 2014 13:57:29 GMT
Content-Length: 166
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://VVV.m
icrosoft.com/atwork/community/rss.xml">here</a>.</h2>..
</body></html>..HTTP/1.1 302 Found..Cache-Control: private
..Content-Type: text/html; charset=utf-8..Expires: Fri, 16 May 2014 13
:56:30 GMT..Location: hXXp://VVV.microsoft.com/atwork/community/rss.xm
l..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-B
y: ASP.NET..Date: Fri, 16 May 2014 13:57:29 GMT..Content-Length: 166..
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://VVV.m
icrosoft.com/atwork/community/rss.xml">here</a>.</h2>..
</body></html>......


GET /fwlink/?LinkId=68928 HTTP/1.1


Accept: */*
If-Modified-Since: Mon, 05 May 2014 17:15:09 GMT
If-None-Match: "80c5918568cf1:0"
A-IM: feed
Accept-Language: en-us
User-Agent: Windows-RSS-Platform/2.0 (MSIE 8.0; Windows NT 5.1)
Accept-Encoding: gzip, deflate
Host: go.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: MC1=V=4&GUID=489b59b88cff45798f407a73595398d1&HASH=&LV=&LU=1399967980436; MUID=0A913FA9C8A8659523DB3BDACCA8654E; A=I&I=AxUFAAAAAADeCAAAHzo oRxHEvEmTSqmQz02rg!!&V=4; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20140513


HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Expires: Fri, 16 May 2014 13:56:31 GMT
Location: hXXp://VVV.microsoft.com/athome/community/rss.xml
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Fri, 16 May 2014 13:57:30 GMT
Content-Length: 166
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://VVV.m
icrosoft.com/athome/community/rss.xml">here</a>.</h2>..
</body></html>..HTTP/1.1 302 Found..Cache-Control: private
..Content-Type: text/html; charset=utf-8..Expires: Fri, 16 May 2014 13
:56:31 GMT..Location: hXXp://VVV.microsoft.com/athome/community/rss.xm
l..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-B
y: ASP.NET..Date: Fri, 16 May 2014 13:57:30 GMT..Content-Length: 166..
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://VVV.m
icrosoft.com/athome/community/rss.xml">here</a>.</h2>..
</body></html>....



POST /cgi/api.cgi/114576/8C9A823EF2F54A2DA307F9A0DD862C57/ping/14/73/ HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml
User-Agent: WidgiToolbar-182-114576
Host: VVV.mybrowserbar.com
Content-Length: 320
Connection: Keep-Alive
Cache-Control: no-cache

<drq><auth><ccv>182</ccv><cnid>114576</cnid><isn>8C9A823EF2F54A2DA307F9A0DD862C57</isn><ct>14</ct><dlid>1033</dlid><wv>5.1</wv><lngid>1033</lngid><brw><ie>8.0.6001.18702</ie><ff>29.0.1</ff><gc>34.0.1847.131</gc><dbrw>Internet Explorer</dbrw></brw></auth>
<ping><source_of_ping>far</source_of_ping><bn></bn></ping></drq>
HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:57:49 GMT
Server: Apache
Vary: Host
Pragma: no-cache
Cache-control: no-cache
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Fri, 16 May 2014 13:57:49 GMT
2b..<drp><auth>.  <scv>182</scv>.</auth>
.</drp>..0..HTTP/1.1 200 OK..Date: Fri, 16 May 2014 13:57:49 GMT
..Server: Apache..Vary: Host..Pragma: no-cache..Cache-control: no-cach
e..Keep-Alive: timeout=30, max=100..Connection: Keep-Alive..Transfer-E
ncoding: chunked..Content-Type: text/html..Expires: Fri, 16 May 2014 1
3:57:49 GMT..2b..<drp><auth>.  <scv>182</scv>.
</auth>.</drp>..0..



GET /infofiles/asc7/update.ini HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com


HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:20 GMT
Etag: "955381131"
Expires: Fri, 23 May 2014 13:57:20 GMT
Last-Modified: Wed, 14 May 2014 04:26:50 GMT
Server: ECAcc (fra/D4B8)
X-Cache: HIT
Content-Length: 5678
Connection: close
[Version].Main=7.3.0.454.Database=1722.FreeUrl=hXXp://VVV.iobit.com/up
date/asc/7/en.php.ProUrl=hXXp://VVV.iobit.com/update/asc/7/en.php.ProG
etUrl=hXXp://VVV.iobit.com/goto.php?id=event1&ref=latestversion..[ProU
pdate].DisplayName=Advanced SystemCare 7.AppName=A7Final.MD5=9E90664A5
F61B2FE2F78E18C13378AB8.Size=19939080.Info=Advanced SystemCare 7.0.5.3
60.IsKill=0..[ProUpdatePmt].AutoPmt=/sp- /verysilent /suppressmsgboxes
 /bigupgrade.Pmt=/sp- /silent /suppressmsgboxes /bigupgrade..[ProServe
r].0=hXXp://download.iobit.com/asc7/patch/asc7-setup-final.exe..[Serve
r].0=hXXp://update.iobit.com/dl/asc7/..[FDBOption].FDBZlib=0.FDBIsShow
=1.FDBMode=2.FDBVersion=7.0.0.834.FDBChkFile=Register.exe..[FDBFileLis
t].Register.exe=Register Update;2042176..[FDBMD5List].0=2EBBF65F25852F
69C790BB7DEE59DAC3..[FDBCheckFileList]..[FDBRun].Cmd=.Pmt=..[FDBDelte]
....[Update Details].Update Details=..[SafeUpdate].IsEnabled=0.SafeURL
=hXXp://VVV.iobit.com/update/asc/7/en.php..[ProUpgrade].ProMode=0.ProU
rl=hXXp://VVV.iobit.com/update/asc/7/en.php..[Zlib].Enable=0....[Check
Per].Per=AA..[DelayOption].MaxCount=3.Per=AA.Max=10.Min=1..Begin=9.End
=23..IngoreBegin=23.IngoreEnd=33...[LanguageWhite].Enable=0..[Language
List].2052=0.1055=0.1042=0.1046=0.1049=0.1059=0.2057=0.1033=0.1041=1..
[Shortcutfix_v9].Fix=0..[onlineusers].enable=1..[UpdateOption].ExpCanU
pdate=1..FileUpdateVer=20121204.DBFileUpdateVer=20121204.UpdateCheckTi
me=720..MinUpdateOption=1..EnableIngoreVer=1 .FreeDays=10..TechSupport
=1..SPFixEnable=1..[Toolbox].Version=201404021543.Url=hXXp://updat
<<< skipped >>>


GET /infofiles/asc7/update.ini HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=0-1419


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 0-1419/5678
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:20 GMT
Etag: "955381131"
Expires: Fri, 23 May 2014 13:57:20 GMT
Last-Modified: Wed, 14 May 2014 04:26:50 GMT
Server: ECAcc (fra/D4B8)
X-Cache: HIT
Content-Length: 1420
Connection: close
[Version].Main=7.3.0.454.Database=1722.FreeUrl=hXXp://VVV.iobit.com/up
date/asc/7/en.php.ProUrl=hXXp://VVV.iobit.com/update/asc/7/en.php.ProG
etUrl=hXXp://VVV.iobit.com/goto.php?id=event1&ref=latestversion..[ProU
pdate].DisplayName=Advanced SystemCare 7.AppName=A7Final.MD5=9E90664A5
F61B2FE2F78E18C13378AB8.Size=19939080.Info=Advanced SystemCare 7.0.5.3
60.IsKill=0..[ProUpdatePmt].AutoPmt=/sp- /verysilent /suppressmsgboxes
 /bigupgrade.Pmt=/sp- /silent /suppressmsgboxes /bigupgrade..[ProServe
r].0=hXXp://download.iobit.com/asc7/patch/asc7-setup-final.exe..[Serve
r].0=hXXp://update.iobit.com/dl/asc7/..[FDBOption].FDBZlib=0.FDBIsShow
=1.FDBMode=2.FDBVersion=7.0.0.834.FDBChkFile=Register.exe..[FDBFileLis
t].Register.exe=Register Update;2042176..[FDBMD5List].0=2EBBF65F25852F
69C790BB7DEE59DAC3..[FDBCheckFileList]..[FDBRun].Cmd=.Pmt=..[FDBDelte]
....[Update Details].Update Details=..[SafeUpdate].IsEnabled=0.SafeURL
=hXXp://VVV.iobit.com/update/asc/7/en.php..[ProUpgrade].ProMode=0.ProU
rl=hXXp://VVV.iobit.com/update/asc/7/en.php..[Zlib].Enable=0....[Check
Per].Per=AA..[DelayOption].MaxCount=3.Per=AA.Max=10.Min=1..Begin=9.End
=23..IngoreBegin=23.IngoreEnd=33...[LanguageWhite].Enable=0..[Language
List].2052=0.1055=0.1042=0.1046=0.1049=0.1059=0.2057=0.1033=0.1041=1..
[Shortcutfix_v9].Fix=0..[onlineusers].enable=1..[UpdateOption].ExpCanU
pdate=1..FileUpdateVer=20121204.DBFileUpdateVer=20121204.UpdateCheckTi
me=720..MinUpdateOpt..
<<< skipped >>>


GET /CSC3-2010.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: csc3-2010-crl.verisign.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Server: Apache
ETag: "91d24e3d84554f956c20acff0f023159:1400231412"
Last-Modified: Fri, 16 May 2014 09:10:12 GMT
Accept-Ranges: bytes
Content-Length: 127186
Date: Fri, 16 May 2014 13:57:39 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0....0.......0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1
.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://www
.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 C
A..140516090004Z..140530090004Z0....0!....c..k....D.k.....120708062201
Z0!... _...u.t.=.<.&...130218061114Z0!...&..].....P.k.:...120125130
117Z0!...7P.x....8.Q...s..130227010252Z0!...J.....Q..Y.[.....110404153
956Z0!...d...=..q!_...g9..130729145216Z0!...l.....h2<.H......120329
152211Z0!...q.9...`H.*.Y.C...120525202212Z0!...s...TM.......0...121221
080842Z0!...t..,.. ...eL.....130314222305Z0!...y..r.HW.v.....w..140423
054643Z0!..../u.......A..5...101214165045Z0!.....0.Xc...%...iM..121102
230226Z0!.......S.a&.X5t.E]..111206083350Z0!....c.(....B.[M83...140108
164517Z0!....A.Sv.....f,.....110609003155Z0!.....z......!.ID{]..101228
182208Z0!....b^......{d.J'...130102154110Z0!......0..........I..130912
181631Z0!....6e...~..T.......130131012247Z0!.........bD#*u......130226
223939Z0!.......@..'$.).;}\..130121172259Z0!....7.v..........n..120724
160733Z0!....P;.Y..d...c.(...120209181451Z0!.....].bb[.....!....140328
205453Z0!.....a...L`..IV.....130402103508Z0!......fFW.z.....@T..130117
000242Z0!...........].{7.....120730000000Z0!...".......Z.V.,.e..121031
192224Z0!...'....[.1......g..130318195659Z0!...,GI.jH.|...J.....120518
121623Z0!...<%a.=.d.......O..120424164254Z0!...@........... .a..121
109212441Z0!...L.&L..o.8..=6....110311141238Z0!...L...5...s $.=.=..130
205142241Z0!...O.c.........t....130109132228Z0!...X.BS.G]T.l.w.i..
<<< skipped >>>


GET /dl/asc730/asc7_setup_730_free_05161823.exe HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=19135374-28703060


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 19135374-28703060/38270744
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:55:11 GMT
Etag: "3919716597"
Expires: Fri, 23 May 2014 13:55:11 GMT
Last-Modified: Fri, 16 May 2014 10:33:22 GMT
Server: ECAcc (fra/D449)
X-Cache: HIT
Content-Length: 9567687
Connection: close
...|<.........e..W..Y....M|.r.#.&@....f...H....J..^..]..A.i.#.%.Y..
....{..iDO.Y..-...=*/V....O.;.x.S._l...I.....N.TZ...K.1....N..?.<..
A...]8'Bk.. $/....H9...r.].(..m.... ...f.^.?.8;uh.L...?....G.V......"y
....q"...._1.h...3...,.Y..Q.5...........~.#|J..h..l..........O.jV..6..
....[C.............M0.Q...............USq.%f..YS.N9{.q...9vh....qdm.=.
.k.c........R..6..62..s....>vic1dI..D..5..,..K).P5.S....rV..z......
.m2-.E..V\.*.b...B.D..rAm.%..3.......W.F..wG.YB|*....@......j.......u_
[.[....t1....[..*0.I...s$.4..[.R.Dz..k]...T....R..........[...&....xI~
>..z.X`....3..>.s...3..$...=.....YY...1-~..2.W.(.r]-..%S.0..'...
.b......Bu.7.(!..X.g..L=K.p..h..L.be~....t....?n...a,h...SzR.....p%..5
8....&x~.....<.=......-8.Hf..r.TU...N...g............q...N..\.qh...
U.Z.....H....P5......I7M./1..2.N9..d....w..1.....;C.7.../-......V..}..
l..6...r..r.2.U....58.7.I.3.I...5.>.....C.....J."8o..#....e: ......
&...0.[W.....6..K...b...._....\....Vk..a;}9g.....d.p5..6.T.~........F.
n........u..g/R"az.yA..5.n...o..U.K.|?..~.^=q..XAgo..s........M.sj<
Ns.cv.......xK.)...u.Sq.-......{.Cm.W#....4...JK...i.....x......F.....
~.......P*......g.(Ka.[.O...R..b^.O.-F.T.......(.i.!q~'..........F....
.j.?...W/L..t.h.]....C.M./..S......c.T.c....rN.6<.j.......~..dU.%m.
'. E..$.2...x.%...H.I..lG.\.....w....G^0...........c$.N..S7..Rbi.P_..&
Z.B...|......O.tv.M....k....7{...J......y.u..m, .3.._X8.G....F.W.x(.q.
}..U...=.!.574.....xX...C...%.....[.)..>.<......k.s..j.1/...h<
;....... #_B...-lCT..5`.<_.o./L.^....T...=..4.!...c....3/L..Y..
<<< skipped >>>


GET /templates/install/asc/7/img/itema.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:05 GMT
Server: ECD (fcn/4032)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 997
.PNG........IHDR.......Y.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Windows)" xmpMM:InstanceID="xmp.iid:9F785488744C11E38B83B5C8E
CCE8C44" xmpMM:DocumentID="xmp.did:9F785489744C11E38B83B5C8ECCE8C44"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9F785486744C11E38B8
3B5C8ECCE8C44" stRef:documentID="xmp.did:9F785487744C11E38B83B5C8ECCE8
C44"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>.u.f...ZIDATx...... ..P..O..,...(...;x......
B..O.Q.N.F...w.........t.w....m....9.{.N.e..&n.u....`.0..OQ{......IEND
.B`.....


GET /templates/install/asc/7/img/icon_10.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:14 GMT
Server: ECD (fcn/4036)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 580
.PNG........IHDR...!...........G.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.bloo.g``..@_....0..... . ... ...................<3....
....$b.!....x#...q1..............D2.K@.QD.T./$.!.o.Ps..}H..?)....l@,..
.8.xc3.Z!....P.......w..{.E..H#..[.X.M...U..>..e N'..Q....41.,..eWu
.....C.)Bs..da.DEE.....t.....D.5h9s...r..Y...I.x....._.l...[..Ah......
.....J.M.?..6......!.n.8..AKLu..j...&.|fJ...Z...@...T.~..6d.../p9B..g.
`....,4.A.... .J..H..P.<...B.J3..eh.....t....@<.... ..:..e.!.*C.
A....#...-..rr.=R....M.HQ6.........ZHi..47.!5..@.).s...m./,.!].. R.~.Z
f.#eK.h..^~...._.c.M.r.....IEND.B`.....


GET /templates/install/asc/7/img/icon_14.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:06 GMT
Server: ECD (fcn/4030)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 606
.PNG........IHDR.............(..V....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..._DCQ....f.QF..!=....zib,QF)=..=.....).SL..{.z).iz..b.i.
."b..i..Y...r...].G_>..s.......;.Q.T..TU.C..-`... ......eb.B......@
.DA^..!F...4G`F.O....8.{%.......iJ0..%.F..|..`.|.Fp.....1...`5....P..x
..A'..k{`..1..Q.(.?L..5..N.C.....9=....%..4.4.=.N.....tM...o .P.] ....
Oe.Li.k....(..gp.|.]..<..0..F.ShU=19.Q.U. .K2...c.*W...e.......kV.^
h..)..P.nYnX0......S....)..-.8k!.V.ZU.1 &.\...A.B..4M..._."q.....qN...
.....|.l.fh.J.;....L.vk .<.. ..A..y<....H......&.ip.... ...:/.MV
o.....0K.M...5|...M.D.....P..D.?z.k..G.....~r.o......IEND.B`...
..


GET /templates/install/asc/7/img/mony_back.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/jpeg
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:26:54 GMT
Server: ECD (fcn/4034)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 7010
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
..........................................................q.q.........
......................................................................
..........!..1.A"..QaBq..2R#.b...r3......C$........................!1.
AQa...q."...2BR#....b3..r4..............?..SB.B.B.B....r........:..{..
*...).....C..C..S.J4.."W..!..z...p.(q??...VB....\...9:.v....VN..@..3..
I..M...Z.i.U..'#jVg..?..*.w.-:.|.z......y,.:......S.Y.E...-...QB.B.B.B
.B.B.B.N....i.R......M....mC%.lpk....v....P2R.....;..rKK.e....u>...
.XI:p......an.....M.....Z...#.. ...F@.dw......_..........^.c.N..\...p{
..o.q.4s.N9..n...:..i.t....v...v...b].....`..#5.H..vD.,.#R.....?..l..C
.o.......O..8.....k..c4.X.`J........ ....k...fC,B...A.........w.....#J
.CI.)_.....J.iy..L:!..NA.x..V.v.........--..7....."wX.jS.]..w ....(.W.
%.Q.6.m.. V..B.B.B.B.B..4............/C.6...v....&.W........6.b...XF..
.m.S...2m...e......? ....Ntr.#1...DLl.zb.o....t".N.J...V..(..}}[=*;.0.
.5h...o...N....mz.h.[.4...m...M4..\..MCU.GzX;NEU..pp1.23.D8..".q!..p..
! Sj.In..j..Z..}k..>S.a..D).y............C..P... .u..Cjq...zf/&%c.)
..l'..........~d.A.R.P..,w..$O....SB...{#6.~....k.[h...1Oo.^.#.5q....a
C.e\..ZI(......V...`..t.....7<.|1...R9.-....|..)...T...u.4U......Y.
.&..mB}r"4...S......Q....Y..5.i...BV.........!.!-.....' .xq.j...dx(\..
..........1.%i....~.;.<.o%;..E..Ap.....A..U.G..s..t$j._.Ook.o.....o
..._...HXY........1.W.@....L...g.T..G..c.1Q..;..q.n2.. RJ....J..[.
<<< skipped >>>

GET /tpl/images/public/logo_head.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Wed, 19 Feb 2014 07:14:02 GMT
Server: ECD (fcn/4025)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 2028
.PNG........IHDR...F...(.....t.|.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:25F6B3363020681188C6D1C3FBC6BD0D" xmpMM:DocumentID="xmp.did:5C65
ADC2993511E3AF98E2741A76DCFF" xmpMM:InstanceID="xmp.iid:5C65ADC1993511
E3AF98E2741A76DCFF" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:176CBA33429811E2BC
9B8ABA6788871D" stRef:documentID="xmp.did:176CBA34429811E2BC9B8ABA6788
871D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>./......PLTE.......d..Ij.)5.......[.....%*.
...-=....AJ.[..v........k..DP.......4A..."&).25....}....48:.f..<O.[
y.{.."&.Fq....7R.3;....?I.9V.8C.>`...EIK........................%),
.............c........3Jdfh...PRUvxy...~........hjl......bdf......CGI.
........prttvwxz{..........ev.... 0....;Z.......|..m..q...............
.......=AC....HV.'/...._.................C\AEG.......c.....Rv.Yt|~....
.......!$Ve4.....tRNS.................................................
..................................................................
<<< skipped >>>


HEAD /asc-spupdate/201405/14/base_upt_add HTTP/1.1
Host: download.iobit.com
Accept: text/html, */*
Accept-Encoding: identity
User-Agent: Mozilla/3.0 (compatible; Indy Library)
Range: bytes=821567-


HTTP/1.1 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 821567-2005319/2005320
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:59 GMT
Etag: "3887829443"
Expires: Fri, 23 May 2014 13:57:59 GMT
Last-Modified: Wed, 14 May 2014 07:01:31 GMT
Server: ECAcc (fra/D4B8)
X-Cache: HIT
Content-Length: 1183753
HTTP/1.1 206 Partial Content..Accept-Ranges: bytes..Cache-Control: max
-age=604800..Content-Range: bytes 821567-2005319/2005320..Content-Type
: application/octet-stream..Date: Fri, 16 May 2014 13:57:59 GMT..Etag:
 "3887829443"..Expires: Fri, 23 May 2014 13:57:59 GMT..Last-Modified: 
Wed, 14 May 2014 07:01:31 GMT..Server: ECAcc (fra/D4B8)..X-Cache: HIT.
.Content-Length: 1183753......


GET /asc-spupdate/201405/14/base_upt_add HTTP/1.1


Host: download.iobit.com
Accept: text/html, */*
Accept-Encoding: identity
User-Agent: Mozilla/3.0 (compatible; Indy Library)
Range: bytes=821567-


HTTP/1.1 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 821567-2005319/2005320
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:59 GMT
Etag: "3887829443"
Expires: Fri, 23 May 2014 13:57:59 GMT
Last-Modified: Wed, 14 May 2014 07:01:31 GMT
Server: ECAcc (fra/D4B8)
X-Cache: HIT
Content-Length: 1183753
..E..R.....ZJ..].......]..Bi...]..aW.o...5.\.o....G..o...8...o....|..o
...J8..o...^...o.......o.......o...^Y..o...9q..o...K.9.o.....6.o...U..
.o.......o....;..o.....Q.o.....k.o.....f.o.......o....C..o.......o...,
x. o.....g"o...b.]#o....6.$o...j..$o......'o.....t(o......(o...?..*o..
...n o...Y`E-o......-o....S./o......0o...-}^4o.....#5o.....25o...2..7o
...p..7o...{H.=o...s..>o.....H>o......>o...Dv.Co...g..Eo...-.
.Go.....QGo.....WIo.....PPo....P.Ro...K..So....<.To......Uo...p.l]o
......ao...=/.fo..."..go..."l.go....j.go......jo...J.mqo..._m.to......
to......wo.....qxo...Q'azo.....@|o.....>}o.......o....Fq.o...z...o.
...g..o.......o....WD.o...`...o...K...o...1.I.o.....).o.....L.o.....f.
o....]..o.......o.....u.o.......o....K..o...{...o.......o.....a.o...`.
..o.......o.......o...Q.D.o.......o....!..o...R...o...N...o.......o...
..<.o...Pb..o...*...o...J...o...s ..o.....V.o....._.o... %~.o...,b.
.o.......o.......o.......o.......o.......o...#=&.o...UqY.o.......o....
...o.......o....f..o...y...o.......o....,B.o.....Q.o.....X.o...j0d.o..
.....o.......o....*..o....;..o.......o.......o...`.N.o....XU.o...<n
..o.......o.....].*......@4.X.l..g.#.....!X....R.N....>........=?..
....Bi.O.o..>..O.o..?..O.o..s..O.o..<...a....S.@]...Q..LjG.z..3.
|e...4.6.h.x.>. oD.y$.l1....G.,......j. ..._...R...x Z[..A..)W...A.
.W.$..A..$'q..A.......M..,.^.{...6_.j.......6F7..tU...O.t..lt.d...l23{
..{r...... ..).J../..5.J.......;.......;..B.ns....,...{....B X{...."`]
{.....U.s. ...Y.s. .....s. ....1s. ....:s. ....as. ...Ocs. ..}.es.
<<< skipped >>>


GET /atwork/community/rss.xml HTTP/1.1
Accept: */*
Cookie: MC1=V=4&GUID=489b59b88cff45798f407a73595398d1&HASH=&LV=&LU=1399967980436; MUID=0A913FA9C8A8659523DB3BDACCA8654E; A=I&I=AxUFAAAAAADeCAAAHzo oRxHEvEmTSqmQz02rg!!&V=4; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20140513
If-None-Match: "091d748668cf1:0"
A-IM: feed
Accept-Language: en-us
User-Agent: Windows-RSS-Platform/2.0 (MSIE 8.0; Windows NT 5.1)
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Cache-Control: no-cache
Host: VVV.microsoft.com


HTTP/1.1 200 OK
Cache-Control: max-age=900
Content-Length: 5653
Content-Type: text/xml
Content-Encoding: gzip
Last-Modified: Wed, 14 May 2014 20:39:04 GMT
Accept-Ranges: bytes
ETag: "0a45d8bb46fcf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
VTag: 438817357200000000
X-Powered-By: ASP.NET
X-Powered-By: ARR/2.5
X-Powered-By: ASP.NET
Date: Fri, 16 May 2014 13:57:30 GMT
...........\.r.Gv.....m...e...I..$.$RZe..C...*..i.-..g.g..W~..&/...E..
(~..B.s...P$...7[[......3.|}.w~.........i"nTn.I..uZ.=....:.=. .a.dO...
.....-...c..Q.3.l.P....M..8W.g...^..(.-|X./V.....Nn..y]<....4..D.*y
.'.B..,..{....DG......G...t..... ....L\..~w...X~....=q....e......O|.K&
lt;....X3,..B|4......_E.=..E...`6.......L.d1.-....2)Z.f.O....{.l......
r.l9....^Q.Q...T2I..JO.D..y......=~.C.b1.....B.|..sS.H.b,o.H.L....te.L
c!.BGX3...V3 b.h.....W."...U.L..h...,L.zzP....LG....*m...Y...g.<...
..@.....c].........l......s(.....;.O..o..:3.20..C..33a.z'.N......8..X.
.../.....B.#.5......P.QRZ.E..T...35.F.72...)L..D.U.`....-.N... d*..5..
......BX.Z..yQ.i.b-Edp/n.&.qQ&s.s2o............?.P.)5.n.[...\....}F..`
=h.8....(....'.?.....w.QN...x.........._.g..R.\.<..............l...
0....!...g";........y.Wr.....b,>.Eb..4..A.p.0WJ....,...H.m...IA.x.T
...I...Q.'.#...2.L...K.bdcS..... .9.%BI..yCLe.mU.X...D..... ..2k...C..
...!a1.0..*.T1....z...~..?.p.R....D$...X....y......Oz.@,mc.0...\.l./_.
./.L..3.X%...Fcc../O.V..|....kQ.A....c.tc....rQ........,oL..... ..B.9.
......o..c,NA....k.Crg.V.....?...M../. .W...0...B.`EE.;UL4.....]v...N.
....g ..j..Q;.j;..c..:.u6...Ek!..W.;*ma....p..)dQ._r..y*.T.x..=. .{k..
...%.J.e.CV...7p|..<'7.h.....$(f!....p).../3....!....M.i.%@8...@z&8
..._"8l...-..4*.>..f..|........(.o.........b....I .vl.]9.....P.)...
..}r.e.2K...n.!.......H:....,...._.x..i.M..80......XE.r`L.......g.....
........4.L..pnf.\^lfibd|........L...D.n......y.......Y..3..k.3B.O.:l.
...).S8_...8,.V..?.?..x..".e[k...m,.#..dBN..../.^/.8e.gcu..?...V.b
<<< skipped >>>

GET /athome/community/rss.xml HTTP/1.1


Accept: */*
Cookie: MC1=V=4&GUID=489b59b88cff45798f407a73595398d1&HASH=&LV=&LU=1399967980436; MUID=0A913FA9C8A8659523DB3BDACCA8654E; A=I&I=AxUFAAAAAADeCAAAHzo oRxHEvEmTSqmQz02rg!!&V=4; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20140513
If-None-Match: "80c5918568cf1:0"
A-IM: feed
Accept-Language: en-us
User-Agent: Windows-RSS-Platform/2.0 (MSIE 8.0; Windows NT 5.1)
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Cache-Control: no-cache
Host: VVV.microsoft.com


HTTP/1.1 200 OK
Cache-Control: max-age=900
Content-Length: 5533
Content-Type: text/xml
Content-Encoding: gzip
Last-Modified: Wed, 14 May 2014 20:32:21 GMT
Accept-Ranges: bytes
ETag: "80b8289bb36fcf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
VTag: 438815757200000000
X-Powered-By: ASP.NET
X-Powered-By: ARR/2.5
X-Powered-By: ASP.NET
Date: Fri, 16 May 2014 13:57:31 GMT
...........\....r.v...cE...$..KR...vW..%kk..|.RC`H..bp0.ry....M.....r.
*?._ ......W .\.8').H\..it...uO...?........E....=......=..p..Qbf..#...
..;....6.z!.af..g'F...[...E,f.N.....1..|iN..O`...'.:.......=.d.d...=..
.q..xd.x..(..7p.).....?I..o...{uyy.n..ys..J......G....-x.....?i..o.. .
f..0.;..OO...*.........f.i...[.Z.r..[N}1.I`Z\G.OO..w./....E..r.t2....\
f.3......-..U..6...{T..<..l&..f.Z..NH.?5.V%..![..`.....>..4...xl
..cF.XK........x2. p..8.E.T..|..97*n==-..j......s.6..........;.~..hP..
ki..]..E...,.......go..u........Rk...........i......=......j.^wT..=..6
.:..PcL...m....D.Z....n./ ..p..C......(.[.7H."......|..".KX3B..W?..=..
....iP.i%|....^.I...."..3...#I........\.5..O.D...V*D3.%k}}....XN[..o5a
...&.~ .g..ht..G.....M.V......V..? 5H.r.~.w..i....?...E.`.r...`.`...5.
^.X.X.....X 1....H.`...(.DM.E.;.m.......,...'..l....*^.....B4>.(.K\
....e`0.b.......(.....|\.%Lp-.m..x...(.... ...;=...$Q.......Dw.......@
...6.x....K....o.p.R......xr....<>......p8..U..1V...Z......%..Zl
x.[.-D.Y...P*......$.g.Uv}...........=X.....)>5..~kg.V1<W:;X9$.j
..[X}..-.=x{....BQ...f3tg.T8..Fq....M........>7..........lU........
.K........q.rMP.....P....:.}.....5p.....Xq......9......B.^p....W..j..j
...0.Q.B....a[...`p...f..@.2y..>.............S.G...P<.I..D......
b...D......v.S....Z...`.W.....3T....$..'.....(....HaM#I.G....0\.{.....
x...B7y.".`.o!.%.."G..@\i..z..............\.A...F...M.(...h8"......v..
.P....f/d^......"..c......A...H9...M.Y..]....gI.by....Q-..^.....X.o[p.
..J...n@.......]....e....^A.s...X...Ic...........`.....H....pHD..I
<<< skipped >>>


GET /infofiles/liveupdate/update/update.ini HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=0-2848


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 0-2848/5696
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:54 GMT
Etag: "2683035385"
Expires: Fri, 23 May 2014 13:57:54 GMT
Last-Modified: Tue, 13 May 2014 09:28:22 GMT
Server: ECAcc (fra/D466)
X-Cache: HIT
Content-Length: 2849
Connection: close
[Update].UpdateMode=1.FileName=.FileMD5=.FileSize=.DownURL=.RunParam=.
AutoUninstall=0..[Product].ASC=0.UninstallerPro=1.UninstallerFree=1.Un
installer=1.Malware Cleaner=0.RealTimeProtector=0.Surfing Protection=1
.ManageMyMobile=0.GameAssistant=1.ASCandU=1.PCTransfer=0..[ASC].IsPush
=0.RegPath1=HKEY_LOCAL_MACHINE\SOFTWARE\IObit\PCtransfer|InstallPath.R
egPath2=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\IObit\PCtransfer|Insta
llPath.RegPath3=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentV
ersion\Uninstall\Advanced SystemCare 7_is1|InstallLocation.RegPath4=HK
EY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion
\Uninstall\Advanced SystemCare 7_is1|InstallLocation.AppName=ASC.exe..
Setup_MD5=.Setup_Size=.Setup_URL=.Setup_Param=....[UninstallerPro].Lat
estVersion=3.0.4.922.RegPath1=HKEY_LOCAL_MACHINE\SOFTWARE\IObit\Uninst
aller 3|UninstallerPro....[UninstallerFree].UptTitle=Uninstaller.Lates
tVersion=3.1.8.2434.RegPath1=HKEY_LOCAL_MACHINE\SOFTWARE\IObit\Uninsta
ller 3|UninstallerFree..AppName=IObitUninstaler.exe.TipTime=72.ServerT
ip=0.ProductTip=1..Setup_Type=1.Setup_Mode=0.Setup_MD5=.Setup_Size=.Se
tup_URL=.Setup_WebURL=hXXp://VVV.iobit.com/update/uninstaller/index.ph
p.Setup_Param=/sp- /verysilent /suppressmsgboxes..File1_Mode=.File1_Na
me=.File1_MD5=.File1_Size=.File1_URL=.File1_Param=..White_Enable=0.Whi
te_2052=0.White_1055=0.White_1042=0..Black_Enable=0.Black_1059=0.Black
_2057=0.Black_1033=0...[Uninstaller].LatestVersion=3.2.0.128.RegPath1=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Unins
<<< skipped >>>


GET /asc-spupdate/spupdate.utp HTTP/1.1
Host: download.iobit.com
Accept: text/html, */*
Accept-Encoding: identity
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:58 GMT
Etag: "2781205123"
Expires: Fri, 23 May 2014 13:57:58 GMT
Last-Modified: Wed, 14 May 2014 07:01:31 GMT
Server: ECAcc (fra/D44B)
X-Cache: HIT
Content-Length: 912
[Main]..base_safe_browse_0429=hXXp://download.iobit.com/asc-spupdate/b
ase_safe_browse_0429..base_upt_add=hXXp://download.iobit.com/asc-spupd
ate/201405/14/base_upt_add..[MD5]..base_safe_browse_0429=7de04d63eeb28
509360bcb293c7fd661..base_upt_add=89a2e46236dc2b15bfa25db8ab77a1e6..[S
ize]..base_safe_browse_0429=3461688..base_upt_add=2005320..[ReUpdate].
.base_upt_add=0..base_safe_browse_0429=1..[OnlineLookup]..Enable=0..UR
L=..[Merger]..Enable=1..Count=8..[WhiteList]..Enable=0..2052=0..1055=0
..1042=0..[Blacklist]..Enable=0..1059=0..2057=0..1033=0..[Main_Bak]..b
ase_safe_browse_0330=hXXp://download.iobit.com/asc-spupdate/base_safe_
browse_0330..base_upt_add=hXXp://download.iobit.com/asc-spupdate/20140
4/29/base_upt_add..[MD5_Bak]..base_safe_browse_0330=8e620679eeed385873
a61146939ffdbd..base_upt_add=396beb3a097f7ca83aa3570dc756a988..[Size_B
ak]..base_safe_browse_0330=3342160..base_upt_add=2842100....



GET /vkits/dlv1/114576/iobitappsToolbar.msi HTTP/1.1
Referer: hXXp://download.mybrowserbar.com/vkits/dlv1/114576/iobitappsToolbar.msi
User-Agent: dwplayer
Host: download.mybrowserbar.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:56:38 GMT
Server: Apache
Last-Modified: Tue, 13 May 2014 09:59:20 GMT
Accept-Ranges: bytes
Content-Length: 4727296
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: application/x-msi
........................>...................I...............8......
......................................................................
......................................................................
......................................................................
............................................................ ... ...!.
..!..."..."...#...#...................................................
......................................................................
.................................;....................................
......................................................................
.$....... ...!..."...#...&...%...0...'.......)...*... ...,...-......./
...2...1...4...3...C...5...6...7...?...M...:...<.......=...>....
...@...A...B...E...D...Z...F...G...H...I...J...N...L.......}...O...P..
.Q...R...S...T...U...V...W...X...Y...\...[...d...]...^..._...`...a...b
...c...f...e...r...g...h...i...j...k...l...m...n...o...p...q...t...s..
.....u...v...w...x...y...z...{...|...}...~...........R.o.o.t. .E.n.t.r
.y.........................................................;..........
........F.............k...k..9.............S.u.m.m.a.r.y.I.n.f.o.r.m.a
.t.i.o.n...........................(...J..............................
.....................,.......@H.?.C.A.E.D1H...........................
...............................F......................................
.................@H.?dA/B6H...........................................
..................................................................
<<< skipped >>>


GET /dl/asc730/asc7_setup_730_free_05161823.exe HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=9567687-19135373


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 9567687-19135373/38270744
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:55:08 GMT
Etag: "3919716597"
Expires: Fri, 23 May 2014 13:55:08 GMT
Last-Modified: Fri, 16 May 2014 10:33:22 GMT
Server: ECAcc (fra/D449)
X-Cache: HIT
Content-Length: 9567687
Connection: close
O.QIh.....`.u...N.o...@yKq..Cs.n.#.c.X.eh.AX...k..K....eWr].3e.[aQ..f!
~.......#R.6.F............G...@.0.|.iD.E.L..........L)........../.e...
..i........ax.{S.i.~.x.M. .../...<..[ ....z.....]O..S..R...gY..;.d.
...&.3.Ch...k..p.R>R....S..q.A5....%!V.K?J...wOm.\.?..so_..[...$...
......f.c.B/#L.a....f..!.1@.../@Y7y.....9..#..8.Q.d0...e70. jUg.S..j..
D.Z. .. .&.fc........B.K...B.X.....1...5.).p.....P."...ph6.F6..CT....l
...N.8hA..../&q.}7..Y{r...g..t...Zd..;9R...Z.<......jh.....-.......
..^..n.."c.d......7.!.G8k.i....W.........>.?.J....#....5.b'<(z..
..o........2<..K.jA/..=..L6..?.$....%.G.......f.D...FI.v.2..r.3..p.
.2'l...^.i.0..n...L..z...`......B.e...CC..l.b,......3..g.?;......_....
..s.i.hg.n.87.Fq...4.Wm<.:........V..'R70.v..........L ...8.,.w..n.
.........u...d..v.2...I\../y"...?....g#...&3.5..O........*.....4e....c
........8;..k..|.R..9....$..b/..T.U.cJG.w.V...e.C.[.6;.Vj77F.....O.V'.
..=..o....^hUZ..$..oE.....j....~UJ...hP.!O..7... i.....OR.JZLcRC..c.z.
47p...........4O.>[....,s.z.....4.uN.=.\..y.9_..Y.{DE..R/.M...(.T#b
w...$.e..S..A.@..w.w^[B.c".0..*...}...B..*...Q.#......P...E........xw.
..(l.2.K...4..j......" .}.x.......i..D.,=9......./.L.&.3....3'.ds.y\~q
.@.r.:.L...o..k[.r.P.....-?1N..........5,....TN...5.=w.k......A..c..*.
Ra......>O...;/,)...........cN$..:..x.H.4v..a.$.1...#..'8..Q...\.pX
..:............|.5G.B..z....[...%..Q....4..K_..n:'.K..i..........'....
.I....\.......t.3fa..oT<.......R.I...........=.f.-Z..w`3.j.........
.._.%'nn...tC.Oi.J,.m.........,.l...u..cliJ9..E.e...r.S../........
<<< skipped >>>


GET /translate_static/css/translateelement.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: translate.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/css
Last-Modified: Thu, 06 Feb 2014 00:22:18 GMT
Date: Fri, 16 May 2014 13:19:48 GMT
Expires: Fri, 16 May 2014 14:19:48 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 3559
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 2238
Alternate-Protocol: 80:quic
...............6.._.Ec0...#..v..a.......ao.m.6wd...~.1.....)..........
...b.X...C.#=.Ud.gQ.'..gJw..~)7...E...Mu. .q...I...o...4fx.Fe....B.|..
.e..u..Q..c...O.....>K.......9~..|......Zf[.....V9....X}..)c..%....
......)......).x5>..........dq.GK..@...g5~../..u.h..!..91'..5.8....
..e.7K..)...N...u...7.-Ck..b.f...r...f.--.x...x.PEP..55....3r.......b.
z...X...s./.:v.E..;?....*.. .2;.</.IM...v8...F./....|.F.n.Z...."...
.. .F.....<.%<.]........V9...z.HY..kSA7_VG....i....3.....O.HI.p.
.J...........,.M..P..$8m...._..\z.r..m.aM..f.....e.j.d.... .....#-....
1G.e.)g..g.u..N..r..Z.a..........d.......l.b...s.....g.......MAk,*.z..
.h%......;......W........e'.2..n95 ..((-..~....;.sc.]}.3...W.F....=..\
:.. .....q.`.dg....P..Ar H..g..u.."h...........|.......mC.f.....m.j.V`
1ye..o..J...v..H..QN.;.l.G{........S...&....Bi.N8..n."c.*.?..JY6.c2..]
.ic..z.9,.&m .... |..E...<...B.....V.=B.N..........k.:nI.....X....r
..."[(k.!a....nT..R.......9.....`\..4HK.@\.....<..y.....6..5..x....
..p......'......\s=.;..}C....r.8."..7[.Q....n;....1AC.LV....p3..xom..o
.4.m...L!.....%_.C#$SP......[%...-..aS....A......\.:.(..../....Z.....V
.._v}...#.)..[.wN.n..s...m..0.qc....!...Z`.8.....Y.._...{..H&|....P..L
WF..=@.........}6.h......`.@a.9&D=...9..%S0.:mI.-0.......b......l..e.k
`.m....n^.8.....-CX.C.....*."cQ..S.....r.W.. .A..g'u<s\:S\zf..9.,..
jlU.>>}%..[.W..l..m.....>9..T..B.h..SU|.....E..x.7..ES.Y@....
...............r.Y4..q\R..vv-zS....J...Z..w...}}".....^X...Y)]......".
...]w<Bf.....Y....U.&.,...."....'v1..S.8..s....G..lB.;.L....bA.
<<< skipped >>>

GET /translate_a/l?client=te&alpha=true&hl=en&cb=_callbacks_._0hv9jvn7c HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: translate.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:57:06 GMT
Expires: Fri, 16 May 2014 13:57:06 GMT
Cache-Control: private, max-age=86400
Content-Type: text/javascript; charset=UTF-8
Content-Language: en
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: HTTP server (unknown)
Content-Length: 709
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
.............n.0.._..U.l....nK..z@.. .....[.,... ).../9..a..>R.~...
 ....s...?....h.T......kA....8c..?.d.@....ZG.......hp/0.TF............
|...{...&.D..h.N.% .. .$....$.iHc{...M....tC...E..<..\...dl.}.qv.K.
.;..B.L,.).....j#..v..:.........4:...:w......'...R.........Jl..k...6)y
.....*.w.q.V..5'.>.....!......X....9).w4..:UM...EP[...[. l.L..{.9..
i@.=..O........v.\a...D.....6v:oop.Br....qP......4.e.M<.... 2.jh.z`
.....  .2i.5A....*...c>P..k..p..}.-7Tq}.Z..E...3.,.W...O.$.=o.B.Ml.
..3..-....(....i.k..c..4`.wv.Z.O$>4!.=...l.3.(Hwo.C..1..7es...onBT.
.v$\...D.'..l..%...,...p..rK.J^7&.:{=d..W...W..hP.j.Q.zVA.......R.....
.........>.^.Kyd.bwp?.z....' ..........[~~....ut.T...Zq}...... .:.|
kH...u...._.?.u......7.s."....HTTP/1.1 200 OK..Date: Fri, 16 May 2014 
13:57:06 GMT..Expires: Fri, 16 May 2014 13:57:06 GMT..Cache-Control: p
rivate, max-age=86400..Content-Type: text/javascript; charset=UTF-8..C
ontent-Language: en..X-Content-Type-Options: nosniff..Content-Disposit
ion: attachment; filename="f.txt"..Content-Encoding: gzip..Server: HTT
P server (unknown)..Content-Length: 709..X-XSS-Protection: 1; mode=blo
ck..Alternate-Protocol: 80:quic...............n.0.._..U.l....nK..z@.. 
.....[.,... ).../9..a..>R.~... ....s...?....h.T......kA....8c..?.d.
@....ZG.......hp/0.TF............|...{...&.D..h.N.% .. .$....$.iHc{...
M....tC...E..<..\...dl.}.qv.K..;..B.L,.).....j#..v..:.........4:...
:w......'...R.........Jl..k...6)y.....*.w.q.V..5'.>.....!......X...
.9).w4..:UM...EP[...[. l.L..{.9..i@.=..O........v.\a...D.....6v:oo
<<< skipped >>>


GET /install.php?operate=1&user=1&app=asc7&ver=7.3.0.454&pr=iobit&system=51&type=1 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: ascstats.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Date: Fri, 16 May 2014 13:56:51 GMT
Server: Apache
Content-Length: 4
Connection: keep-alive
trueHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..Date: Fri
, 16 May 2014 13:56:51 GMT..Server: Apache..Content-Length: 4..Connect
ion: keep-alive..true..



POST /cgi/api.cgi/114576/8C9A823EF2F54A2DA307F9A0DD862C57/vaus/14/ HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml
User-Agent: WidgiToolbar-182-114576
Host: VVV.mybrowserbar.com
Content-Length: 411
Connection: Keep-Alive
Cache-Control: no-cache

<drq><auth><ccv>182</ccv><cnid>114576</cnid><isn>8C9A823EF2F54A2DA307F9A0DD862C57</isn><ct>14</ct><dlid>1033</dlid><wv>5.1</wv><lngid>1033</lngid><brw><ie>8.0.6001.18702</ie><ff>29.0.1</ff><gc>34.0.1847.131</gc><dbrw>Internet Explorer</dbrw></brw></auth>
<vaus><app><sid>58</sid><ac>WT</ac><pid>58</pid><kt>SSE</kt><ccv>182</ccv><cnid>114576</cnid><isn>8C9A823EF2F54A2DA307F9A0DD862C57</isn></app></vaus></drq>
HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:57:49 GMT
Server: Apache
Vary: Host
Pragma: no-cache
Cache-control: no-cache
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Fri, 16 May 2014 13:57:49 GMT
3a..<drp><auth>.  <scv>182</scv>.</auth>
.<vaus>.</vaus>.</drp>..0..HTTP/1.1 200 OK..Date: Fr
i, 16 May 2014 13:57:49 GMT..Server: Apache..Vary: Host..Pragma: no-ca
che..Cache-control: no-cache..Keep-Alive: timeout=30, max=100..Connect
ion: Keep-Alive..Transfer-Encoding: chunked..Content-Type: text/html..
Expires: Fri, 16 May 2014 13:57:49 GMT..3a..<drp><auth>.  
<scv>182</scv>.</auth>.<vaus>.</vaus>.&l
t;/drp>..0..



GET /translate_a/element.js?cb=googleTranslateElementInit HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: translate.google.com
Connection: Keep-Alive
Cookie: PREF=ID=4a7f16f5c3ec0541:U=446aab18649b6521:FF=0:TM=1399967072:LM=1399967684:S=aoAxnOZoikilPPyD; NID=67=Myr94PHPbQMMoQ2GHlUcPtfX2cMrtPZGA5tiRp6fVLqGMflK1YN6LwWJfLIzz0JBXmjPhhiZyvytwv84H6wxqfCxPGCEKS-8hA9GZj5ZE0-gG48GxYZLRKMD1N5EqTCT


HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:57:04 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/javascript; charset=UTF-8
Content-Language: en
Pragma: no-cache
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: HTTP server (unknown)
Content-Length: 681
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
...........T.N.0.}. ...X...^&2k...6m....P.87..c...U...S........9...{c.
.Rq/.J........U...h......."..|~....V...fX............w..8.$ER...:.Z`..
.E\wF.....~_~}..e...T<.....y....?..Gq.W..9g....:....c.SJ]..a6p.u...
..:m..R ...0x.%..{F).z,=..U..n...E.. ......:....,.eaS.ow....._...I.=..
B..X......%qF......6.e......,.......8.uz..... ~}...............4._bt.G
..}X......*.....|...<(..)Z..j..B......B3X....Y..KU....y....B..6...w
.T...c\..z...%.....-SN.....`.............9...u...4..l....|...*}S.G....
u=...4..G.f.#a.D..i...OI..q.I..Dj....X.5....8IF....Yr.....n....k...u.P
.Z..|.3w.....k..T.H#.M~...ro..-..i......{....w?.....F....K...Y......N(
1..kT...u~8...Cb...h......Sa......G3:&..q.'[.t...iU.X....HTTP/1.1 200 
OK..Date: Fri, 16 May 2014 13:57:04 GMT..Expires: Fri, 01 Jan 1990 00:
00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: tex
t/javascript; charset=UTF-8..Content-Language: en..Pragma: no-cache..X
-Content-Type-Options: nosniff..Content-Disposition: attachment; filen
ame="f.txt"..Content-Encoding: gzip..Server: HTTP server (unknown)..Co
ntent-Length: 681..X-XSS-Protection: 1; mode=block..Alternate-Protocol
: 80:quic.............T.N.0.}. ...X...^&2k...6m....P.87..c...U...S....
....9...{c..Rq/.J........U...h......."..|~....V...fX............w..8.$
ER...:.Z`...E\wF.....~_~}..e...T<.....y....?..Gq.W..9g....:....c.SJ
]..a6p.u.....:m..R ...0x.%..{F).z,=..U..n...E.. ......:....,.eaS.ow...
.._...I.=..B..X......%qF......6.e......,.......8.uz..... ~}...........
....4._bt.G..}X......*.....|...<(..)Z..j..B......B3X....Y..KU..
<<< skipped >>>


GET /dl/asc730/asc7_setup_730_free_05161823.exe HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com


HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:55:08 GMT
Etag: "3919716597"
Expires: Fri, 23 May 2014 13:55:08 GMT
Last-Modified: Fri, 16 May 2014 10:33:22 GMT
Server: ECAcc (fra/D449)
X-Cache: HIT
Content-Length: 38270744
Connection: close
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....WZR............
......................... ....@.................................o.H...
.......@....................................................G. .......
......................................................................
...............text...,........................... ..`.itext..D.......
.................... ..`.data........ ......................@....bss..
...V...0...........................idata..............................
@....tls.....................................rdata....................
..........@..@.rsrc................ ..............@..@................
....................@..@..............................................
......................................................................
..............................................@...AnsiChar............
@...string(.@...AnsiString......@...............................@.....
.... 9@.(9@..9@..9@..9@..9@..9@..9@.,8@.H8@..8@..TObject.%..A....%..A.
...%..A....%..A....%..A....%..A....%(.A....%..A....%$.A....%..A....%..
A....%..A....%..A....%..A....%|.A....%x.A....%t.A....%p.A....%l.A....%
h.A....% .A....%d.A....%`.A....%\.A....%..A....%..A....%..A....%X.A...
.%T.A....%..A....%..A....%..A....%P.A....%L.A....%H.A....%D.A....%@.A.
..S..........$D...T.J....D$,.t...\$0....D[..@..%<.A....%8.A....
<<< skipped >>>


GET /js/mapplication/2.2/mapplication.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: codes.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-javascript
Date: Fri, 16 May 2014 13:57:02 GMT
Last-Modified: Mon, 21 Apr 2014 06:45:29 GMT
Server: ECS (fra/D4F6)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 22343
// JavaScript Document..// R & D Documentation hXXp://codes.iobit.com/
js/mapplication/2.2/api.php..var MApplication_2_2 = (new function(){..
.this.version = '2.2.6',...this.lastUpdate = '2014-04-21 14:19',......
/********************* Language *********************/...this.language
 = (new function(){....// en-US....this.lang = navigator.browserLangua
ge ? navigator.browserLanguage : navigator.language;....// Array('en',
 'us') | Array('en')....this.langArr = this.lang.toLowerCase().split('
-');..../**.... * Back URL based on the language of the client browser
.... * @param array valueArr;.... * @return string;.... *.... * @examp
le language.reValue(Array('default'=>'value','en'=>'value','fr'=
>'value'));.... *.... **/....this.reValue = function(valueArr){....
.var reValue = valueArr[this.langArr[0]];.....reValue = reValue == und
efined ? valueArr['default'] : reValue;.....return reValue;....};..../
**.... * According to the client browser language automatically jump..
.. * @param array valueArr;.... * @return null;.... *.... * @example l
anguage.jump(Array('default'=>'value','en'=>'value','fr'=>'va
lue'));.... *.... **/....this.countdownJump = function(valueArr, inter
val){.....var url = this.reValue(valueArr);.....if (url != undefined &
& url != ''){......setTimeout(function(){window.location=url}, interva
l*1000);.....}....};...});........./********************* Client *****
****************/...this.client = (new function(){....this.userAgent =
 navigator.userAgent.toLowerCase();..../**.... * Get client device
<<< skipped >>>


GET /update/wt/ie/coupons/update.xml HTTP/1.1
User-Agent: MS IE Coupons addon
Host: update.mybrowserbar.com
Accept: */*


HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Fri, 16 May 2014 13:57:53 GMT
Content-Type: text/xml
Content-Length: 217
Last-Modified: Tue, 21 May 2013 11:38:18 GMT
Connection: keep-alive
Accept-Ranges: bytes
<?xml version='1.0' encoding='UTF-8'?>..<cpupdate>...<l
ibid>{40C6AC97-5316-4D22-BA61-3BF0D585FB22}</libid>...<url
>hXXp://update.mybrowserbar.com/update/wt/ie/coupons/coupons_1.0.zi
p</url>...<ver>1.0</ver>..</cpupdate>..



GET /dl/asc730/asc7_setup_730_free_05161823.exe HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=0-9567686


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 0-9567686/38270744
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:55:08 GMT
Etag: "3919716597"
Expires: Fri, 23 May 2014 13:55:08 GMT
Last-Modified: Fri, 16 May 2014 10:33:22 GMT
Server: ECAcc (fra/D449)
X-Cache: HIT
Content-Length: 9567687
Connection: close
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....WZR............
......................... ....@.................................o.H...
.......@....................................................G. .......
......................................................................
...............text...,........................... ..`.itext..D.......
.................... ..`.data........ ......................@....bss..
...V...0...........................idata..............................
@....tls.....................................rdata....................
..........@..@.rsrc................ ..............@..@................
....................@..@..............................................
......................................................................
..............................................@...AnsiChar............
@...string(.@...AnsiString......@...............................@.....
.... 9@.(9@..9@..9@..9@..9@..9@..9@.,8@.H8@..8@..TObject.%..A....%..A.
...%..A....%..A....%..A....%..A....%(.A....%..A....%$.A....%..A....%..
A....%..A....%..A....%..A....%|.A....%x.A....%t.A....%p.A....%l.A....%
h.A....% .A....%d.A....%`.A....%\.A....%..A....%..A....%..A....%X.A...
.%T.A....%..A....%..A....%..A....%P.A....%L.A....%H.A....%D.A....%@.A.
..S..........$D...T.J....D$,.t...\$0....D[..@..%<.A....%8.A....
<<< skipped >>>


GET /vkits/dlv1/114576/iobitappsToolbar.msi HTTP/1.1
Referer: hXXp://download.mybrowserbar.com/vkits/dlv1/114576/iobitappsToolbar.msi
User-Agent: dwplayer
Host: download.mybrowserbar.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:56:38 GMT
Server: Apache
Last-Modified: Tue, 13 May 2014 09:59:20 GMT
Accept-Ranges: bytes
Content-Length: 4727296
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: application/x-msi
........................>...................I...............8......
......................................................................
......................................................................
......................................................................
............................................................ ... ...!.
..!..."..."...#...#...................................................
......................................................................
.................................;....................................
......................................................................
.$....... ...!..."...#...&...%...0...'.......)...*... ...,...-......./
...2...1...4...3...C...5...6...7...?...M...:...<.......=...>....
...@...A...B...E...D...Z...F...G...H...I...J...N...L.......}...O...P..
.Q...R...S...T...U...V...W...X...Y...\...[...d...]...^..._...`...a...b
...c...f...e...r...g...h...i...j...k...l...m...n...o...p...q...t...s..
.....u...v...w...x...y...z...{...|...}...~...........R.o.o.t. .E.n.t.r
.y.........................................................;..........
........F.............k...k..9.............S.u.m.m.a.r.y.I.n.f.o.r.m.a
.t.i.o.n...........................(...J..............................
.....................,.......@H.?.C.A.E.D1H...........................
...............................F......................................
.................@H.?dA/B6H...........................................
..................................................................
<<< skipped >>>


POST /cgi/api.cgi/114576/8C9A823EF2F54A2DA307F9A0DD862C57/vrst/4 HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml
User-Agent: WidgiToolbar-182-114576
Host: iobitapps.mybrowserbar.com
Content-Length: 446
Connection: Keep-Alive
Cache-Control: no-cache

<drq><auth><ccv>182</ccv><cnid>114576</cnid><isn>8C9A823EF2F54A2DA307F9A0DD862C57</isn><ct>4</ct><dlid>1033</dlid><lngid>1033</lngid><wv>5.1</wv><brw><ie>8.0.6001.18702</ie><ff>29.0.1</ff><gc>34.0.1847.131</gc><dbrw>Internet Explorer</dbrw></brw></auth>
<vrst><isn>8C9A823EF2F54A2DA307F9A0DD862C57</isn><cnid>114576</cnid><code_ver>182</code_ver><type>install</type><ct>4</ct><src>12</src><cid>75ed9567aa584c8ea8ea3cad7c47ab03</cid></vrst></drq>
HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:57:50 GMT
Server: Apache
Pragma: no-cache
Cache-control: no-cache
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Fri, 16 May 2014 13:57:50 GMT
2b..<drp><auth>.  <scv>182</scv>.</auth>
.</drp>..0..



POST /news/asc/v7/7_en_news_free.dat HTTP/1.0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Host: download.iobit.com
Accept: text/html, */*
Accept-Encoding: identity
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:15 GMT
Etag: "2674276093"
Expires: Fri, 23 May 2014 13:57:15 GMT
Last-Modified: Wed, 09 Apr 2014 01:54:52 GMT
Server: EOS (cpm001/F93C)
Content-Length: 428
Connection: keep-alive
freetotrial=0..title1=Today's Special Deal - 80% OFF..link1=hXXp://goo
.gl/75tNHX..remark1=Buy Advanced SystemCare 7 today, Share 300% Faster
 PC Feeling with Your Family!..imageurl1=hXXp://download.iobit.com/new
s/images/iconv7_50.png..title2=Today's Special Deal - 80% OFF..link2=h
ttp://goo.gl/75tNHX..remark2=Save 80%, Share 300% Faster PC Feeling wi
th Your Family!..imageurl2=hXXp://download.iobit.com/news/images/iconv
7_50.png....


GET /news/images/iconv7_50.png HTTP/1.1


Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Host: download.iobit.com
Accept: text/html, */*
Accept-Encoding: identity
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:15 GMT
Etag: "4069298584"
Expires: Fri, 23 May 2014 13:57:15 GMT
Last-Modified: Thu, 29 Aug 2013 09:02:30 GMT
Server: ECAcc (fra/D4A2)
X-Cache: HIT
Content-Length: 5802
.PNG........IHDR...2...2......?......tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:FAA583873CBCE211AC48ED40E5B649CF" xmpMM:DocumentID="xmp.did:25D9
8251108911E3AE719ABFFD871591" xmpMM:InstanceID="xmp.iid:25D98250108911
E3AE719ABFFD871591" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B7D0B03E7D10E311827DD9
E8E83465E1" stRef:documentID="xmp.did:FAA583873CBCE211AC48ED40E5B649CF
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>$F].....IDATx..Zi.\.u..{.....F#.h.....IhC....".
.X.bW.C.\....1...c..".."...".P....d.H....v...6.........n....h.)f......
....;...r.hB.|.~\.?...}.;.6`..5....U...-.............M..$...H2..I...$R
...l;]-`.t.....wm.....X..I.%.....eW5VU^VWZ4.....<.t.........Kh.M..T
:zjp.........m.E.{..d......Z. ".@C......u3o^X]..,..........d..I[ .A..]
.<.:.-.....gr..};?n.x.w`.U..%o......e......s..{~..eA...=.dT.~...2dx
w.....S.,z.IDb..rY.]:B!.**.QS.DU...B.{.....7..x.x.;..;~.h$..n7;..i...@
..........97..].@......^ A.Zb....h...pO7b.=H......J'!...P.z....Byc
<<< skipped >>>

GET /news/images/iconv7_50.png HTTP/1.1


Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Host: download.iobit.com
Accept: text/html, */*
Accept-Encoding: identity
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:16 GMT
Etag: "4069298584"
Expires: Fri, 23 May 2014 13:57:16 GMT
Last-Modified: Thu, 29 Aug 2013 09:02:30 GMT
Server: ECAcc (fra/D4A2)
X-Cache: HIT
Content-Length: 5802
.PNG........IHDR...2...2......?......tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:FAA583873CBCE211AC48ED40E5B649CF" xmpMM:DocumentID="xmp.did:25D9
8251108911E3AE719ABFFD871591" xmpMM:InstanceID="xmp.iid:25D98250108911
E3AE719ABFFD871591" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B7D0B03E7D10E311827DD9
E8E83465E1" stRef:documentID="xmp.did:FAA583873CBCE211AC48ED40E5B649CF
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>$F].....IDATx..Zi.\.u..{.....F#.h.....IhC....".
.X.bW.C.\....1...c..".."...".P....d.H....v...6.........n....h.)f......
....;...r.hB.|.~\.?...}.;.6`..5....U...-.............M..$...H2..I...$R
...l;]-`.t.....wm.....X..I.%.....eW5VU^VWZ4.....<.t.........Kh.M..T
:zjp.........m.E.{..d......Z. ".@C......u3o^X]..,..........d..I[ .A..]
.<.:.-.....gr..};?n.x.w`.U..%o......e......s..{~..eA...=.dT.~...2dx
w.....S.,z.IDb..rY.]:B!.**.QS.DU...B.{.....7..x.x.;..;~.h$..n7;..i...@
..........97..].@......^ A.Zb....h...pO7b.=H......J'!...P.z....Byc
<<< skipped >>>


GET /pca3-g5.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.verisign.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Server: Apache
ETag: "895f8ccd92dfec674c94f0d04d1b63bc:1396128308"
Last-Modified: Sat, 29 Mar 2014 21:25:08 GMT
Accept-Ranges: bytes
Content-Length: 533
Date: Fri, 16 May 2014 13:57:39 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0...0..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U
....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For aut
horized use only1E0C..U...<VeriSign Class 3 Public Primary Certific
ation Authority - G5..140320000000Z..140630235959Z0...*.H.............
}...a.D[..8..i.....g8..S..tt..a.e.B]..v.l9.m.....~.G(l...G..#z{...Za..
F.q....2^X..w.i'.&..n...4v8. &|/Y.B..%..J..g0."k.0....A..7.)h...=5....
'Z........y.Ye.......M.._5.9..B.*.. .4z@.7#...... UL.F......iDg..6...'
z$.E.E..*..g...2.@D.....&v...o..>..k1N...P...iHTTP/1.1 200 OK..Serv
er: Apache..ETag: "895f8ccd92dfec674c94f0d04d1b63bc:1396128308"..Last-
Modified: Sat, 29 Mar 2014 21:25:08 GMT..Accept-Ranges: bytes..Content
-Length: 533..Date: Fri, 16 May 2014 13:57:39 GMT..Connection: keep-al
ive..Content-Type: application/pkix-crl..0...0..0...*.H........0..1.0.
..U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:0
8..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<
;VeriSign Class 3 Public Primary Certification Authority - G5..1403200
00000Z..140630235959Z0...*.H.............}...a.D[..8..i.....g8..S..tt.
.a.e.B]..v.l9.m.....~.G(l...G..#z{...Za..F.q....2^X..w.i'.&..n...4v8. 
&|/Y.B..%..J..g0."k.0....A..7.)h...=5....'Z........y.Ye.......M.._5.9.
.B.*.. .4z@.7#...... UL.F......iDg..6...'z$.E.E..*..g...2.@D.....&v...
o..>..k1N...P...i..
<<< skipped >>>


GET /active.php?uid=8b230885c2581ae91bcdb7f4b9fa5e57&type=1&app=asc7&ver=7.3.0.454&pr=iobit HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: ascstats.iobit.com
Connection: Keep-Alive
Cookie: __utma=12415148.1451469242.1400248624.1400248624.1400248624.1; __utmb=12415148.1.10.1400248624; __utmz=12415148.1400248624.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Date: Fri, 16 May 2014 13:57:17 GMT
Server: Apache
Content-Length: 31
Connection: keep-alive
Array.(.    [id] => 3428.).trueHTTP/1.1 200 OK..Content-Type: text/
html; charset=utf-8..Date: Fri, 16 May 2014 13:57:17 GMT..Server: Apac
he..Content-Length: 31..Connection: keep-alive..Array.(.    [id] =>
 3428.).true..



GET /static/fonts/opensans/v8/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: themes.googleusercontent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: font/eot
Last-Modified: Tue, 28 Jan 2014 23:51:09 GMT
Date: Thu, 15 May 2014 08:19:06 GMT
Expires: Fri, 15 May 2015 08:19:06 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 18265
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 106677
Alternate-Protocol: 80:quic
..........u.sx%......83.mw...m....m..:.mt..:.....[k.s...w....w.g.....$
).`^.....4.............H.....9....}]R.0-..F...._}.&.......E.......!U..
?.......Of.p.........4.I\....8..4..........@TUR.?....5..).....f......-
Mx ../.<I.y......G..7.....uR.....q&.&6.-X..lDlx.....y..~..O.<...
......'}..q........=.1..qvW..S..I."\u.....0.X...V#w..'#..[.`L.........
...&.J!.5.d......i...MG..m=..k.T..\..&.-...C..Y.]D.L.... ...I..|.8....
7.]. ...B...[.J.9k...,..C...h.-*.4.....%Y]Q'....<..Ò.9\...qC,g...
....'<G_..|*.'.2=..q~9.7W,0......V.?sN..T..PJ9.}P]H......D!...K....
k...H3..F.N....J....._.....;H't....d.8.'].........}.V...EGb..]#76...oV
...VE.e..`fc.7...t...V...!.......^.qX..0T.....^...sZs%^....7.o..4z.i.V
2.d..B.E....)\......w.MV5.>.p...Mh}0...NE.JE.O .Y.F...N..'.........
G..O..E...G..BM.wx......L8..U...T..^..8......:....e..z-q......~......D
..=.fEf....;.w....P...b...X..Z/.....9*.......m..I..i.nG3.n.@){...P9{.b
du..voz..<q....e...8......v.A,..=.X..$..3ea...B. ..D..L....ow...7Q.
:...q.....9./....yg..c..keZ.... .^..,%G%..Y.p..O%.G\.........X."....n.
...6.*.Y...A.k...".N.....l...f..l....b..v..N.....E.A.6.e.6...%.....Y[.
.D...#.Z.{~{.....&.Q.......7...r7.@..O..G.y`./2.^L....i....JQ."...s...
jW.Y....1.....|.6.=Y|....!...5K.|......'.....l......_..tQ..*Z..2....Q.
6...(C.,..B^..X...c..(m.n.7..(.Q.O.q"..\Od.".2.l....H......Gi.".b]..1{
.....X.....)C........7... ...C.i..tN....G1.]0*W....t.....".y1.X)...|..
..<.....[..^.....0.z...X.gJ.s.tcu....x.{..u(.N'........X.:..xQH..V.
1.z....a0.q...q.4.../dr..!t......_:u.F.F@....M......D.4g.2...=...2
<<< skipped >>>


GET /dl/asc730/dl-info.upt HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=0-65


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 0-65/130
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:55:08 GMT
Etag: "2693207509"
Expires: Fri, 23 May 2014 13:55:08 GMT
Last-Modified: Fri, 16 May 2014 10:58:08 GMT
Server: ECAcc (fra/D44C)
X-Cache: HIT
Content-Length: 66
Connection: close
[Option]..MD5=85719979DC3CFE146E12E85378B70C78..URL=hXXp://update...



POST /downloader.php HTTP/1.0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 190
Host: ascstats.iobit.com
Accept: text/html, */*
Accept-Encoding: identity
User-Agent: Mozilla/3.0 (compatible; Indy Library)

gid={36D94DD7-CC12-437C-9BED-B8ED63FF296F}&app=asc7&download_time=86&download_count=0&download_size=38270744&error_code=0&success=1&cancel=0&lang=English&md5=85719979DC3CFE146E12E85378B70C78
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Fri, 16 May 2014 13:56:30 GMT
Server: Apache
Content-Length: 0
Connection: keep-alive



GET /infofiles/liveupdate/update/update.ini HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com


HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:54 GMT
Etag: "2683035385"
Expires: Fri, 23 May 2014 13:57:54 GMT
Last-Modified: Tue, 13 May 2014 09:28:22 GMT
Server: ECAcc (fra/D466)
X-Cache: HIT
Content-Length: 5696
Connection: close
[Update].UpdateMode=1.FileName=.FileMD5=.FileSize=.DownURL=.RunParam=.
AutoUninstall=0..[Product].ASC=0.UninstallerPro=1.UninstallerFree=1.Un
installer=1.Malware Cleaner=0.RealTimeProtector=0.Surfing Protection=1
.ManageMyMobile=0.GameAssistant=1.ASCandU=1.PCTransfer=0..[ASC].IsPush
=0.RegPath1=HKEY_LOCAL_MACHINE\SOFTWARE\IObit\PCtransfer|InstallPath.R
egPath2=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\IObit\PCtransfer|Insta
llPath.RegPath3=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentV
ersion\Uninstall\Advanced SystemCare 7_is1|InstallLocation.RegPath4=HK
EY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion
\Uninstall\Advanced SystemCare 7_is1|InstallLocation.AppName=ASC.exe..
Setup_MD5=.Setup_Size=.Setup_URL=.Setup_Param=....[UninstallerPro].Lat
estVersion=3.0.4.922.RegPath1=HKEY_LOCAL_MACHINE\SOFTWARE\IObit\Uninst
aller 3|UninstallerPro....[UninstallerFree].UptTitle=Uninstaller.Lates
tVersion=3.1.8.2434.RegPath1=HKEY_LOCAL_MACHINE\SOFTWARE\IObit\Uninsta
ller 3|UninstallerFree..AppName=IObitUninstaler.exe.TipTime=72.ServerT
ip=0.ProductTip=1..Setup_Type=1.Setup_Mode=0.Setup_MD5=.Setup_Size=.Se
tup_URL=.Setup_WebURL=hXXp://VVV.iobit.com/update/uninstaller/index.ph
p.Setup_Param=/sp- /verysilent /suppressmsgboxes..File1_Mode=.File1_Na
me=.File1_MD5=.File1_Size=.File1_URL=.File1_Param=..White_Enable=0.Whi
te_2052=0.White_1055=0.White_1042=0..Black_Enable=0.Black_1059=0.Black
_2057=0.Black_1033=0...[Uninstaller].LatestVersion=3.2.0.128.RegPath1=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Unins
<<< skipped >>>


GET /tpl/css/public.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Encoding: gzip
Accept-Ranges: bytes
Content-Type: text/css
Date: Fri, 16 May 2014 13:57:02 GMT
Last-Modified: Fri, 25 Apr 2014 07:57:07 GMT
Server: ECD (fcn/4036)
Vary: Accept-Encoding
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 5524
....S.ZS...<ks.H... ....n..<.V.........0.]...X# ......_e...B..l\
....%...].YY.1.GuC[r.lSgq..{~$w.....Z=?....Y..Z7.......{...-...#...O..
..'./E..G....?...6..N.q.5K..j...7.._Q..$...^......?..!..HW..6Z.....N..
C8.....).'...g.{...y..e..;.#..n1........3#m...(g_..!?.....-....c....4]
..,Z..~c..I.&/..!..W_.Z.......'..:..'.....m.GO.a7.Fz...W.}.Z.....(...i
WEY...]DN.x'.qYGmV.......<)x..7...3.h.g...Q..4.......y..._...#.&..y
F.M..!'.z... EF.Ok...|]..Y.ms.|............86..........@..*J[Z.......~
.3.....w..I.Ty..n.e..Vsyk.q.g-......k$[o..r..?.).I.........Qn..9%..jt%
..I.j.....DN.a.b?0....}...b.".Y..z.. .D..\.....Te.q.3....|...<AW...
&Zs...:.].....i....h........|....y".1.....n.2.F5W.m...S[V.......P.u..-
..i.r.q......8..(h..ut........>.-.....=....<*v'l..zK..U.m...zB.I
./_I..-.v.Eq...i..<w.. .. .i...{...!L@../...~..J..e\..3v._>jc..o
N...mE......L.!F...P.......'y....&X...).c.1.=4.2ni._.h../rH.......o.7.
.G.. PEv....z...zOD...S.6..vv!...O....`...GYE1.8..Y{.3....j.}...}.}..H
Z:0.x.#!.!....}.2.b.E9.=i.....K.wC|...#M...W...`tp$.Y..Yf y. 7\1.O...C
..... ..UN.VK.~..1|..F1.r..?.........u..u..C......g..[..o.WE....Q....}
..b.H..B?~.......4.TEI...&.`. K..@.;Ou.....X..... 2)......&..[..F.a?.u
......]..t.>B..?...;?cw...e.y4v.iDE.u..?I...%...p..y..x\.j.....O..f
.o.....C^`. ....=uaa...'.A4..>?&uY.hq.UM}7..b.d. ...  ...'.|.xi.m\.
...\...vB.......=7..t......?.qL..Y.......7!}6v,...c.....c...g.R.......
-.lE....3t._.n......w8.Ir)..C..`'....'......2..X.^..I...0.,.ZA.0.....H
.....k'K.dCoF.I.wVj..aw6&5....`2.;9)J...5..\rY.?.34..|........vn6?
<<< skipped >>>

GET /tpl/js/base.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: application/x-javascript
Date: Fri, 16 May 2014 13:57:02 GMT
Last-Modified: Thu, 23 Jan 2014 06:26:41 GMT
Server: ECD (fcn/4032)
Vary: Accept-Encoding
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 1647
....!..R...X}S.6..;...D..6.;.u.4a.@o.[..r...;N..X.X.$'.6.}.d)....v.R..
U.=.&....B{.=.."S..\.)6._r,..I%h6A4.Y&.S<!@xY.......`.P....q.......
.y...$@...:3,..Y.....[...|.......'.>..X).{R.^.yad...i..z..0 .#".f&l
t;.qJ......,.......s.c.b.).)4.q!.... D..[.d.). c\0uC....k..?......T...
.=....|...c)}/.....y....#...a..h8D.>.f..S.t:. .._...2h...;l....3...
".$A.&..V.m5...........dD).......Y^.*OK!>.#.B*..jt...JA..j...... ..
.[..=.x.]_....d...8.u..J Bp.VN^.......w..%$5.P.|..QS...jL..*c6.......,
......OI|.Ry.5|...qn..t...QF..$.R....,.B..;6...1....EK.'T..#.q..h[..&.
..;......p...W.n.=M(...T..$...yH...0...J.0!...R.$XaP.&..;N...J54.O.R..
..m.e.....Z.....L.[7.yG2.u...3"....8.G...A..`.0....M...afX..n. ..B...r
......9k.i..._.i.gU..TB.}D....KH..W.Q'..........Q..h.!....3.F.2O..|8..
.._.9B...f.q.x8!..p.......M.l....)#.._[...;<%..5oE..A5.s...%.S....m
...Q.K.t.(B`.@.T..AgQ.~%..<.2..o..:R.VC.e~%~.IB2.K.o.v0{AF......:..
~...}........Qx..qx..=;vs..;.Q.....2f.G.Q3......zA.C^=..Al<.].a...P
A\...&.........Pc......i.n.....C.V{`.E{!].f.....r.F4...%....ck...../.W
.i...p...`..0r.cAtWl3..5...p.Lu.k...v.%...kxA9Z..34.....(n..c..:.a?.6-
uO.Lr.. ......r..R...=E......[.... .-.:k.F..z.M.....nc.%.h.......6....
.p...>.S.>z....]gN!hf.\.....IPJX^r...C.S)A.NR0..j.....H...wg3.4.
18.........Q......@.8;....h..Ad......s....x<.@....0n...N.... ......
[..qW2.a.%... ..B...k..V.k.^........7d.u.W....]...xV|2a_..pEY/.za..OU.
....emW .Z.....}.... k.T.J...J....jr..Non....\..S.ql......;. ...J.)y..
...'..!.&....g]@.....R..imxE1.....%9.dveX ...;..C`I.n.s[B-..h.....
<<< skipped >>>

GET /templates/install/asc/7/img/asc7pro.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Thu, 20 Feb 2014 03:32:39 GMT
Server: ECD (fcn/4026)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 7181
.PNG........IHDR.............m>.7....tEXtSoftware.Adobe ImageReadyq
.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/
xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRe
f#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did
:7B34998C99DF11E3917EE3FB33A963F2" xmpMM:InstanceID="xmp.iid:7B34998B9
9DF11E3917EE3FB33A963F2" xmp:CreatorTool="Adobe Photoshop CC (Windows)
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A94079F8994511E3
AF76E3CE6AB76578" stRef:documentID="xmp.did:A94079F9994511E3AF76E3CE6A
B76578"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.k......PLTE....................$()-.....
!......679..(..)"#&..4.:T.(7..?."-..4."J./?$%(.(G.#:$Tz.4J.@Z!Ih>&g
t;C!Nu..#CDI8:B%Y..CeHJQ..T....%TVV[''*128.2`(c..*_.$0.u..7k#Pm..lMQ[.
..) 2.<wTYe//2..&#(0.-;.B..2K.6....:AN....Fsfjt.7X.Dv.K....dfj....:
c__bNNS.`.\ak.V.......,Z.P..y}.5e..R..M.suy,o........k..Eb.Qt.I.....b.
....5rmos....X.......D.....!..'..... 9x:...Xx1** %$ ..'.....2..0..VKJ.
................1.....IDATx....C....'.D.@b B6.&..........j...g....%1..
.N..V.....f#...3..;...Q....>........$.......7..S....;!.T. .tw..r...
.D.*j.@.s...t.p..)..E..=n......._o......u..6n.~FT.X(.u`p.PrOO.)...
<<< skipped >>>

GET /templates/install/asc/7/img/icon_05.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:24 GMT
Server: ECD (fcn/4025)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 347
.PNG........IHDR.............8.G.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.bloo.g``..@$...`... I..0.........ZNm.......Mo....=6...[..
......U...=}.....T....8....Y...G|).. G....,........?.....-..G.........
~.....(....L .C...M...7-..Pv..-[....;...Ij'..@..._.H..@jhQ....hiV.... 
...F....1..n`........J..b6$>'41...,d~.....M`X.@.....1.........IEND.
B`.....


GET /templates/install/asc/7/img/icon_11.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:11 GMT
Server: ECD (fcn/4034)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 646
.PNG........IHDR..............!$h....tEXtSoftware.Adobe ImageReadyq.e&
lt;...(IDATx..VMDDQ..y.&""ZM.D..".Q.E..Rb..(-FL.J.D).""EZ$...6.Z.h....
.!"bL....x..z........s....h.R.x.a.4L....P...-..:`.x..B%....F..N..8b.&l
t;%j..(&..9D.........I..A.....a.=...........p.....0......#.$ H..J...L&
......@..[e.8..~...t.{.)(_.(0..k.....<'c..G...P......K.....<...h
.".1..E`!.w!.^xN)?.<.......?H......E......%.|.o.$.*T....I.......H..
.aIQ..$....%.b....&.#.jC .q.H..|4.4....Hz.'?.1 6,.@"ud.IN\ .k._E......
..-.MU.....Etn.6.T9N9......Z.@t&.O......~.,.K.-.$*..]..e W.Rr.H.$.gRJ.
..........k................Ny...d..V......J..W..&.i>.k..qGe{...a...
.w'.....}.....$n...M......IEND.B`.....


GET /templates/install/asc/7/img/jane_mcclain.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/jpeg
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:01 GMT
Server: ECD (fcn/402E)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 4049
......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-
c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C82B6B95C64FE2
11ACA6CFE47D057EFB" xmpMM:DocumentID="xmp.did:EF010B634FC711E2B038C0C9
9E4C2723" xmpMM:InstanceID="xmp.iid:EF010B624FC711E2B038C0C99E4C2723" 
xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:84ACFC44C74FE211ACA6CFE47D057EFB" stRef:
documentID="xmp.did:C82B6B95C64FE211ACA6CFE47D057EFB"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.....................P.P..............................................
..........................................!..1A"..Qa2.q..B#...R...br..
3.$.....4D.UF.....................!.1.Q.A.a"................?...L..>
;..../.n.....U.)b.B.9W.P.....a..F.....^.g;^.m45.L.[=.N.!.#Kk@..L...T..
.`v=.......N.l..G..W...T.RO....O........../.R........S....h?7K,fO....b
Kd.|#.. .{....#...^$R..TE......@....n..... ..^l.>Paa.Z.0.......
<<< skipped >>>

GET /templates/install/asc/7/img/discount.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:37 GMT
Server: ECD (fcn/4034)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 6423
.PNG........IHDR...?...?.....W_......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..[...e.......9{.Ln ...D.&......,.q.. ..(.x.]....a....x.}.
..y.Q...`.L.%....3su..}wW.~..U.U=3.H.............;..4. ....w...0t8.K..
.Sk..uZ.2c....q.p..F....C]...8.. ..[].......?....#x..Xwlc..F...V.6..\.
.m.v?..............>.....S.....\...ouC..VB.{.-.....M]>..z.\...@.
.shQ34.]..|....gs.. ..7...ki..#6.8=..f.qy..Z...............%1.i..4[..`
6.Q n&4.!.......-F....._....?..O..P ....n...|u...............mn.o0..g.
...nxG.G...c.|............<.9.0zz..j..u...$..\i.=..}oz*C.?.s...3.4`
6........!....*v.Lo... .._..:.V....&-.d...x..y.x.b7I...Vu.3..J..w..5..
....b.s.@..VO.E.......^..........O....N#.nA.>/T...O..i4j.....{..\p.
J..7u7.}...?.........@.&..Hj..@...:.P..:I;Z....... j^.Z..F<..%....F
....D.r.u.....=.(.^......_U..~v....w....8..7..d........\B...*h.O.h.H._
...eo.A[..\....=..hj..\.".'b\/F.....O..K./j}..a.....,..lN.2%.....4...4
]U.P.....d._;O.w.v.@@.. [M..5....x.`.......H..{.`u..........5.....D...
C.-...@...#....c.G..h..2.j..!..V.V.E..... ..EB..u~#x[=!....N..WG@.}.-.
....l<.z..^....... ......LM.:...*>....p.w...B.T}J.~f......t.=...
.....Oo.ch...V....{Z.....C.....]m..}a.....e...F..:.....F.R.i......|...
:..'X......P....X.j.2E]....|#f.....ms.h..... ...3)Kc.......[.. .{z.$..
7.{.4..&.(..........X3......:.....l...yAs(:...an@.b..0.N|~6.kf..Q._.x.
%...j...h.".T.}..>..'......c.h.........c..f..H<......@v..L......
.0...e8.......y......(..|..DF.8...i..j..;.........[,p....5.(N.>1...
..6..A.I..^P..2.....F.....E.=2|..~..`ds..F9S.~...$..4~....QX..X...
<<< skipped >>>

GET /tpl/images/public/favicon.ico HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: VVV.iobit.com
Connection: Keep-Alive
Cookie: __utma=12415148.1451469242.1400248624.1400248624.1400248624.1; __utmb=12415148.1.10.1400248624; __utmc=12415148; __utmz=12415148.1400248624.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)


HTTP/1.1 200 OK
Content-Encoding: gzip
Accept-Ranges: bytes
Content-Type: text/plain; charset=UTF-8
Date: Fri, 16 May 2014 13:57:06 GMT
Last-Modified: Wed, 26 Dec 2012 05:48:39 GMT
Server: ECD (fcn/4026)
Vary: Accept-Encoding
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 276
.......P..c``.B... ...... ......@!..D...X...83.A.......=.@|..g.1.T....
....^{ ...W..1..j .....T./.....R..]P.ux.(...@..E.......rP5.....x.....x
.....b.,r.@........u.%..( .../,r.P.....c.(.7....7B.n...I-?........8..G
Bz...J.* 3I.Kk..?...g`x(..p......c.>....1..|........T........t~...H
TTP/1.1 200 OK..Content-Encoding: gzip..Accept-Ranges: bytes..Content-
Type: text/plain; charset=UTF-8..Date: Fri, 16 May 2014 13:57:06 GMT..
Last-Modified: Wed, 26 Dec 2012 05:48:39 GMT..Server: ECD (fcn/4026)..
Vary: Accept-Encoding..X-Cache: HIT..X-Cache-Info: not cacheable; resp
onse code not cacheable..Content-Length: 276.........P..c``.B... .....
. ......@!..D...X...83.A.......=.@|..g.1.T........^{ ...W..1..j .....T
./.....R..]P.ux.(...@..E.......rP5.....x.....x.....b.,r.@........u.%..
( .../,r.P.....c.(.7....7B.n...I-?........8..GBz...J.* 3I.Kk..?...g`x(
..p......c.>....1..|........T........t~.....



GET /dl/asc730/dl-info.upt HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=66-130


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 66-129/130
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:55:08 GMT
Etag: "2693207509"
Expires: Fri, 23 May 2014 13:55:08 GMT
Last-Modified: Fri, 16 May 2014 10:58:08 GMT
Server: ECAcc (fra/D44C)
X-Cache: HIT
Content-Length: 64
Connection: close
iobit.com/dl/asc730/asc7_setup_730_free_05161823.exe..IsSubmit=1..



GET /js/jquery/jquery-1.7.1.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: codes.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-javascript
Date: Fri, 16 May 2014 13:57:02 GMT
Last-Modified: Fri, 14 Feb 2014 01:56:12 GMT
Server: ECS (fra/D4E2)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 93868
/*! jQuery v1.7.1 jquery.com | jquery.org/license */.(function(a,b){fu
nction cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.pa
rentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f("<" a ">
;").appendTo(b),e=d.css("display");d.remove();if(e==="none"||e===""){c
l||(cl=c.createElement("iframe"),cl.frameBorder=cl.width=cl.height=0),
b.appendChild(cl);if(!cm||!cl.createElement)cm=(cl.contentWindow||cl.c
ontentDocument).document,cm.write((c.compatMode==="CSS1Compat"?"<!d
octype html>":"") "<html><body>"),cm.close();d=cm.creat
eElement(a),cm.body.appendChild(d),e=f.css(d,"display"),b.removeChild(
cl)}ck[a]=e}return ck[a]}function cu(a,b){var c={};f.each(cq.concat.ap
ply([],cq.slice(0,b)),function(){c[this]=a});return c}function ct(){cr
=b}function cs(){setTimeout(ct,0);return cr=f.now()}function cj(){try{
return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ci
(){try{return new a.XMLHttpRequest}catch(b){}}function cc(a,c){a.dataF
ilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,e={},g,h,i=d.l
ength,j,k=d[0],l,m,n,o,p;for(g=1;g<i;g  ){if(g===1)for(h in a.conve
rters)typeof h=="string"&&(e[h.toLowerCase()]=a.converters[h]);l=k,k=d
[g];if(k==="*")k=l;else if(l!=="*"&&l!==k){m=l " " k,n=e[m]||e["* " k]
;if(!n){p=b;for(o in e){j=o.split(" ");if(j[0]===l||j[0]==="*"){p=e[j[
1] " " k];if(p){o=e[o],o===!0?n=p:p===!0&&(n=o);break}}}}!n&&!p&&f.err
or("No conversion from " m.replace(" "," to ")),n!==!0&&(c=n?n(c):p(o(
c)))}}return c}function cb(a,c,d){var e=a.contents,f=a.dataTypes,g
<<< skipped >>>


GET /tpl/js/redirect.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Encoding: gzip
Accept-Ranges: bytes
Content-Type: application/x-javascript
Date: Fri, 16 May 2014 13:57:02 GMT
Last-Modified: Sun, 04 May 2014 08:40:05 GMT
Server: ECD (fcn/4029)
Vary: Accept-Encoding
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 2386
......eS...\m..6......PQ..mc.v..\..X4....Z\z.. .%.f".*I.Y...oHI.$."...
E..........C..._..........y.Squyu....qH...'..!&R..=^s".....#. o.....i 
.M...^]^.-......m0......j..>|.~.c......!.."i.<g.|..kuez}$%.7$...
...qDb..~S^k...%XG......E4.3.|.%y..........D.9..b..4...we........z....
.tY.9A.C..........D....]. ..r.%.q...>r.3......,...&b..d.....kd...r.
l...V......X>..-...q_...I.....<.0...V.....~0.I..6Xh7cx.b1...2..l
M..`...#........ ..p$.*...j...\t{,.........o.3@J.h.....m.3...I2...~...
IhH.iLQ./..r.o.e....."'.hMs.XE.&4..4.!...I..0........>....X........
..q..,......8.E4.a.....m.q...\.86.v0<........77P..y...F....K@CC....
D.4.(0L...Ip.....SXM.!.7i.3<........[...2."L....}.._...$..b.;......
.....8C0..p.....E...?r........fT...Lbg......U.=s.t).u.UTc.`..[....B.-.
......(.F0.bG..5...>)^...................T...\.f......p.P..}..y....
... v...I.`a2].vP.4K......-#......n,......e.Gd.5...g...tk.0F}...0...-.
l..I..1...C.j...L. K.'. x....... F...o.i...G..k.|....u.1W|..{....OX&.^
.m....,oP?.O..@M...Vl9X...S4W...h.f<.Q.Q...@m-=..[d..'....L...M.tO=
.n. ..wo.[.D..]Y[x.T.........y.V.G......zP.4...m-.......c. iD......d_.
.=.^n(.F...._. .mQSyo...5...b.( i..c,.......2\.....q]...R.a..R6..A.JO.
~B.=WId.......OYM.....p.e....VNMP...t.....r..U.J..gFAi*o.9b....)..2...
p....3.a...f......n.w9DR.....0....;...#@...S......G7.h......!0....PA.F
.v......u.....n....}........................5}...K"W........Y.U.]....j
}P(.qB...l.6.....N$.....9#......z..#g$......;....N,B.1....6.!...Y..QP.
.....).f.. (.....pB.$.ct...Qq...Z. .[ .l.............s.(5.4 s..;..
<<< skipped >>>

GET /templates/install/asc/7/img/asc7free.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Thu, 20 Feb 2014 03:32:34 GMT
Server: ECD (fcn/4036)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 7131
.PNG........IHDR.............m>.7....tEXtSoftware.Adobe ImageReadyq
.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/
xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRe
f#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did
:7C70C7AD99DF11E38C2B9FA2D1DB1DA6" xmpMM:InstanceID="xmp.iid:7C70C7AC9
9DF11E38C2B9FA2D1DB1DA6" xmp:CreatorTool="Adobe Photoshop CC (Windows)
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B271F95E994511E3
93CDE7570B0058E2" stRef:documentID="xmp.did:B271F95F994511E393CDE7570B
0058E2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>...,....PLTE.................&.....%.. ..
.()-679.k...*..3!"&.(6..>$%'.:U..2."K./?.#9.(G.(Z.s. Mu Ih.@Z#Tz.4J
8:A>>C.6_.3l.CeBDJ%Y...W.9}...''*.L.128.G.."..v..C.O5 .2L) 2GJSV
V[gksTYe.f..-:JIJ'c..Cw...#QmMQ[.S.//2"(1/ ..Sv...cdi.:u.p.NOS\al Z.^]
a...9AOJ........ru{.\..Dc6d.......|~.....h.........w..b......t....M...
'................GD..1....4...(m.F-.'...{& %$q@..v. ..1**2.....0..gNN.
......................IDATx..\.C....@...` .#....p.....u.Uk........s.{I
._.k'.`e..V}...{..e.5f......v.{.D.,...g..........^#.8...6C....,A....X.
..;.....8&,V%4..O.Z..i.....A_...Qzgx.Ms.t?Q,....x6....X. .......m.
<<< skipped >>>

GET /templates/install/asc/7/img/redmark.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:26:48 GMT
Server: ECD (fcn/402A)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 398
.PNG........IHDR...............mJ....tEXtSoftware.Adobe ImageReadyq.e&
lt;...0IDATx.b...@)...fL......@........% ..b.&..... .....e.. ....2..9.
).q.....O.1....C..>...$H5(...... ..l.C ...l..Q..v(.../C.d.:...'..%N
 ......@.eA.....@).[B.sA....kH.6.....h.q#....&l61.E#....X.*...EH...n\.
.......Fh...bc.....F..y.0..@......5.@...A..(..  `.d..|.`3....c.nB.1@c.
9@ga.nb.B.....@.....%.i ..*..1. ....<w.~.@....IEND.B`.....


GET /templates/install/asc/7/img/icon_09.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:17 GMT
Server: ECD (fcn/4030)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 1036
.PNG........IHDR...!.................tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx....d.a.....#...2....X.cs..MY.%.(..?..eiv..F.)fS..i..t.f..
r#.sq.;..c....................|..<...k.........@7..&P..o ......I8..
..(...<..`.4.yp....m...I...s.!...sSe.........kR`.<.K..X...s.q...
2.>|F._......'..s..y%W.$xEe..L9.P....@;.P2.....'...#..u-..x.C8V....
...cj.~0S..3.7.l.ry....u...`.....Wt.......!c.....{?..-...B...k...."...
.)..=.F....@G..!.Jt....%......q.....1~.....j...i..B>.Og2.p...8.ye..
LhR...1..^....2..s.2.bQZ...9.}..a...?..2.>Z...r..%.J%.G.X..`...L...
...FFFj.%....Z..St.P..F...2K.j.[!..um)(...?.,r./-c......-k".A..WD.\...
... ....F...-=<.......eX;....wr|.................2r...<..T"'....
..R&..]<..3}B...k..c.'6%.g.e..~#!J{....fK'.9..3...QB..Y.T....q.zlXF
.LV3,DczBH...l.s.y-......%...%z.`..Tb..1!B...el.w...(^.w.>r.VE.x.?.
|ND.k.....2{.U.~.....=.........J%T&;.......c,fkF&M..z:h..V~t.R..D.[;.-
.R.|..w.=...y ...:s.%.c.O9...&;...?....e..Y..n~....._.l.M..?C..e......
e..F./...u.....<....y*q....j..r.......V.Fv\...`.6##B_..YEg....{.`..
...<.KW.......IEND.B`.....


GET /templates/install/asc/7/img/icon_12.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:10 GMT
Server: ECD (fcn/4037)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 461
.PNG........IHDR..............!$h....tEXtSoftware.Adobe ImageReadyq.e&
lt;...oIDATx.b...?.1....D....T....'F/#>K......b. VG.>..V.Y...*..
A....Y ~..?....X..GN....@..5.d..G....P6(..... .G....8..."...b{ ......t
j...***....@..*......."...b] ....@|.Zq.....;h.c.j..eF.j.......vPP|..y.
..../.....I.....mhrg..%.d...E@<.......R......... 5..w .I......6.e..
...he.3.@..;.....W#U..X.l.dP..1.R.=....#.A...P...%.....F..k.P..1..A.R.
T....W@.(.f...y|.I4._...P<.....0.4.Y..K2k....IEND.B`.....


GET /templates/install/asc/7/img/bob_bassett.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/jpeg
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:51 GMT
Server: ECD (fcn/4032)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 3699
......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-
c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C82B6B95C64FE2
11ACA6CFE47D057EFB" xmpMM:DocumentID="xmp.did:38D77E2A4FC811E2B407E3A7
57881674" xmpMM:InstanceID="xmp.iid:38D77E294FC811E2B407E3A757881674" 
xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:84ACFC44C74FE211ACA6CFE47D057EFB" stRef:
documentID="xmp.did:C82B6B95C64FE211ACA6CFE47D057EFB"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.....................P.P..............................................
...........................................!1A.Qaq"........2R#s....3S.
.F.Br.....Cc.$67.........................!1AQ..a...23...q.".BRb#..$4..
...........?..W.imksr....P....o......".^.1J.F..u..v....%..C...Y......e
..u.g.1>......./... .K.!..w...{..}".....=.@_...=..w....q>....y..
...K..;~n..<...~<Z9.I.G.q..S[.F.....7w...U.......#.. .J.....
<<< skipped >>>

GET /templates/install/asc/7/img/arr.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:28:07 GMT
Server: ECD (fcn/4036)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 1128
.PNG........IHDR.............Vu\.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:6E0CF29F648B11E2BC84E49E
8FDF97C9" xmpMM:DocumentID="xmp.did:6E0CF2A0648B11E2BC84E49E8FDF97C9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6E0CF29D648B11E2BC
84E49E8FDF97C9" stRef:documentID="xmp.did:6E0CF29E648B11E2BC84E49E8FDF
97C9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>...(....IDATx.b...?...L......8..-. .8....Y.
r.....A......-@l...\.b.........L>...P./@..E.e 6a.:C.I......_4. 5i .
.h...V..L......4.as4P.. ...../..fL.../d6..8...p..9........A6.DS..T<
.H.GS.. ...G.&....AO...... .L..y.... >....T..... ...tC.........IEND
.B`.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: image/png..Da
te: Fri, 16 May 2014 13:57:04 GMT..Last-Modified: Fri, 03 Jan 2014 09:
28:07 GMT..Server: ECD (fcn/4036)..X-Cache: HIT..X-Cache-Info: not cac
heable; response code not cacheable..Content-Length: 1128...PNG.......
.IHDR.............Vu\.....tEXtSoftware.Adobe ImageReadyq.e<..."
<<< skipped >>>

GET /tpl/images/public/loading.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive
Cookie: __utma=12415148.1451469242.1400248624.1400248624.1400248624.1; __utmb=12415148.1.10.1400248624; __utmc=12415148; __utmz=12415148.1400248624.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/gif
Date: Fri, 16 May 2014 13:57:06 GMT
Last-Modified: Wed, 19 Feb 2014 06:47:24 GMT
Server: ECD (fcn/402E)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 9074
GIF89a].]................$$$,,,666...LLL<<<DDDvvv~~~hhh\\\TTT
................................................!..NETSCAPE2.0.....!..
XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
 <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c0
14 79.151481, 2013/03/13-12:09:15        "> <rdf:RDF xmlns:rdf="
hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description r
df:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http
://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/
sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmp
MM:InstanceID="xmp.iid:942E6173993111E3A7F0E6F8B2088058" xmpMM:Documen
tID="xmp.did:942E6174993111E3A7F0E6F8B2088058"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:942E6171993111E3A7F0E6F8B2088058" stRef:d
ocumentID="xmp.did:942E6172993111E3A7F0E6F8B2088058"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>..................................................................
................................................................~}|{zy
xwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9
876543210/.-, *)('&%$#"! .................................!.......,...
.].].@..`$.di.h.<...p,..`.@....C..,rX....r.T6......6......z....0(..
G..R...>..=.G.u.k..../....T.~........K..............a.......&.kk..V
586:.Ei....R.......e.f.)zylo..."xv.s).........$..g..4.....M...};....3.
..........4..d4....?..`...h......jP......1..e...M.....[...K..\..Q.
<<< skipped >>>


GET /webslices/ie8?culture=en-us&r=asdf9488 HTTP/1.1
Accept: */*
Host: az307127.vo.msecnd.net
A-IM: feed
Accept-Language: en-us
User-Agent: Windows-RSS-Platform/2.0 (MSIE 8.0; Windows NT 5.1)
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: public, max-age=7200
Content-Type: text/html; charset=utf-8
Date: Fri, 16 May 2014 13:57:30 GMT
Expires: Fri, 16 May 2014 15:57:31 GMT
Last-Modified: Fri, 16 May 2014 13:05:09 GMT
Server: ECAcc (fcn/40CB)
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 3.0
X-Cache: HIT
X-Powered-By: ASP.NET
Content-Length: 2044
..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.
org/TR/html401/strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999
/xhtml"..      lang="en-US">..    <head>..        <title&g
t;Personalize Your Web Browser</title>..    ..    ..    ..    ..
    ..    ..    ..    ..    ..    ..    ..    <script src="hXXp://a
z307127.vo.msecnd.net/?v=1e84fd8_9f72d9476963b62ddbb9dce9fb63c036&p=sc
ripts&js=jquery-1.5.1,jquery-ui-1.8.11.min,jquery.tools.scrollable,jqu
ery.tools.scrollable.autoscroll.pete,jquery.tools.scrollable.navigator
,jquery.jscrollpane.min,jquery.mousewheel" type="text/javascript">&
lt;/script>...    ..    ..    ..     ..    ..     ..    ..    ..   
 ..    ....    <script src="hXXp://az307127.vo.msecnd.net/?v=1e84fd
8_9f72d9476963b62ddbb9dce9fb63c036&p=content/js&js=s_code,analytics,ga
llery,gallery.layout,gallery.browse,layout,addon_utils,detail" type="t
ext/javascript"></script>.  ..        <script type="text/j
avascript">..            var langAndLoc = "en-us";..        </sc
ript>..        <link type="text/css" href="hXXp://az307127.vo.ms
ecnd.net/content/css/webslices.css?v=1e84fd8" rel="stylesheet" />..
    </head>..    <body>..<div id="ie9slice" class="hsli
ce">..    <span class="entry-title">Get more Add-ons</span
>  ..    <p style="display:none;"><span class="ttl">999
9999</span></p>   ..    <div class="entry-content ie8sl
ice">..        <div id="slice-inner">..            <im
<<< skipped >>>


GET /install/asc/7/en.php HTTP/1.1
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Encoding: gzip
Accept-Ranges: bytes
Content-Type: text/html; charset=UTF-8
Date: Fri, 16 May 2014 13:57:02 GMT
Last-Modified: Fri, 16 May 2014 06:18:48 GMT
Server: ECD (fcn/4024)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 5615
......uS...=is........\.6..k...R.K...xy.s.:..."!.6I..hY]~...~.........
".6oq..H,..8;........o..'.?^.%..{......'.T..~.<..NoO....=.@..:..h .
.".^....DJ....Zm8.V..U..k...G.......2=..rK...z.G..dk.........2.....%..
.~..C.t"...U....D...*)..j...8..I.Z..UvK..P.W.k..hpOF"&=...HE=..}r.>
..a...I....1r.1F*..e........o..9f}..0.z.!.&q.|...R.@..yO....J.j...B...
j.....T".&`.....Z%.F.....A|.,.A^`...-...}.g..Z.>`.*..D|.u..0H......
s..9..rbE.8:.P..d.xJV.B.=FC....qU..Q.{..e...7...[...&.}S......%/....M.
.{..n^.a~.Q...,[....h..%......L|G..n.CeP..2rRau..d.....(w.v.K.....4.;.
F..A.n..1.R..f.V...a.hRT&.f.9QP`....C.ty....@u.d..,h......N..BZ.....O?
.@..U.X..~*w@..9...U. ..G....N...4.?..k}*|....3......G.'... Y..U..9.@.
;.W W...-..^.8H..u......)...N....:...~.1|[ ......Y......V.. .....">
..8..A.hM.../.Vf$OXn.#..#<....k5).2.'..I*....lu@....)..M.#...A:%..Q
.);.y<..}\...~..|@d5.....`.*./..1.....t.H.x....o.Y...8]E`.1........
.U..,..G...........we.......X.UZ .5k.........wA.@)`.b..9W...u<*...F
..X...F=.Xj.C:.DKIkO.E......5-.cO.....).2.'..H....g.\1..].en.....a.}e.
.eH......(..A..@qf>i.....6.....d...6.r.}P...I..A.LS.=.z.:H...$....B
....v..|....s......p....6O..O#0I.%.}.....`.X...#.O@z.3.e1.;...r1. ...e
#.S.o.7..,.t..0Q%....'..<?..p....l.....k. ........j.$.3..z....7X@Nu
..,F.8..S..V....8/d....P(w-..N.Q.wu....@cH.[.xe.......P....R........$y
...J....9..}.r.5......Y.Z.p.......7s.#`......p...Gf..Z.\...k......6...
`B..?..jrf.I3..O...z~.....E."...@.......Rr.K..}...v?-.....}...*..).J.\
.Z.}R].!...:'d.A|.$.3.X.t....R..N....T..,.o..N)r..!D..-I}.64.q....
<<< skipped >>>

GET /tpl/css/reset.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/css
Date: Fri, 16 May 2014 13:57:02 GMT
Last-Modified: Thu, 19 Dec 2013 07:34:21 GMT
Server: ECD (fcn/402E)
Vary: Accept-Encoding
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 415
....}..R...R...0... ...........k..-...Ht.....q..v..7b..p.|..ZU........
.....cp.F.D@..../......;.W...Ke.. 9..B.#../..5d0.......=...]......s!.R
]w...dRqX.6..\.]..B....bS.......b....C.`.(...\....\R.o..u....P.B.F1..8
#?1..W....F.(..9.........)..%.X...Z..ol_...c.-.......A.c,pZ.........'.
t.........e3.....;.:f5..p....g ..L...I.i.....S2...~j....g..(M...=...V.
../i.s%..{6...]..=..G.......7......).eU..3.I.?.G. ........A525...t>....


GET /templates/install/asc/7/css/install_en.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Encoding: gzip
Accept-Ranges: bytes
Content-Type: text/css
Date: Fri, 16 May 2014 13:57:02 GMT
Last-Modified: Fri, 03 Jan 2014 09:28:13 GMT
Server: ECD (fcn/4034)
Vary: Accept-Encoding
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 1062
.......R...W.r.0.}.W../m.......gt..X.!1B.I..{%$la0.'/.VG{9gw....pJ.Bp.
4./I.M.~.\0!.U....('.....R.F..".*@..<..pE...}YY....Io_!YRm..O.Z% ..
.P.\T5.....B.#... ..V...g.!.J....#6G...H{..{.......H....%..6.kL.t`}...
.u".k.2!1.A&..U..|........(~.#...........PE.G._.R....^.o2...D....`.."^
.&0>x.}...".D!.@.!#)..<u...._..........3G..4'..<....,.0..D...
.)V')..tU.].J..c...._..l.m...E.....Q.34....24...*R..C.k...8.V.oa.B....
..... ..`@.. .<.......E......!./"h7/....j..L.?&.L ..{..&.."ku./.4..
....Th.'6."N...F.S^.V...8....Z.... .a.9M..D..iS3..fL..c.......a.}.7.$z
d>h..C...%u...6ST.a4...9....9...Q.Z.....Z..............ag....K..%9(
9.2._A." ..5;.?A..P.).$..U7p..]O........*.1[.(8....lJ.E....mBtF...,^..
.$A]-..w~I...oK>.Z5}.....S.;3y.6.?\..VYw:..d...<....:..%@..L....
..c.n.2^.......`ms0.^~..p.nS.O?^......s3...........o..Iks.......(w...q
..3.....u....D..h..V.S.... .vpao..\.a.6Z.D.36....lhmI.....f..*.vEv....
..n\iw...L%............V...]...f&._Q..y.C.{u........,v...*...e.Z6.I.z.
M......e.P...Mif..T...I9..l..Bm.....A..6W....../o.....>...5..1.[.t.
...6.....q....f{..................Z....HTTP/1.1 200 OK..Content-Encodi
ng: gzip..Accept-Ranges: bytes..Content-Type: text/css..Date: Fri, 16 
May 2014 13:57:02 GMT..Last-Modified: Fri, 03 Jan 2014 09:28:13 GMT..S
erver: ECD (fcn/4034)..Vary: Accept-Encoding..X-Cache: HIT..X-Cache-In
fo: not cacheable; response code not cacheable..Content-Length: 1062..
.......R...W.r.0.}.W../m.......gt..X.!1B.I..{%$la0.'/.VG{9gw....pJ.Bp.
4./I.M.~.\0!.U....('.....R.F..".*@..<..pE...}YY....Io_!YRm..O.Z
<<< skipped >>>

GET /tpl/images/dropdown/banner-dbfree-300x250.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/jpeg
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Wed, 23 Apr 2014 08:08:52 GMT
Server: ECD (fcn/4037)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 19584
......Exif..II*.................Ducky.......<.....*hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-
c014 79.151481, 2013/03/13-12:09:15        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" x
mpMM:InstanceID="xmp.iid:6368DF18CABB11E39EB199DF701037A3" xmpMM:Docum
entID="xmp.did:6368DF19CABB11E39EB199DF701037A3"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:6368DF16CABB11E39EB199DF701037A3" stRef
:documentID="xmp.did:6368DF17CABB11E39EB199DF701037A3"/> </rdf:D
escription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r
"?>....Adobe.d.....................................................
......................................................................
........................,.............................................
..............................................!..1AQ"2.Uaq.R....t.....
....Bb#3.%5...r.&F...c.$.G..Ss.4Td.Ee6..D.......................!..1Q.
.2R..Aaq..."....#.B.3br..D..............?...l6!.D.......Fd.*.."...Pn|.
..|oqo.P*`p...............|oqo.P=0.?7E.......o.....[...M...l_po..96...
.}..k@..p.m....Z.|..y.'.7.h.6....=..k@..6..."{.~..~nm..6D......so..'.7
.h.....dOpo...76....{.~..............ooy.'.7.h..{{..=..k@|...l...{
<<< skipped >>>

GET /templates/install/asc/7/img/icon_01.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:31 GMT
Server: ECD (fcn/4029)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 471
.PNG........IHDR..."..........k......tEXtSoftware.Adobe ImageReadyq.e&
lt;...yIDATx.bloog..6 ..bE....@|....;.........a`......& Cw......."<
H..@AE'.8.......&y.......H.a`b.$..B..,'.e.....rH...A..(q....!.Fr......
.3..w...V...bo.r..(.........J......-...f...F0.5@...~AM....1...........
.(.RQ......T......:./.z@Ew...........$....k. ‹..-TO5.....@....@.p...
...H3A!z.."..X.Za...p..gA...zb.&T....h .....@.N..k^3B;X.........y.....
..#.*...p..p.q/-KVR:b....5D..,z.......UE-.Q......IEND.B`.....


GET /templates/install/asc/7/img/icon_06.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:23 GMT
Server: ECD (fcn/4030)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 915
.PNG........IHDR...".........I.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...5IDATx....d.a....{F.2.......e)....hJ).RL..R.c...;.Rb4b....&..1Mi
..)..".#".8F....s.=...c.^....}......y>..Z..tT).]5.V....J...C.1...!;
....[.}.|..............>.U....y,Y2.....g.$x...q...x...a.j......z...
._q....@........4xAQ..y.O........}...`..{..2....'........B....".]...?c
..K..=?(..Yg.*.....Zd.x]$.@'.~...v....@?....]..5S..a.h.oq.......i....M
.........(X..y...%....@L<o....mO.Nn...=.-.....3/!....-m..).e.y?...f
.}W...V.....2.....D.Y... L.J|@...e....r{...nV...7!..A:S...;L_ ...q....
.UB..[.Q).`....!..).....Dl.CF..fG.t......2_bfM..2(..."...C.5|..c..._..
.<..3.%...g.8>.v.....h.YTT.i.......]3.AL..}.G..H.%:.o...(.%.....
x_b......_.....C.Y1j.Op.g.,...l.....V..."../=H....<...s....r.Q.....
..Wr.....a.Y.N.G...`?.`.b.b.!D&.. .M.s..[...>.u..i..%R......-f@.z-.
.f..5C........Q . F...5!c...J4 B....E2...Z.0......8.........!/E..Y.-.;
.i.Z...`....M...O....IEND.B`.....


GET /templates/install/asc/7/img/icon_04.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:26 GMT
Server: ECD (fcn/4032)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 666
.PNG........IHDR..."..........7m.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...<IDATx..W.G.Q...F......DDYJ.(......E..eimZe#=..H./=..".C, ..X
R...H)"...p...wvk....;.|..s....r9.....&#X...T*....a..._t..(.......q.7.
....t@B.%!F8 .5..*!.`.f..p.vW#d..P.i..xtB.8..........q..y..&.5..0...-.
.N...VeT#$...h.<w..r......."*..&........ ..............{"z..f..V...
/]!..qV..'..q.^8..7...(..U$c.B.`QW..|...z..q...W0.jy... ....W.........
..#..4e......ZD....[.Wl..a.g..W..G.^.S.....u..........4...I..c..s....]
!E.$....].t..D@;r.K...8.*....Ujt}.[....e...'..z..Y.a.d.,......W...o..x
I..G.)*...0.....J8.... ....u...>..7.9/.....(.._..8=.W.........Q..sF
C..y..7G..........fD..........l3.X......IEND.B`.....


GET /templates/install/asc/7/img/almirr.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/jpeg
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:28:08 GMT
Server: ECD (fcn/402C)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 3374
......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-
c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C82B6B95C64FE2
11ACA6CFE47D057EFB" xmpMM:DocumentID="xmp.did:0998E05E5ED611E29D249D22
A7AB4DBF" xmpMM:InstanceID="xmp.iid:0998E05D5ED611E29D249D22A7AB4DBF" 
xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:DFB68037C15EE21196A7AC307664CE4A" stRef:
documentID="xmp.did:C82B6B95C64FE211ACA6CFE47D057EFB"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.....................P.P..............................................
.........................................!..1..AQq."2..a.s..7R3....Br#
...6.b....4.%uFV.......................!..12AQ....q#a"3$4............?
........U.T..\..S.Q..9..4..dw,....#"(..Z..........;.6/3...j.......H.V.
Z.:4.....J.R.T...$._......W..Z}M....`......9e..&....;..........P||.2?.
...|$I-T......?y...$.F<.2..?r.0&.h.O..6. .....xs.S.4m.S..m72...
<<< skipped >>>

GET /templates/install/asc/7/img/itemb.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Mon, 03 Mar 2014 06:54:15 GMT
Server: ECD (fcn/4033)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 1241
.PNG........IHDR.......Y.....na......tEXtSoftware.Adobe ImageReadyq.e&
lt;...qiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:bd428a34-3886-fc4c-9478-ac81af280e1c" xmpMM:DocumentID="xmp.did:
F558BE30A29F11E3986C8694C43721B9" xmpMM:InstanceID="xmp.iid:F558BE2FA2
9F11E3986C8694C43721B9" xmp:CreatorTool="Adobe Photoshop CC (Windows)"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d8945716-744d-254
6-812a-7262ca2df929" stRef:documentID="xmp.did:bd428a34-3886-fc4c-9478
-ac81af280e1c"/> </rdf:Description> </rdf:RDF> </x:x
mpmeta> <?xpacket end="r"?>.P......PLTE......................
......................................................................
..........................................G....nIDATx......0...."..q1.
....?{.....y....5......:%o.;sJ..H..cvmO...._=...=......3...E...6f..4'.
.z...zc.....<.......#W........IEND.B`...
<<< skipped >>>


GET /infofiles/liveupdate/update/update.ini HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=2849-5696


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 2849-5695/5696
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:54 GMT
Etag: "2683035385"
Expires: Fri, 23 May 2014 13:57:54 GMT
Last-Modified: Tue, 13 May 2014 09:28:22 GMT
Server: ECAcc (fra/D466)
X-Cache: HIT
Content-Length: 2847
Connection: close
CAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit 
Surfing Protection_is1|InstallLocation.RegPath2=HKEY_LOCAL_MACHINE\SOF
TWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IObit Sur
fing Protection_is1|InstallLocation.AppName=PluginInstall.exe..TimerRu
n=SPUpdate.exe.TimerRunParam=/SvrRun.TimerInterval=12.TimerRunType=0..
BootRun=PluginInstall.exe.BootRunParam=/FixEnable....Setup_Type=0.Setu
p_Mode=1.Setup_MD5=.Setup_Size=.Setup_URL=.Setup_Param=/sp- /verysilen
t /suppressmsgboxes....File1_Mode=1.File2_Mode=1.File1_Name=.File2_Nam
e=.File1_MD5=.File1_Size=.File1_URL=.File1_Param=/sp- /verysilent /sup
pressmsgboxes.File1_RunFile=...White_Enable=0.White_2052=0.White_1055=
0.White_1042=0..Black_Enable=0.Black_1059=0.Black_2057=0.Black_1033=0.
..[RealTimeProtector].LatestVersion=1.0.0.0.RegPath1=HKEY_LOCAL_MACHIN
E\SOFTWARE\IObit\RealTimeProtector|InstallLocation.RegPath2=HKEY_LOCAL
_MACHINE\SOFTWARE\Wow6432Node\IObit\RealTimeProtector|InstallLocation.
.AppName=RealTimeProtector.exe.RunName=RealTimeProtector.exe.RunParam=
/run..[GameAssistant].LatestVersion=1.2.0.421.RegPath1=HKEY_LOCAL_MACH
INE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GameAssistant_
is1|InstallLocation.RegPath2=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\M
icrosoft\Windows\CurrentVersion\Uninstall\GameAssistant_is1|InstallLoc
ation.AppName=GameAssistant.exe..Setup_Type=0.Setup_Mode=1.Setup_MD5=1
CDB5F08584A30DA490CD1132FE11C01.Setup_Size=3858632.Setup_URL=hXXp://up
date.iobit.com/infofiles/liveupdate/download/gameassistant_beta2.0
<<< skipped >>>


GET /en/ie8slice/default.aspx HTTP/1.1
Accept: */*
A-IM: feed
Accept-Language: en-us
User-Agent: Windows-RSS-Platform/2.0 (MSIE 8.0; Windows NT 5.1)
Accept-Encoding: gzip, deflate
Host: iegallery.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 302 Found
Location: hXXp://az307127.vo.msecnd.net/webslices/ie8?culture=en-us&r=asdf9488
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Fri, 16 May 2014 13:57:29 GMT
Content-Length: 189
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://az307
127.vo.msecnd.net/webslices/ie8?culture=en-us&r=asdf9488">here&
lt;/a>.</h2>..</body></html>..HTTP/1.1 302 Found.
.Location: hXXp://az307127.vo.msecnd.net/webslices/ie8?culture=en-us&r
=asdf9488..Server: Microsoft-IIS/7.0..X-Powered-By: ASP.NET..Date: Fri
, 16 May 2014 13:57:29 GMT..Content-Length: 189..<html><head&
gt;<title>Object moved</title></head><body>..&
lt;h2>Object moved to <a href="hXXp://az307127.vo.msecnd.net/web
slices/ie8?culture=en-us&r=asdf9488">here</a>.</h2>
..</body></html>....



GET /install.php?operate=1&user=1&app=un3&ver=3.2.10.2466&pr=asc&system=51&type=1 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: ascstats.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Date: Fri, 16 May 2014 13:56:57 GMT
Server: Apache
Content-Length: 4
Connection: keep-alive
trueHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..Date: Fri
, 16 May 2014 13:56:57 GMT..Server: Apache..Content-Length: 4..Connect
ion: keep-alive..true..



GET /dl/asc730/dl-info.upt HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com


HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:55:08 GMT
Etag: "2693207509"
Expires: Fri, 23 May 2014 13:55:08 GMT
Last-Modified: Fri, 16 May 2014 10:58:08 GMT
Server: ECAcc (fra/D44C)
X-Cache: HIT
Content-Length: 130
Connection: close
[Option]..MD5=85719979DC3CFE146E12E85378B70C78..URL=hXXp://update.iobi
t.com/dl/asc730/asc7_setup_730_free_05161823.exe..IsSubmit=1..



POST /cgi/api.cgi/114576/8C9A823EF2F54A2DA307F9A0DD862C57/vloc/4 HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml
User-Agent: WidgiToolbar-182-114576
Host: iobitapps.mybrowserbar.com
Content-Length: 464
Connection: Keep-Alive
Cache-Control: no-cache

<drq><auth><ccv>182</ccv><cnid>114576</cnid><tbcnid>114576</tbcnid><isn>8C9A823EF2F54A2DA307F9A0DD862C57</isn><ct>4</ct><dlid>1033</dlid><lngid>1033</lngid><wv>5.1</wv><brw><ie>8.0.6001.18702</ie><ff>29.0.1</ff><gc>34.0.1847.131</gc><dbrw>Internet Explorer</dbrw></brw></auth>
<vloc><type>install</type><key>1</key><key>3</key><key>2</key><key>4</key><key>5</key><key>6</key><key>7</key><key>8</key><key>9</key><key>10</key><key>11</key><key>14</key></vloc></drq>
HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:57:43 GMT
Server: Apache
Pragma: no-cache
Cache-control: no-cache
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Fri, 16 May 2014 13:57:43 GMT
455..<drp><auth>.  <scv>182</scv>.</auth>
;.<vloc>.  <li>.    <key>1</key>.    <value
>hXXp://yandex.ru/yandsearch?clid=1782905&text={searchTerms}<
;/value>.  </li>.  <li>.    <key>3</key>.  
  <value>hXXp://yandex.ru/yandsearch?clid=1782905&text={sear
chTerms}</value>.  </li>.  <li>.    <key>2<
/key>.    <value>hXXp://yandex.ru/yandsearch?clid=1782905&
;text={searchTerms}</value>.  </li>.  <li>.    <k
ey>4</key>.    <value>hXXp://yandex.ru/yandsearch?clid=
1782905&text=</value>.  </li>.  <li>.    <key
>5</key>.    <value>hXXp://yandex.ru/yandsearch?clid=17
82905&text={searchTerms}</value>.  </li>.  <li>.
    <key>6</key>.    <value>hXXp://VVV.yandex.ru/?cl
id=1782904</value>.  </li>.  <li>.    <key>7&l
t;/key>.    <value>hXXp://VVV.yandex.ru/?clid=1782904</val
ue>.  </li>.  <li>.    <key>8</key>.    <
;value>hXXp://VVV.yandex.ru/?clid=1782904</value>.  </li&g
t;.  <li>.    <key>9</key>.    <value>359</
value>.  </li>.  <li>.    <key>10</key>.   
 <value>114576</value>.  </li>.  <li>.    <
key>11</key>.    <value>114576</value>.  </li&
gt;.  <li>.    <key>14</key>.    <value>fa
<<< skipped >>>


GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: VVV.yandex.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:57:54 GMT
Content-Type: image/x-icon
Last-Modified: Thu, 15 May 2014 14:32:02 GMT
ETag: "5374cfe2-47e"
Accept-Ranges: bytes
Content-Length: 1150
............ .h.......(....... ..... ............................~....
......................................................................
.....................................{................................
......................................................................
......................................................PP..((..........
...........................<............................ii.........
.........................................................%%...........
......................f....................//..\\..CC.................
.................................AB..{|...............................
............................*...............(.........................
....f................8N..............*A...............................
..................._y..........8Y.........................<........
....................Y|..Ai..Lr........................................
......................................................................
...................................x...............{..................
......................................................................
....................................HTTP/1.1 200 OK..Date: Fri, 16 May
 2014 13:57:54 GMT..Content-Type: image/x-icon..Last-Modified: Thu, 15
 May 2014 14:32:02 GMT..ETag: "5374cfe2-47e"..Accept-Ranges: bytes..Co
ntent-Length: 1150.............. .h.......(....... ..... .............
...............~......................................................
.........................................................{........
<<< skipped >>>


HEAD /msdownload/update/v5/eula/windowsie7.0-enu-d0ce5c0e-a2fd-4f4e-b53c-44e562026ce0.txt?1405161357 HTTP/1.1
Accept: */*
User-Agent: Windows-Update-Agent
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 2894
Content-Type: text/plain
Last-Modified: Thu, 28 Sep 2006 00:54:03 GMT
Accept-Ranges: bytes
ETag: "42f7d69798e2c61:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 16 May 2014 13:57:53 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
HTTP/1.1 200 OK..Content-Length: 2894..Content-Type: text/plain..Last-
Modified: Thu, 28 Sep 2006 00:54:03 GMT..Accept-Ranges: bytes..ETag: "
42f7d69798e2c61:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..
Date: Fri, 16 May 2014 13:57:53 GMT..Connection: keep-alive..X-CCC: RU
..X-CID: 2......


GET /msdownload/update/v5/eula/windowsie7.0-enu-d0ce5c0e-a2fd-4f4e-b53c-44e562026ce0.txt?1405161357 HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Thu, 28 Sep 2006 00:54:03 GMT
Accept-Ranges: bytes
ETag: "42f7d69798e2c61:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 2894
Date: Fri, 16 May 2014 13:57:53 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
..P.L.E.A.S.E. .N.O.T.E.:. . .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.
n. .(.o.r. .b.a.s.e.d. .o.n. .w.h.e.r.e. .y.o.u. .l.i.v.e.,. .o.n.e. .
o.f. .i.t.s. .a.f.f.i.l.i.a.t.e.s.). .l.i.c.e.n.s.e.s. .t.h.i.s. .s.u.
p.p.l.e.m.e.n.t. .t.o. .y.o.u... . .Y.o.u. .m.a.y. .u.s.e. .a. .c.o.p.
y. .o.f. .t.h.i.s. .s.u.p.p.l.e.m.e.n.t. .w.i.t.h. .e.a.c.h. .v.a.l.i.
d.l.y. .l.i.c.e.n.s.e.d. .c.o.p.y. .o.f. .M.i.c.r.o.s.o.f.t. .W.i.n.d.
o.w.s. .X.P. .S.P.2. .a.n.d. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .
S.P.1. .s.o.f.t.w.a.r.e. .(.t.h.e. .. s.o.f.t.w.a.r.e.. )... . .Y.o.u.
 .m.a.y. .n.o.t. .u.s.e. .t.h.e. .s.u.p.p.l.e.m.e.n.t. .i.f. .y.o.u. .
d.o. .n.o.t. .h.a.v.e. .a. .l.i.c.e.n.s.e. .f.o.r. .t.h.e. .s.o.f.t.w.
a.r.e... . .T.h.e. .l.i.c.e.n.s.e. .t.e.r.m.s. .f.o.r. .t.h.e. .s.o.f.
t.w.a.r.e. .a.p.p.l.y. .t.o. .y.o.u.r. .u.s.e. .o.f. .t.h.i.s. .s.u.p.
p.l.e.m.e.n.t... . .M.i.c.r.o.s.o.f.t. .p.r.o.v.i.d.e.s. .s.u.p.p.o.r.
t. .s.e.r.v.i.c.e.s. .f.o.r. .t.h.e. .s.u.p.p.l.e.m.e.n.t. .a.s. .d.e.
s.c.r.i.b.e.d. .a.t. .w.w.w...s.u.p.p.o.r.t...m.i.c.r.o.s.o.f.t...c.o.
m./.c.o.m.m.o.n./.i.n.t.e.r.n.a.t.i.o.n.a.l...a.s.p.x...........P.l.e.
a.s.e. .n.o.t.e.:. .A.s. .t.h.i.s. .s.o.f.t.w.a.r.e. .i.s. .d.i.s.t.r.
i.b.u.t.e.d. .i.n. .Q.u.e.b.e.c.,. .C.a.n.a.d.a.,. .t.h.i.s. .n.o.t.i.
c.e. .i.s. .p.r.o.v.i.d.e.d. .b.e.l.o.w. .i.n. .F.r.e.n.c.h.......R.e.
m.a.r.q.u.e. .:. .C.e. .l.o.g.i.c.i.e.l. ...t.a.n.t. .d.i.s.t.r.i.b.u.
.. .a.u. .Q.u.e.b.e.c.,. .C.a.n.a.d.a.,. .c.e.t.t.e. .n.o.t.i.f.i.c.a.
t.i.o.n. .e.s.t. .f.o.u.r.n.i.s. .c.i.-.d.e.s.s.o.u.s. .e.n. .f.r.
<<< skipped >>>

HEAD /msdownload/update/v5/eula/ie8rtmeula-enu-ac95a9ce-9522-47a1-b0d3-09f0d26e41f5.txt?1405161357 HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 8998
Content-Type: text/plain
Last-Modified: Wed, 25 Feb 2009 22:51:56 GMT
Accept-Ranges: bytes
ETag: "e2b21aa99b97c91:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 16 May 2014 13:57:53 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
....


GET /msdownload/update/v5/eula/ie8rtmeula-enu-ac95a9ce-9522-47a1-b0d3-09f0d26e41f5.txt?1405161357 HTTP/1.1


Accept: */*
User-Agent: Windows-Update-Agent
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Wed, 25 Feb 2009 22:51:56 GMT
Accept-Ranges: bytes
ETag: "e2b21aa99b97c91:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 8998
Date: Fri, 16 May 2014 13:57:53 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
..M.I.C.R.O.S.O.F.T. .S.O.F.T.W.A.R.E. .S.U.P.P.L.E.M.E.N.T.A.L. .L.I.
C.E.N.S.E. .T.E.R.M.S.........M.I.C.R.O.S.O.F.T. .W.I.N.D.O.W.S. .I.N.
T.E.R.N.E.T. .E.X.P.L.O.R.E.R. .8. .F.O.R. .M.I.C.R.O.S.O.F.T. .W.I.N.
D.O.W.S. .X.P.,. .W.I.N.D.O.W.S. .V.I.S.T.A.,. .W.I.N.D.O.W.S. .S.E.R.
V.E.R. .2.0.0.3.,. .A.N.D. .W.I.N.D.O.W.S. .S.E.R.V.E.R. .2.0.0.8.....
....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n. .(.o.r. .b.a.s.e.d. .o.
n. .w.h.e.r.e. .y.o.u. .l.i.v.e.,. .o.n.e. .o.f. .i.t.s. .a.f.f.i.l.i.
a.t.e.s.). .l.i.c.e.n.s.e.s. .t.h.i.s. .s.u.p.p.l.e.m.e.n.t. .t.o. .y.
o.u... .I.f. .y.o.u. .a.r.e. .l.i.c.e.n.s.e.d. .t.o. .u.s.e. .M.i.c.r.
o.s.o.f.t. .W.i.n.d.o.w.s. .X.P.,. .W.i.n.d.o.w.s. .V.i.s.t.a.,. .W.i.
n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3.,. .o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.
r. .2.0.0.8. .s.o.f.t.w.a.r.e. .(.f.o.r. .w.h.i.c.h. .t.h.i.s. .s.u.p.
p.l.e.m.e.n.t. .i.s. .a.p.p.l.i.c.a.b.l.e.). .(.t.h.e. .. s.o.f.t.w.a.
r.e.. ).,. .y.o.u. .m.a.y. .u.s.e. .t.h.i.s. .s.u.p.p.l.e.m.e.n.t... .
Y.o.u. .m.a.y. .n.o.t. .u.s.e. .i.t. .i.f. .y.o.u. .d.o. .n.o.t. .h.a.
v.e. .a. .l.i.c.e.n.s.e. .f.o.r. .t.h.e. .s.o.f.t.w.a.r.e... .Y.o.u. .
m.a.y. .u.s.e. .t.h.i.s. .s.u.p.p.l.e.m.e.n.t. .w.i.t.h. .e.a.c.h. .v.
a.l.i.d.l.y. .l.i.c.e.n.s.e.d. .c.o.p.y. .o.f. .t.h.e. .s.o.f.t.w.a.r.
e...........T.h.e. .f.o.l.l.o.w.i.n.g. .l.i.c.e.n.s.e. .t.e.r.m.s. .d.
e.s.c.r.i.b.e. .a.d.d.i.t.i.o.n.a.l. .u.s.e. .t.e.r.m.s. .f.o.r. .t.h.
i.s. .s.u.p.p.l.e.m.e.n.t... .T.h.e.s.e. .t.e.r.m.s. .a.n.d. .t.h.e. .
l.i.c.e.n.s.e. .t.e.r.m.s. .f.o.r. .t.h.e. .s.o.f.t.w.a.r.e. .a.p.
<<< skipped >>>


GET /translate_static/js/element/main.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: translate.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Last-Modified: Tue, 25 Mar 2014 23:24:10 GMT
Date: Fri, 16 May 2014 13:47:13 GMT
Expires: Fri, 16 May 2014 14:47:13 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1529
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 593
Alternate-Protocol: 80:quic
...........V[s.:.~..P5S..*.;Ms :...6.&=3.... ..FT.;n..~V..'u...c..>
.....a..E"2.|.3........ !.).."..S...2.2m.....J........4Z...{.-LR..]..b
e!F.9`i:]b...q.P."..."LF._........(^bc.....s9...E!.....%.\Q..L......!.
...PHmPR._.' `I..c.u.0.P...ID..#.:..e....0.M......A.!.6{.[.....L.b6[].
...3=...01........Rq2,...L-..."..M).~.....O...?.q.V....H?...f.q.....b.
...P......3.%/t".6...u..5.\| .N.M.......Q.!.D..Fy...SQJ$.......L...$BW
B.Q.\|......W..;p......q.e....\.Hr.0q.u[......s.8...Fv .... !.(......I
.W ..n...fA*..h...'I."_..z``Cw...ei.......`. / vgs.).mE..p...n.9I.!x..
Nr...<.5:eYT.,...T..p]..u..*...c:aS..$.......H.....2Mi.L&~.|c.B..z.
...U#X...n.].DP./@R.a#x.. .zku...V:S.).y.nwm.......h.m....{.W.p#!.e;Z.
~U..#.....Y.....0K!..l.|u.@n.z..'.=....!.e_h;." .... 5_.F.)..,...1....
.S. 9 r.6[.c....}..c.."....n".<...@..@......7...z...,....:5X.ZS..@.
9Te....>.|YY...8cY5>~..M{.(.|.c..j...~..V...y..(L$P)...... .B...
....7.I ...W.V.s..?J..!8...3/.V_z."..Q..>..<...Y...t.dP. ...j._k
9...X.!...6.......^.>.......>...Ml.v..;......9..w.....k.....t..0
h.'&.$G......G..1=/G>..a..q...V..a[...lf.{l.v'Ov..I>....>.L&g
t;S.`..'....7... .l;.....g@.XK.v.....{u2...|.....T...cOA-.#..c..'ss>
;./B?.69[dT...Q...-x......y...[...~..Z ............I.....Zg:.....qcj.M
B..%...AB.)=m_XLg...../9.....S.q.^XM0^.A.|.Kq..................4.v^/.~
.......$.S.p....h.*..1...cW /..&.S..B....0.Z lzW. ...3.x.....u'....l&g
t;w`..k..]...l.z.3..>q...x.x....BG.i`......n.XU.7p..*.9<......1k
4..b&.........Z.d@.T... .^.................7....|.N..I0<.!.X..,
<<< skipped >>>

GET /translate_static/js/element/23/element_main.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: translate.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Last-Modified: Tue, 25 Mar 2014 23:24:10 GMT
Date: Fri, 16 May 2014 12:58:37 GMT
Expires: Fri, 16 May 2014 13:58:37 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 89990
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 3509
Alternate-Protocol: 80:quic
............i_.I.........V..,.....:b..l..L.j.....$..g..........>..L
.Qn.kddDdDd.:l..F..q.z.{.Uo.hG.....Ip...7...v..n.&n.{......:.....n.{..
...V}...........[...a .{n....c...:=..m.z.{.{..N3..6....~.G.5Ux....n.;.
.......(.;Q|y...iu;m.......5...P..~.w...^<....~...."/x1E.f..b?.... 
..~....{..G.hP.K..K.~;..v..t.^g.N.j8SI.HU.8]...tzv..t.F...v/.....Sl<
;;..KbW5....7..iy......E..{.x`.,O.l..T.....8=7.3...:...lN...'../v...v.
..v...".I7U..L.?.kG....;S....M./......nH...t...JUq0[E...:...........w.
...M..v.....t.v....~sp...8...v-....._c.L..l.D..o ..t>;p.O.*=..3U5.q
...&..Y.x......Q....8...g.gz.\...n.....u........h.Q.......`.i.E.N.....
]..fv -}/.N0]&...~.......h..M?.!.t....)...GO.N....w..D6..f.......__r..
.P...V3.....(.V`...N....g....:e..)7.g8..Kn..;T..{G..M..{O.~.Q.`..../..
.3......8\r...a....%>G....A.y.@]].uL..dt.M......b|.,.}t......f#..C.
.M&"..R...../..[:N.....sc.....D.O.....W....w.........2.u.W..:.tj.....1
...nP...K.&......n!.....z\%.Yr.9.0.Iu...H ...#..]n.E......S....=....A.
.%..?..[...o...0v..{....h.=4=....yK8...#.....K.1..j.....c...1g...t..O6
Q......3Ll........87...^ ..D.sI..a......Z.L..T~GCa.V_6..{M).L... .....
7..&...n...c.o.....<T?$..".4.[L'....<....Z....C..E...F.%.(j.j.c.
'.AV.JQ.Z{.l J.0........Pm..@.b.......Q\....U#..f.....nQ..u. .....o.R.
.  ..I.m.E...y#h.v.]..:b;.&..5.........O..............VB..p...0...?...
....M05......M..Pf...........:|^.....t.....{....1.&@..&..~BH..d......p
...CNsX..G..5...l......L..6......"..D.=3v.......N.H...;...v.Z..T.c.k..
N.Q....L(?.........=.%.6;..8....p/B.....\.......|.@.?..O.|.6....@p
<<< skipped >>>


GET /images/pixel.gif?stb=1&sds=1&shp=1&cnid=114576 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: VVV.mybrowserbar.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 16 May 2014 13:56:38 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 1093
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: image/gif
GIF89a.............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:68AF816F211411E187C8D4C48A
462294" xmpMM:DocumentID="xmp.did:68AF8170211411E187C8D4C48A462294">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:68AF816D211411E187C8
D4C48A462294" stRef:documentID="xmp.did:68AF816E211411E187C8D4C48A4622
94"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.............................................
......................................................................
...............~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIH
GFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ........................
.........!.......,...........D..;HTTP/1.1 200 OK..Date: Fri, 16 May 20
14 13:56:38 GMT..Server: Apache..Accept-Ranges: bytes..Content-Length:
 1093..Cache-Control: no-cache, no-store, must-revalidate, max-age=0, 
proxy-revalidate, no-transform..Pragma: no-cache..Expires: Thu, 01 Jan
 1970 00:00:00 GMT..Keep-Alive: timeout=30, max=100..Connection: Keep-
Alive..Content-Type: image/gif..GIF89a.............!..XMP DataXMP&
<<< skipped >>>


GET /infofiles/asc7/update.ini HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent: Mozilla/4.0 (compatible; ICS)
Host: update.iobit.com
Range: bytes=2840-4259


HTTP/1.0 206 Partial Content
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Range: bytes 2840-4259/5678
Content-Type: application/octet-stream
Date: Fri, 16 May 2014 13:57:20 GMT
Etag: "955381131"
Expires: Fri, 23 May 2014 13:57:20 GMT
Last-Modified: Wed, 14 May 2014 04:26:50 GMT
Server: ECAcc (fra/D4B8)
X-Cache: HIT
Content-Length: 1420
Connection: close
31656.Url=hXXp://update.iobit.com/infofiles/asc7/VulXP_brazil0423.upt.
md5=0DAE2BE769056E1A23F9DCC50067B638.BI=..[VulXP_Spanish].Version=2014
04231656.Url=hXXp://update.iobit.com/infofiles/asc7/VulXP_spain0423.up
t.md5=4621EA45920E7E141366814292C3C1CF.BI=...[VulXP_Italian].Version=2
01404231656.Url=hXXp://update.iobit.com/infofiles/asc7/VulXP_Italian04
23.upt.md5=CC2F5F7F144516E219DBFDE155C56054.BI=..[VulXP_Chinese].Versi
on=201404231656.Url=hXXp://update.iobit.com/infofiles/asc7/VulXP_Chine
se0423.upt.md5=E0D1F5262DD347CF9D0F964519096978.BI=..[VulXP_Portuguese
].Version=201404231656.Url=hXXp://update.iobit.com/infofiles/asc7/VulX
P_Portuguess0423.upt.md5=0B521D820902CD72AC9DF8A291B4AD64.BI=..[VulXP_
German].Version=201404231656.Url=hXXp://update.iobit.com/infofiles/asc
7/VulXP_German0423.upt.md5=7C0564EAEB5B4C81DAD97CDC9A232B57.BI=..[VulX
P_ChineseTrad].Version=201404231656.Url=hXXp://update.iobit.com/infofi
les/asc7/VulXP_ChineseTrad0423.upt.md5=D2C1DA8A4895370025BE6EAD2FC9B1A
8.BI=..[VulXP_Czech].Version=201404231656.Url=hXXp://update.iobit.com/
infofiles/asc7/VulXP_Czech0423.upt.md5=B05F39769BA41F253F7BB7E55C7FB91
7.BI=..[VulXP_Korean].Version=201404231656.Url=hXXp://update.iobit.com
/infofiles/asc7/VulXP_Korean0423.upt.md5=5DFD89E138F2EC187B06401FFFC88
E5A.BI=..[VulXP_Dutch].Version=201404231656.Url=hXXp://update.iobit.co
m/infofiles/asc7/VulXP_Dutch0423.upt.md5=2153F149F1C56F49FDD69D69BB391
DB9.BI=..[VulXP_Russ..
<<< skipped >>>


GET /tpl/images/public/icons.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Thu, 10 Jan 2013 09:30:39 GMT
Server: ECD (fcn/402D)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 5657
.PNG........IHDR................#....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx...........Y....O....9.s.EV<P..e"'W*....V,...<.P.:K.
.K..URg.U(...w.41..$w*I.F....EW.(q. .......?3}......3.......<U/=...
...|o...=3.[o..BD.....k....;.....f......6V..N..].6o.0..v.yNg...^p...P.
o.".c...F...O.c..Y..l.. ....3t..FM....Vj.e*..|^.Le......N.l..q...2.IG.
e.j.>.o.H.........%....3...~.......R.5.....e.....p. ^Xy37..H.N...vs
]..J...W...7ty..g.R. ..*;uY.}../.......5..8W&.:_...!G.....;u...F......
.%6.....%.*.........a....?S.BI../.....G.5......9.f.~..Er....KnX!c&....
.r...........w4.:.!.,..Q.79.i..J....r..S..)....H.kt..I....w.ST.._.#.W.
g...r...........}.4...I...u ......l.nO.S:t.x._.......'t...-..........}
._._.......(.....?.s.<O....~..m..d..[..Z.p....e....o.d.'v:.....`{F9
..z..R......d............o..}7.....D0p=k.%RY5RZ..S..q...k...}..Z......
../_....|...3.......[..gk;..........-gd..R..15X;..1.w.....w...r.)=.5f.
.nL@.........qgfrkpm./.....x.s.X..G.]?_.)..r...-3gxR.@...C....Un.sv$.J
...`..p...............4.}K..z[.j..*.c9...u.j.^....{........v.b...N..5.
K.......2.....k....i\..U...k.zJU0....n.Y.../.-!.j.$....l[m.Wm..}.7...N
%?.o..3....5....<*...x!2`..j..>..j......e.......E..-.9=......wL&
........._....t...oKzN....-....wR.Wn..?P.. .E],qu.|w..q......v.i..Y...
..>...........2n.X9{........_y.]o.....w.....\.4!.L..g2~$......q.[..
.o....5w.SW....7.s...s.q.e.Q..r;[..s..K/..'O.[...._..]..r......m-.....
@..S.fWu......g._..{...|~0..._..Q.lM. },F......-.i.......G......U..k. 
>.Z.Dq./?...R.....V3o@.%}..!W....~.......=..PzZ..:..X.o...4..-.
<<< skipped >>>

GET /templates/install/asc/7/img/icon_07.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:03 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:21 GMT
Server: ECD (fcn/4028)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 545
.PNG........IHDR.............6.......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx....K.@....t*8u.:...... .N...EQ.DP,....$.(...tr.....S  .N.
....:.B...K..]......;..wy.].R....\........h....'pe.v....L...q.....}...
.l.)....."8..8......<K..e..m..S.`.%...-0.6.. .!....e._f.L.1h#.....C
.uV.d3Uz.......s..M....<."..3k...S.........5..P.|..j.6-`....S@i.T.R
.T.9..X_..h....84p..4n.j..N{&.{A{...4M.;.S5c....,..#...".y.^).(..h..T.
....S~....P...... &v.[`....?G..k@..*.1...}h......!..)..-. |..Za-....f#
.....H...Y.H....Rt7...5B@.mp.z......E4........w..".T....IEND.B`.>....


GET /templates/install/asc/7/img/icon_13.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:08 GMT
Server: ECD (fcn/4031)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 599
.PNG........IHDR.............1J......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx....G.Q....lD.v..%........d.K..2............M$.H...1.1.1b.
......[.....>.9.{...>.<.y_w..u.Y6.....d2m.....8x6....:D.....2
...g...........p8.n@X.6........H.g"..\..o..T)<....l...id.P...Si.fA.
.HB......j.n9At.bH.&..(.L.Q&..........p,^rG..O.LHz......z..:.Y.90.....
I...o ..ornG.\...........%.YH.7@Dz...e".*L.^.aI..>.m:O*...55..A$"SV
AK L..)..qbd....?b..{...^.@..M....*..qb9.()Ih......`....D./ BU....1.. 
VS.t. .6.$..}.....:..h....|........."..L...#...O._........"..G.B&8^ V.
F..2..7...a-&........ ...&....w.|..0.a......<....IEND.B`....
.


GET /tpl/images/public/footer_bg.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Wed, 26 Dec 2012 05:48:38 GMT
Server: ECD (fcn/4035)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 147
.PNG........IHDR.......<.....(.G.....tEXtSoftware.Adobe ImageReadyq
.e<...5IDATx.bHKKc..........YY..88.9y..y....E....$..$.."..0.Qq..Kug
.....IEND.B`.....


GET /templates/install/asc/7/img/icon_02.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.iobit.com/install/asc/7/en.php
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.iobit.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 16 May 2014 13:57:04 GMT
Last-Modified: Fri, 03 Jan 2014 09:27:30 GMT
Server: ECD (fcn/4034)
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 171
.PNG........IHDR..............JL.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...MIDATx.b...?.1.......a(.....,b.@/.0g.p...8.&i..a...z.TTT0...Q.F-
..h..Q..l.@...j..f..I.....IEND.B`.HTTP/1.1 200 OK..Accept-Ranges: byte
s..Content-Type: image/png..Date: Fri, 16 May 2014 13:57:04 GMT..Last-
Modified: Fri, 03 Jan 2014 09:27:30 GMT..Server: ECD (fcn/4034)..X-Cac
he: HIT..X-Cache-Info: not cacheable; response code not cacheable..Con
tent-Length: 171...PNG........IHDR..............JL.....tEXtSoftware.Ad
obe ImageReadyq.e<...MIDATx.b...?.1.......a(.....,b.@/.0g.p...8.&i.
.a...z.TTT0...Q.F-..h..Q..l.@...j..f..I.....IEND.B`...







The program connects to the servers at the folowing location(s):














Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    ASCSetup.tmp:3220
    AutoUpdate.exe:3528
    LiveUpdate.exe:2880
    LiveUpdate.exe:1196
    LiveUpdate.exe:1088
    LiveUpdate.exe:228
    homepage.exe:3284
    Display.exe:2904
    Install_PintoStartMenu.exe:2348
    ASCSetup.exe:3736
    RealTimeProtector.exe:348
    RealTimeProtector.exe:1636
    RealTimeProtector.exe:4036
    IEXPLORE.EXE:2500
    PluginInstall.exe:2072
    PerformUpdate.exe:3408
    Reinforce.exe:3288
    ASCUpgrade.exe:3844
    UpgradeTip.exe:3208
    iobitappsToolbar-stub-1.exe:3908
    sc.exe:604
    sc.exe:3532
    SearchSettings.exe:2724
    AutoCare.exe:2320
    AutoCare.exe:340
    SlickSavingsSet:3300
    AutoSweep.exe:3644
    Regsvr32.exe:2228
    Regsvr32.exe:1324
    ToolbarAcceptRate.exe:3900
    ApplicationUpdater.exe:3388
    verclsid.exe:2532
    verclsid.exe:2520
    IObitUninstaller.exe:3116
    ASCInit.exe:1692
    SPSetup.tmp:208
    regsvr32.exe:2284
    regsvr32.exe:352
    regsvr32.exe:2272
    SPSetup.exe:232
    MonitorDisk.exe:1932
    register.exe:2328
    Wizard.exe:2280
    Homepage.exe:2864
    UninstallPromote.exe:1336
    UninstallPromote.exe:2248
    MsiExec.exe:1400
    MsiExec.exe:2056
    SPUpdate.exe:3656
    %original file name%.exe:2172
    MSIEXEC.EXE:1324
    CouponsHelper.exe:3380
    msfeedssync.exe:2376
    

    2. 

  2. Delete the original program file.
    3. 

  3. Delete or disinfect the following files created/modified by the program:
    

    %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced SystemCare 7.lnk (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-ITB88.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-SBQ5M.tmp (4185 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-KG0RF.tmp (857 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-SASS3.tmp (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-HJGCP.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-BR27O.tmp (898 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-BN4HI.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-359S6.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\drivers\wnet_x86\is-243N0.tmp (23 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-M4IM3.tmp (24284 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-4CEHO.tmp (4185 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-6VA20.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-5TOJN.tmp (7547 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-TN7EJ.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-EGEM3.tmp (3361 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-A3T4R.tmp (15019 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-HMG37.tmp (1425 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-CPR6B.tmp (15116 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\skin\is-6MFF2.tmp (14022 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-J9VO3.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-IC84M.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-NIVS5.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-1MQ5H.tmp (1281 bytes)
    %Documents and Settings%\All Users\Desktop\Advanced SystemCare 7.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\ASCUpgrade.exe (3361 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-6RSJO.tmp (780 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\skin\is-688L8.tmp (7433 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-K1Q8T.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-OQHH6.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-G7VGS.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-D67R1.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-FJ32V.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-5GDGP.tmp (7726 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-KJRV5.tmp (63 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-29FG8.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\skin\is-91907.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-DQ8CJ.tmp (7345 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-TL8T6.tmp (889 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-R4V8I.tmp (968 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-89GRT.tmp (9 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-J68V4.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\drivers\wlh_x86\is-VS17B.tmp (24 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-TJHP3.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-SL9TE.tmp (5441 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-S2CLL.tmp (5873 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-EPEVC.tmp (7345 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-9KUT6.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Update\is-S89N8.tmp (2 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-KG0Q9.tmp (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-6T8QT.tmp (4545 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-HKEJB.tmp (7971 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-QKUON.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-2PTQ6.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-QH0K1.tmp (14 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-5IBHU.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-4OCLS.tmp (7345 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-SCIT8.tmp (46 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-DV78N.tmp (7726 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-KLGSK.tmp (13122 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-VUKSK.tmp (1281 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Main.ini (104 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-3PQP9.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-0UC0R.tmp (3073 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-NJUCF.tmp (1425 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-T7AVP.tmp (3 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-M0G8M.tmp (7433 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Advanced SystemCare 7\Advanced SystemCare 7.lnk (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-TACQK.tmp (15799 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\drivers\win7_x86\is-DFMOE.tmp (24 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-ODK5J.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-O0J3V.tmp (5441 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-2HFE9.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-MVMGC.tmp (1425 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\unins000.msg (646 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-OL1O2.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\drivers\wxp_x86\is-UDJ13.tmp (23 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-TNJOE.tmp (3361 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-U05KK.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-67SSQ.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-A34G8.tmp (44 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-1LNQD.tmp (3361 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-AC83F.tmp (3361 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-TICD4.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-VAF7E.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-U3N5K.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-EJMQ2.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\drivers\win7_amd64\is-10GOM.tmp (27 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-EJ99M.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-M1SMS.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-27V9L.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-2LJ0R.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-UCC5J.tmp (4185 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-N9LE3.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-GIGIB.tmp (44 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-D274O.tmp (1425 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-ECT8K.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-V9RDT.tmp (3361 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-OEPTK.tmp (1281 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\itdownload.dll (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-R271H.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-S0GNH.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-TLHOJ.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\skin\is-IKV3N.tmp (8281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\unins000.dat (38201 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-SJ3D3.tmp (56 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-F42GM.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-B84HA.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-5G3GD.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-LJPO5.tmp (32242 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-CD994.tmp (12 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-BR7E8.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-1S4VO.tmp (6841 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-6NME8.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-1A0LU.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-F94LD.tmp (4545 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\drivers\wnet_amd64\is-06DDD.tmp (26 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-USU05.tmp (3361 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-3CJAR.tmp (43 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-A0UAA.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-LHA6T.tmp (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-5IDA8.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-RGFV9.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-UQKR1.tmp (7433 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-4Q7TA.tmp (3361 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-3EHL3.tmp (1425 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-EKCJD.tmp (4185 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-FC0PH.tmp (4545 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Advanced SystemCare 7\Uninstall Advanced SystemCare.lnk (869 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-NBIG9.tmp (3073 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-QLKO2.tmp (904 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-1AOPI.tmp (8281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-79RRK.tmp (54 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\iobitappsToolbar-stub-1.exe (8281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-45KL1.tmp (23 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-BMNPL.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-MLIH8.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-P0A69.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-J3QH2.tmp (39506 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-PS915.tmp (51 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-9J159.tmp (15116 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-GMLE5.tmp (14022 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-2PTPK.tmp (2105 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\_isetup\_shfoldr.dll (23 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-648U6.tmp (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-E5T93.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-A7K2S.tmp (1425 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-DL5F4.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-2MAN4.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-H617Q.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-C1K6K.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-3S1HS.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-9H9LR.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-UH4K8.tmp (5 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-3SH0L.tmp (11 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-O7GOD.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-VJOBM.tmp (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\RdZone.dll (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-DFPAO.tmp (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-42OFF.tmp (1425 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-S7UHM.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-I4TNG.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-GJ10H.tmp (7433 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-L4PE2.tmp (806 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-37ET2.tmp (7433 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-89VPT.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Update\is-46DMF.tmp (20 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-FI00K.tmp (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-HFEMK.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\skin\is-C84BQ.tmp (10815 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-SQ93E.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-HDL3F.tmp (1425 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\ToolbarAcceptRate.exe (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-LNIAS.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-E1E1P.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-7PU27.tmp (32429 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-3720L.tmp (22 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-T44HN.tmp (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-VGE3T.tmp (3073 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-V3FLI.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\drivers\wlh_amd64\is-UD4JC.tmp (27 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-9F44T.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-F20P8.tmp (2105 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Advanced SystemCare 7\Turbo Boost.lnk (886 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-HQQO4.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-20PHJ.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-DNPI1.tmp (1425 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-K6A1L.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-63J86.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-04H9G.tmp (1425 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-LCM36.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-C2TD5.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-9PA7U.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-C1J5P.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-48DJ5.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-O8SAB.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-K5IV9.tmp (7 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-BB6BU.tmp (56198 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-H0O9L.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LinkImages\is-FMTRF.tmp (1425 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-MTLLE.tmp (5873 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-MB051.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-4045E.tmp (56 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-L8QDP.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-O2QK0.tmp (13122 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-4NSCU.tmp (13122 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Update\is-J5O4I.tmp (11 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-AUVR9.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\drivers\wxp_amd64\is-5SPV4.tmp (26 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-EEV4J.tmp (2321 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-LQ39D.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-MJ3P2.tmp (3073 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-IMU9L.tmp\Inno_English.lng (14 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-H14OM.tmp (7971 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-HF5MS.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-JPIVB.tmp (10 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-PFNI0.tmp (14 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-IHOA1.tmp (11 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-4RU14.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-UO00C.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-0MEK3.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-CKQL6.tmp (948 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-6K5B0.tmp (7547 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-98P8T.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-IUPSQ.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-QKJ5N.tmp (4185 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-28TOU.tmp (15506 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-G2ETA.tmp (7547 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-KCKV0.tmp (5 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-ALJU9.tmp (6841 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Advanced SystemCare 7\Toolbox.lnk (880 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-QQPEU.tmp (6841 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-JNRDB.tmp (11518 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-4C3H9.tmp (2321 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-ESLT8.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-9DVOA.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-76HU0.tmp (36 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-TRVV5.tmp (4 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\is-331UQ.tmp (14988 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-BK9QL.tmp (673 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Toolbox_Language\is-SDTLT.tmp (2105 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Images\is-NKONP.tmp (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\is-ALKAS.tmp (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-LH96E.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Language\is-ELATG.tmp (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\skin\is-IK5N9.tmp (14988 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\License.log (110 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Update\Update.ini (20 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\AutoUpdate.log (7142 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Update\Update.ini.tmp (1521 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Update\Test.ini (34 bytes)
    %Program Files%\IObit\LiveUpdate\update\timer.db (189 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\Downloader.log (13954 bytes)
    %Program Files%\IObit\LiveUpdate\LiveUpdateSrvUpt.log (27392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZtfKYq3ttQv8tnkE.tmp (1700 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZtfKYq3ttQv8tnkE.tmp.dat (1720 bytes)
    %Program Files%\IObit\LiveUpdate\system.ini (93 bytes)
    %Program Files%\IObit\LiveUpdate\update\update.spt (5 bytes)
    %Documents and Settings%\%current user%\Application Data\ProductData\update.spt (5 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Slovak.lng (1281 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LiveUpdate.log (272 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Hungarian.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Czech.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\ChineseSimp.lng (673 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Portuguese(PT-PT).lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Malayalam.lng (673 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Russian.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Greek.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Portuguese(PT-BR).lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Latvian.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\LiveUpdate.exe (15116 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Polish.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Dinka.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\ProductStatistics.dll (4185 bytes)
    %Program Files%\IObit\LiveUpdate\Language\English.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Finnish.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Dutch.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Hebrew.lng (673 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Romanian.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Korean.lng (673 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Arabic.lng (673 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Spanish.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Vietnamese.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Belarusian.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Japanese.lng (673 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Flemish.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Slovenian.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\ChineseTrad.lng (601 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Serbian (latin).lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Serbian (cyrillic).lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Ukrainian.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Italian.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\German.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Indonesia.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\French.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Turkish.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Swedish.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\Language\Danish.lng (1281 bytes)
    %Program Files%\IObit\LiveUpdate\LiveUpdate.log (806 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\homepage.log (607 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Display_log.txt (796 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\HealthLevel.ini (82 bytes)
    C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\change.log (244 bytes)
    C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000009.lnk (2 bytes)
    C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000007.lnk (2 bytes)
    C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000008.lnk (2 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Uninstall Programs.lnk (887 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\IObit Uninstaller\MenuRight.dat (302 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-HLFGJ.tmp\ASCSetup.tmp (7386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\icon_11[1].png (646 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\google_logo_41[1].png (87 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\icon_13[1].png (599 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\css[1].css (527 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\f[1].txt (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\itema[1].png (997 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\jane_mcclain[1].jpg (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\icon_10[1].png (580 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\mony_back[1].jpg (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\asc7pro[1].png (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icon_14[1].png (606 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\main[1].js (277 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icons[1].png (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\discount[1].png (690 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\icon_09[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\footer_bg[1].png (147 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\public[1].css (12682 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot (4689 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\f[1].txt (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\reset[1].css (821 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\translateelement[1].css (9026 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\bluemark[1].png (441 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\banner-dbfree-300x250[1].jpg (776 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\logo_head[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\loading[1].gif (1107 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\icon_04[1].png (666 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\redirect[1].js (3398 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\icon_03[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\element_main[1].js (151668 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\almirr[1].jpg (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\scrollup_telsupport[1].png (1308 bytes)
    %Documents and Settings%\%current user%\Cookies\5I7OX03J.txt (570 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icon_06[1].png (915 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\favicon[1].ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\jquery.superbox-min[1].js (2450 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icon_08[1].png (556 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\en[1].htm (1849 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\icon_12[1].png (461 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icon_02[1].png (171 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\icon_05[1].png (347 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\asc7free[1].png (7 bytes)
    %Documents and Settings%\%current user%\Cookies\U5CZ81GJ.txt (120 bytes)
    %Documents and Settings%\%current user%\Cookies\EAC1U558.txt (570 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\gordon[1].jpg (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\base[1].js (2317 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\icon_07[1].png (545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\arr[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\icon_01[1].png (471 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014051620140517\index.dat (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\btns[1].png (578 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\install_en[1].css (807 bytes)
    %Documents and Settings%\%current user%\Cookies\AH0OJJGN.txt (300 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\itemb[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\ga[1].js (22344 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\translate-32[1].png (87 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\bob_bassett[1].jpg (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\promo_awards[1].png (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\redmark[1].png (398 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\en[1].php (738 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\mapplication[1].js (13067 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\jquery-1.7.1.min[1].js (58919 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{F29AF83C-DD01-11E3-81D1-0050563EC483}.dat (15783 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F29AF83D-DD01-11E3-81D1-0050563EC483}.dat (17815 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\~DF297C.tmp (3263 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\~DF3CC1.tmp (3263 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\warning.js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\background.html (206 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\urlbaricon.js (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\window_safe.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\tip_details.png (1 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\imagemgr.js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\safe_logo.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\ASCPlugin_Protect.dll (3361 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\popbox_btn_close.png (1 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\AscService.ini (76 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions.json (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\background.js (14 bytes)
    %Program Files%\IObit\Surfing Protection\Preferences (1269 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome.manifest (153 bytes)
    %Documents and Settings%\%current user%\AppData\LocalLow\IObit\Advanced SystemCare V7\Main.ini (76 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\window_risk.png (4 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\ascsurfingprotection.xul (3 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\protectpage.js (8 bytes)
    %Documents and Settings%\%current user%\Application Data\Apple Computer\Safari\Extensions\Extensions.plist (643 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\searchresultmgr.js (22 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\ascsurfingprotection.js (19 bytes)
    %Program Files%\IObit\Surfing Protection\Extensions.plist (643 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\warning.bak (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\tips.js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\popup.js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\asc.png (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Ex.js (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\popup.html (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\manifest.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\risk_logo.png (2 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\popbox.css (136 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\risk.png (1 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\icon.png (4 bytes)
    %Program Files%\IObit\Surfing Protection\SPInit.log (8003 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (4274 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\popbox_btn_ok.png (1 bytes)
    %Documents and Settings%\%current user%\Application Data\Apple Computer\Safari\Extensions\ASCBrowserProtection.safariextz (601 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions.ini (522 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\install.rdf (843 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\safe.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\wraningBg.png (24 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\ascsurfingprotection@iobit.com\chrome\content\languagemgr.js (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\active[1].php (31 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\ReinforceData.ini (2288 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\AntivirusConfig.ini (228 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x0410.ini (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is2B.tmp (345 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is34.tmp (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is28.tmp (345 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is27.tmp (465 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x040c.ini (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\~33.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\~2E.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\iobitappsToolbar.msi (36896 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\1033.MST (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x0409.ini (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\Setup.INI (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\iobitappsToolbar[1].msi (466782 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is26.tmp (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x0407.ini (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is32.tmp (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\0x040a.ini (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is2A.tmp (465 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is2F.tmp (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is2D.tmp (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\~2C.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is30.tmp (660 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is29.tmp (345 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{7D5464D7-16D0-4E12-9AF4-F94B47D9410E}\_ISMSIDEL.INI (14120 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\~31.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal (13210 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{5C75E037-0E2A-4637-BA0D-02ED1C0AAB45}.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\favicon[1].ico (1150 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\searchplugins\yandex.xml (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Local State (58 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js (57 bytes)
    %WinDir%\WindowsUpdate.log (10140 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\sh.dat (1373572 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Ignore.ini (4 bytes)
    %Documents and Settings%\%current user%\Application Data\Slick Savings\Uninstall.exe (3268 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsd9F.tmp\NSISCouponsPlugin.dll (2392 bytes)
    %Documents and Settings%\%current user%\Application Data\Slick Savings\Coupons64.dll (21216 bytes)
    %Documents and Settings%\%current user%\Application Data\Slick Savings\coupons_2.4.crx (784 bytes)
    %Documents and Settings%\%current user%\Application Data\Slick Savings\coupons_2.9.xpi (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsd9F.tmp\UserInfo.dll (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsd9E.tmp (49595 bytes)
    %Documents and Settings%\%current user%\Application Data\Slick Savings\CouponsHelper.exe (27704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsd9F.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Application Data\Slick Savings\Coupons.dll (18424 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LatestNews\imagenews_B.tmp (5 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LatestNews\LatestNews.ini (26 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\LatestNews\imagenews.tmp (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB52.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB6E.tmp (776 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB6B.tmp (5224 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Dinka.lng (27 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Vietnamese.lng (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB4E.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB74.tmp (38624 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\German.lng (31 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB5E.tmp (5952 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB70.tmp (1 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\right-click-entrance.jpg (49 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Hindi.lng (27 bytes)
    %Program Files%\IObit\IObit Uninstaller\UninstallPromote.exe (15116 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\ChineseTrad.lng (19 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Hrvatski.lng (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB43.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\sqlite3.dll (1798 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\uninstalling.jpg (99 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Hungarian.lng (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB5A.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB62.tmp (5952 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB35.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB4C.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB77.tmp (18768 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB4D.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB6C.tmp (1 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Malayalam.lng (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB5B.tmp (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB5D.tmp (7288 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB78.tmp (20504 bytes)
    %Program Files%\IObit\IObit Uninstaller\taskmgr.dll (1620 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB4F.tmp (4 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Portuguese(PT-BR).lng (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB64.tmp (2 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\more-settings-button.jpg (845 bytes)
    %Program Files%\IObit\IObit Uninstaller\UninstallRote.dbd (15 bytes)
    %Program Files%\IObit\IObit Uninstaller\vcl120.bpl (14988 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Nuer.lng (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB50.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\search-program.jpg (2 bytes)
    %Program Files%\IObit\IObit Uninstaller\IObitUninstaler.exe (56198 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB4B.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB75.tmp (2696 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Danish.lng (24 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Ukrainian.lng (24 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\more-settings.jpg (113 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\shred-file.jpg (85 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\batch-uninstall.jpg (1 bytes)
    %Program Files%\IObit\IObit Uninstaller\UninstallMenuRight32_1.dll (210 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB4A.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\main-screen.jpg (100 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB37.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB65.tmp (5952 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\uninstall.jpg (96 bytes)
    %Program Files%\IObit\IObit Uninstaller\madbasic_.bpl (673 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Polish.lng (28 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Korean.lng (21 bytes)
    %Program Files%\IObit\IObit Uninstaller\datastate.dll (66 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB42.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB48.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Serbian(Cyrillic).lng (28 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Dutch.lng (29 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\like.jpg (1 bytes)
    %Program Files%\IObit\IObit Uninstaller\UninstallExplorer32_1.dll (3825 bytes)
    %Program Files%\IObit\IObit Uninstaller\Uninstaler_SkipUac.exe (7386 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Swedish.lng (26 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Thai.lng (27 bytes)
    %Documents and Settings%\All Users\Desktop\IObit Uninstaller.lnk (881 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Arabic.lng (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB7B.tmp (23608 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB6D.tmp (5952 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB3F.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB67.tmp (826 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\file-shredder.jpg (82 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\browser-plug-ins.jpg (111 bytes)
    %Program Files%\IObit\IObit Uninstaller\help.html (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB51.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\pr.dat (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB44.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB60.tmp (661 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB47.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB55.tmp (5 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\IObit Uninstaller\Uninstall IObit Uninstaller.lnk (915 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB58.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB7A.tmp (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB3D.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\control-panel-entrance.jpg (115 bytes)
    %Program Files%\IObit\IObit Uninstaller\rtl120.bpl (7433 bytes)
    %Program Files%\IObit\IObit Uninstaller\Install_PintoStartMenu.exe (1869 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Belarusian.lng (28 bytes)
    C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\_driver.cfg (512 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\French.lng (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB57.tmp (5 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\IObit Uninstaller\Main.ini (26 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Serbian(Latin).lng (28 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Slovenian.lng (29 bytes)
    %Program Files%\IObit\IObit Uninstaller\UninstallDisplay.exe (3702 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB69.tmp (1928 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB3C.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB39.tmp (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB54.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Romanian.lng (58 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB49.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Latvian.lng (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB66.tmp (5952 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\powerful-scan.jpg (94 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Finnish.lng (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB71.tmp (392 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Greek.lng (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB61.tmp (5952 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Japanese.lng (21 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\more-settings-dropdown.jpg (15 bytes)
    %Program Files%\IObit\IObit Uninstaller\ProductStatistics.dll (4185 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\file-shred.jpg (40 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB68.tmp (6872 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB3A.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB6F.tmp (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB38.tmp (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB40.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\English.lng (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB45.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB79.tmp (16 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\restore-browser-default.jpg (97 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB3E.tmp (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB7C.tmp (9496 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Czech.lng (24 bytes)
    %Program Files%\IObit\IObit Uninstaller\mcwNWP2fEx (30622 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB73.tmp (20400 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB3B.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\ChineseSimp.lng (19 bytes)
    %Program Files%\IObit\IObit Uninstaller\maddisAsm_.bpl (51 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\IObit Uninstaller\Help.lnk (826 bytes)
    %Program Files%\IObit\IObit Uninstaller\madexcept_.bpl (2105 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB41.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB53.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\forced-uninstall.jpg (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB56.tmp (4 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Spanish.lng (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB36.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB46.tmp (6 bytes)
    %Program Files%\IObit\IObit Uninstaller\EULA.rtf (45 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB5C.tmp (6872 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Italian.lng (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB5F.tmp (6984 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Russian.lng (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB6A.tmp (5224 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\settings.jpg (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB63.tmp (3656 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB72.tmp (392 bytes)
    %Program Files%\IObit\IObit Uninstaller\vclx120.bpl (1281 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\create-restore-point.jpg (94 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\IObit Uninstaller\IObit Uninstaller.lnk (893 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Portuguese(PT-PT).lng (30 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\view-style.jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB59.tmp (5 bytes)
    %Program Files%\IObit\IObit Uninstaller\Images\vote.jpg (108 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Turkish.lng (28 bytes)
    %Program Files%\IObit\IObit Uninstaller\Language\Indonesian.lng (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ZLB76.tmp (7288 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Boottime\path.ini (97 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\ASCInit.log (6399 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-6MLU5.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-RNTOR.tmp (3 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-K8HIV.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-S7H0C.tmp (2 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-19IBT.tmp (5441 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-0BHOK.tmp (4 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-TKT96.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-1BQHB.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-7TIE3.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-8TCIU.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-TRP7C.tmp (3 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-C5M14.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-GBDE3.tmp (3 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\is-HALQP.tmp (843 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-JSA1K.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-FKE83.tmp (3 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-O426H.tmp (812 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-UJ9QP.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-LT00K.tmp (3361 bytes)
    %Program Files%\IObit\Surfing Protection\is-8JKOG.tmp (32233 bytes)
    %Program Files%\IObit\Surfing Protection\Database\is-59VLP.tmp (23811 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-NL4P9.tmp (4 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-C2VJP.tmp (545 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-VCN8B.tmp (393 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-791VF.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-MEFGC.tmp (7 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-1QFKC.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-UTFC2.tmp (136 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-KI5P7.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-ITLIN.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-96ES9.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-GOPD5.tmp (19 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-QRRD2.tmp (1281 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-4V27Q.tmp (8 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-VD3GJ.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\Database\is-7MI81.tmp (911 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-GT93V.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-NOMN1.tmp (2 bytes)
    %Program Files%\IObit\Surfing Protection\Database\is-VANPK.tmp (5873 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-OAVRF.tmp (4 bytes)
    %Program Files%\IObit\Surfing Protection\unins000.dat (11432 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-U0Q7D.tmp (24 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-9TJ1E.tmp (24 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-2FDM1.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-G67UP.tmp (2105 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-Q4EQ3.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-RKHR7.tmp (4 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-2DM4T.tmp (2 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-RLAST.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\unins000.msg (646 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-EQ8HJ.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-52Q9V.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-H3RS3.tmp (4 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-PODS0.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-NJD69.tmp (2 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-E0LPN.tmp (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-103M0.tmp\Inno_English.lng (5 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-9UR7A.tmp (14 bytes)
    %Program Files%\IObit\Surfing Protection\Database\is-JFGBS.tmp (21 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\Img\is-5RO71.tmp (3 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-US8E9.tmp (3 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-5QGIA.tmp (1425 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-5UH7B.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\is-JUQQ6.tmp (8281 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-1T7OA.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-2NMJ8.tmp (4 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-9S6Q8.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-3DUT8.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-92N8V.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-ISSVD.tmp (924 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-1MTCD.tmp (601 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-OGSNG.tmp (3361 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\is-3UL2F.tmp (153 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-3QEAS.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-43I5L.tmp (6 bytes)
    %Program Files%\IObit\Surfing Protection\is-IS7N4.tmp (3073 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-KTBFJ.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-B3SNS.tmp (206 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-103M0.tmp\_isetup\_shfoldr.dll (23 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-4EUCT.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-FLIU7.tmp (5 bytes)
    %Program Files%\IObit\Surfing Protection\is-F42BJ.tmp (7971 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-AUS9U.tmp (878 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-1MMQV.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-6HA8N.tmp (22 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-A35SO.tmp (43 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\is-I1UCE.tmp (1 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\is-1BN7V.tmp (4 bytes)
    %Program Files%\IObit\Surfing Protection\Language\is-5IQFJ.tmp (768 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\images\is-NTCF6.tmp (28 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\is-NRRLP.tmp (4545 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\ascsurfingprotection@iobit.com\chrome\content\is-2UASH.tmp (13 bytes)
    %Program Files%\IObit\Surfing Protection\BrowerProtect\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\Plugin\is-6SUH6.tmp (4 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\ASCTray.log (709 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-J7VII.tmp\SPSetup.tmp (7386 bytes)
    %WinDir%\Tasks\ASC7_PerformanceMonitor.job (264 bytes)
    C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000003.ini (512 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\Install.ini (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\install[1].php (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\install[1].php (4 bytes)
    C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000002.ini (512 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is90 (615 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is91 (1 bytes)
    %Program Files%\Common Files\Spigot\Search Settings\yandex_ff.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\~87.tmp (277532 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is8F (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is8E (734 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_is8D (595 bytes)
    %Program Files%\IObit Apps Toolbar\Res\widgets.xml (9 bytes)
    %Program Files%\Common Files\Spigot\Search Settings\yandex_ie.xml (617 bytes)
    %Program Files%\Common Files\Spigot\Search Settings\yahoo_ie.xml (584 bytes)
    %Program Files%\Common Files\Spigot\Search Settings\yahoo_ff.xml (776 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\iobitapps@mybrowserbar.com (39 bytes)
    %Program Files%\IObit\Surfing Protection\Database\base_upt_add_tmp (23886 bytes)
    %Program Files%\IObit\Surfing Protection\Database\spupdate.utp (912 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\Country.dat.dat (2 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\Update.upt (194 bytes)
    C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000001.ini (512 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\Update.upt.dat (617 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\ASCSetup.exe.dat (1396 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\getcountry[1].cgi (2 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\ASCDownloader\ASC7_UserConfig.ini (1356 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\yahoo.xml (1 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\ASCService.log (17257 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data.ReadOnly (2875 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-13-510).old (601 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-48-588).old (601 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\HomepageBlack.dbd (130 bytes)
    C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000005.ini (512 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\HomepageIgnore.dbd (633 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-48-619).new (601 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\HomepageProtect.ini (102648 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\bing.xml (2 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\google.xml (2 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\prefs.js.2014-05-16(16-57-13-338).old (5 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\prefs.js.2014-05-16(16-57-48-510).old (5 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\ProgramDeactivator\myAutoDisable.ini (4 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-13-572).new (601 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-48-244).old (601 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\prefs.js.2014-05-16(16-57-48-525).new (5 bytes)
    C:\System Volume Information\_restore{0A0B686E-9C3D-41EA-AC70-6DCF5ED4D5E7}\RP1\A0000010.ini (512 bytes)
    %Program Files%\IObit\Advanced SystemCare 7\Database\HomepageWhite.dbd (633 bytes)
    %Documents and Settings%\All Users\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\ASCService.log (91059 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\Preferences.2014-05-16(16-57-48-260).new (601 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\prefs.js.2014-05-16(16-57-13-385).new (5 bytes)
    %Documents and Settings%\%current user%\Application Data\IObit\Advanced SystemCare V7\Homepage Protection\google.xml (3 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\savingsslider.js (392 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\main.js (386 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\icon.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Slick Savings\coupons.crx (22 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\install.rdf (1 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\spigot.js (3 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\config.json (371 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome.manifest (148 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\savingsslider.xul (606 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\ie8[1].txt (644 bytes)
    %WinDir%\Tasks\User_Feed_Synchronization-{414D0F7C-B684-437B-B53E-8AB5AE32E070}.job (416 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\SuggestedSites.dat (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms (2168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\rss[1].xml (11437 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms (10780 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms (4452 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms (4452 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\Internet Explorer Suggested Sites~.feed-ms (2168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\rss[1].xml (10305 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Slick Savings" = "%Documents and Settings%\%current user%\Application Data\Slick Savings\CouponsHelper.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SearchSettings" = "%Program Files%\Common Files\Spigot\Search Settings\SearchSettings.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "(Default)" = ""

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Advanced SystemCare 7" = "%Program Files%\IObit\Advanced SystemCare 7\ASCTray.exe /Auto"
    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2025 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now