MD5: 9c356e024f58aaaf0eef94bf772580c2
SHA1: 7c1688e9fd667ee1d709b251e4c7a1d50057de2a
SHA256: 01933585bd59a73d3fc15d0bc63809451a5b8d57664cb98828991b2b01f5d886
SSDeep: 24576:CRdMs9NnAHY4gDGedk9OA/G J6bOBZJfWSNSFKFW4wefTE:Cb5jAHGGedkYA1T4KFW4wgE
Size: 1112881 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Installer. An installation package.

Payload

No specific payload has been found.

Process activity

The Installer creates the following process(es):
No processes have been created.
The Installer injects its code into the following process(es):

%original file name%.exe:3308

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:3308 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Grey_Button.png (698 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\CH_logo_new[1].png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\bootstrap_41124.html (156 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Resume_Button.png (718 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\FR.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Progress.png (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00140251.log (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\main.css (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\ie6_main.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\BG.png (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\g_-_32x32_-_s_13060x20130323113056_0[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp.CIS (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\button.css (417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\0A7D17F4_stp.EXE.part (2856 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D (388 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\checkbox.css (190 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp\osutils.vbs (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Close_Hover.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bg2[1].jpg (5184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Loader.gif (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab561B.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\button-bg.png (131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\progress-bar.css (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg2.png (978 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0060A9F9287878B15AB61E0E47645E5 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Icon_Generic.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Grey_Button_Hover.png (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\EN.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\logo[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_7C90AA5E29A4A4431A9E53E5B55F2F3D (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\sponsored.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\3F8C9735_stp\asgnd.json (6341 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC42971B7939A9CA55C44CFC893D7C1D (360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Pause_Button.png (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\3F8C9735_stp.CIS.part (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\BG[1].jpg (7704 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\browse.css (337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Close.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\ProgressBar.png (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\form.bmp.Mask (244 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FF_logo_new[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\Nininininon[1].png (41648 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D (602 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\truste[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (727 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0060A9F9287878B15AB61E0E47645E5 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Color_Button_Hover.png (818 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Cazurazihiz[1].png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Quick_Specs.png (221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\BG_FS[1].jpg (5600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bar7[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\3F8C9735_stp.CIS (141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\IE_logo_new[1].png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\csshover3.htc (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar561C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_7C90AA5E29A4A4431A9E53E5B55F2F3D (472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bg1[1].jpg (12860 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Color_Button.png (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\BG[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp.CIS.part (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FS_BG[1].png (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\logo_b[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0014009C.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D (773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\0A7D17F4_stp.EXE (164831 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\PL.locale (4 bytes)

The Installer deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar561C.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0014009C.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab561B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00140251.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\bootstrap_41124.html (0 bytes)

Registry activity

The process %original file name%.exe:3308 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASMANCS]
"MaxFileSize" = "1048576"
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Docesipete
Product Name: Fas
Product Version: 1.5
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 4.5.4.0
File Description: Fas Setup
Comments: This installation was built with Inno Setup.
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 16
8197620fe52fe518bbad4acca7aae4fc
1125643ad05f953d40babcd51e2dbc6a
5caba877244aaa52974afce7b032024a
32ef9d8778ba2d3a9a0c2dd03a62ac41
b485a8f370e9818645ba2d34ff89d53c
3b47164fb155d81397d265741a6713ea
476531acc1164a9968857c3dfc6a9715
3a8367511dd39951310866315aa1fdb7
a2089302b2d139131bd658058708d200
0716e334db15fd23746de448da556afb
20da70c48f8a6afc94bae07beed35c20
29d8b6c791390ff719cc42d4e36756aa
87d8b2aa73e25fbc2311bac5e7d17c8f
8c613a0e486c16e1fe2deb51ca6f510a
ab50a218591c96947ba093a678846f12
34b96f30ba9a806cc862fccc0c1b2604

URLs

URL	IP
hxxp://rp.bororeb.com/?v=2.0&pcrc=1858890704	54.229.91.211
hxxp://db4sw1py28nkw.cloudfront.net/pl1-sst-x.json
hxxp://awseb-e-3-awsebloa-1e879wom63989-1129466525.eu-central-1.elb.am/?f=json
hxxp://info.bororeb.com/?v=1.03&c=8b3a4081&at=740357246&cntr=0	176.34.130.130
hxxp://rp.bororeb.com/?v=2.0&pcrc=775274733	54.229.91.211
hxxp://os.bororeb.com/DobreProgramy.pl_High/?v=6.0&c=852899565&t=1312873	52.19.5.95
hxxp://gallery.dpcdn.pl/imgc/ToolIcon/13060/g_-_32x32_-_s_13060x20130323113056_0.png	194.0.171.165
hxxp://download.videolan.org/pub/videolan/vlc/2.2.2/win32/vlc-2.2.2-win32.exe	88.191.250.2
hxxp://img.bororeb.com/img/Malaromoro/bg2.jpg	146.185.27.53
hxxp://img.bororeb.com/img/Malaromoro/bg1.jpg	146.185.27.53
hxxp://img.bororeb.com/img/Tuburera/logo.png	146.185.27.53
hxxp://cdneu.dobreprogramyplcdn.com/ofr/Solululadul/osutils.cis	146.185.27.45
hxxp://cdneu.dobreprogramyplcdn.com/ofr/Solululadul/asgnd.cis	146.185.27.45
hxxp://img.bororeb.com/img/Tuburera/truste.png	146.185.27.53
hxxp://img.bororeb.com/img/Tuburera/bar7.png	146.185.27.53
hxxp://img.bororeb.com/img/Tuburera/logo_b.png	146.185.27.53
hxxp://img.bororeb.com/img/Rewudaw/BG.jpg	146.185.27.53
hxxp://img.bororeb.com/img/Rewudaw/BG_FS.jpg	146.185.27.53
hxxp://cdnus.dobreprogramyplcdn.com/ofr/Solululadul/osutils.cis	199.58.87.151
hxxp://cdnus.dobreprogramyplcdn.com/ofr/Solululadul/asgnd.cis	199.58.87.151
hxxp://img.bororeb.com/img/IE_logo_new.png	146.185.27.53
hxxp://img.bororeb.com/img/FF_logo_new.png	146.185.27.53
hxxp://img.bororeb.com/img/Cazurazihiz/Cazurazihiz.png	146.185.27.53
hxxp://img.bororeb.com/img/Nininininon/Nininininon.png	146.185.27.53
hxxp://img.bororeb.com/img/Fividof/FS_BG.png	146.185.27.53
hxxp://img.bororeb.com/img/CH_logo_new.png	146.185.27.53
hxxp://img.bororeb.com/img/Fividof/BG.png	146.185.27.53
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI=	178.255.83.1
hxxp://crl.usertrust.com/AddTrustExternalCARoot.crl	178.255.83.2
hxxp://rp.bororeb.com/?v=2.0&pcrc=1988936779	54.229.91.211
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc=	178.255.83.1
hxxp://crl.comodoca.com.cdn.cloudflare.net/COMODORSADomainValidationSecureServerCA.crl	104.16.89.188
hxxp://crl.comodoca.com.cdn.cloudflare.net/COMODORSACertificationAuthority.crl	104.16.89.188
hxxp://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy+emBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQCdZZ9r88cafMgPHXnOMOGm	178.255.83.1
hxxp://gpla1.wac.v2cdn.net/CRL/Omniroot2025.crl
hxxp://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl	104.16.89.188
hxxp://sui-generator.sensic.net/?f=json	35.156.82.106
hxxp://config.sensic.net/pl1-sst-x.json	52.222.157.51
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy+emBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQCdZZ9r88cafMgPHXnOMOGm	178.255.83.1
hxxp://cdp1.public-trust.com/CRL/Omniroot2025.crl	93.184.220.20
hxxp://crl.comodoca.com/COMODORSACertificationAuthority.crl	104.16.89.188
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc=	178.255.83.1
time.windows.com	13.80.12.54
dns.msftncsi.com	131.107.255.255
pl1-sst.sensic.net	52.29.220.191

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET MALWARE DealPly Adware CnC Beacon 4

Traffic

GET /img/Malaromoro/bg2.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/jpeg

Content-Length: 59210

Connection: keep-alive

x-amz-id-2: S864L5S4TUGtpH1FbaiE 24IhQaIj 9LHPuJ6yzgkWL6AUgp3aFHgczTwVrV0qv8

x-amz-request-id: 6DC2E3436D265BB1

x-amz-version-id: JMXnkH_Q4w85o.RRxkVvr1HHBSYxTWbA

x-amz-meta-cb-modifiedtime: Sun, 16 Mar 2014 10:17:54 GMT

Last-Modified: Sun, 16 Mar 2014 10:45:33 GMT

ETag: "3ca90bdb0184dba078b0e604eb239df0"

Accept-Ranges: bytes
......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-
c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:345E81DDDAA9E3
11B383BEF54B638275" xmpMM:DocumentID="xmp.did:118EE61EAA0211E3A8EABD13
5B592C02" xmpMM:InstanceID="xmp.iid:118EE61DAA0211E3A8EABD135B592C02" 
xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:086B2D40FAA9E311A847ACF83C7EB2CA" stRef:
documentID="xmp.did:345E81DDDAA9E311B383BEF54B638275"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.......................0..............................................
...........................................!.1.A".Qa2..q...B#3..Rb...C
$45..r..cs%....S.DT....U..E&......................!1.A.Qa.q.."2......B
..Rb.#..r.3...cs.$............?...@L...-..I....E.i..D2P.*..b.,...]H.Z7
.|1.....v.4....M.....T.<.Q......z.....u9...\u.......M....r'.gW.hM.B
...I.....I...0@.....I..:.....:.s.......:...L..._..%nh6._........b)
<<< skipped >>>

GET /img/Tuburera/logo.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/png

Content-Length: 8970

Connection: keep-alive

x-amz-id-2: Zdob5wcCDC6sUoDlSOx22Lu8ztgK heNu8iAi/1BO8dRjyzG3YFEfRxch6E8FtCI

x-amz-request-id: E1965D61B461F838

x-amz-version-id: CbercSsLGa07nAy9AshJRzsQW0lz1UK5

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:07:02 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:49 GMT

ETag: "b084c85324dcb4d88f500ebaf8ab37ce"

Accept-Ranges: bytes
.PNG........IHDR.......5.....Ap^.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..".IDATx..]......^.. l.w.....  XP....%..X.1.D.$DM.""..  ....J.E.u.
]v....{....3.... .j....D........s.{.....D %H..B..zB...n...K.^,.Z.*..[[
.K.[.._.GD|.....x/.V.g..L..Y.....44 .<U.=N..yY..B.R.....[_ ...@c...
..C..._...f$...%{....1y.b.U...Oxy...YG..a..E....PRZC..?..|......e.Q.E.
.{./~..<.X...i.( 9..[....Dx.-N|<ZhO...F.......P.&V.?.U.l..1qLW..
z.?Ld........m...B.0..8.../~....B....[..../......M..4...Dnh.....&11...
....|..6DD.`......a............J..}.";E.i..._......r.......Gr.p....i{s
p2.....(......8.g."...:.Db..Ix....=..^...r...}.'4.......P.0.....~../..
L......EUX......1..mX.l7..*......Lf.d.........^..&....Z..W.hl.......e.
R.B..z..=~.......}E..å...W.........l.]Lr...............kD.....:8.N\&
lt;.#..m.......%CZ-x...../g.............s6`..L....!..L.8....y......2..
^||<..... ..G...........#._e.........[...#..x..Fl.QL......W!1!..=9.
...J_..z...~..._~yN.q.3..,........EBB.4.].aG[................8.......E
|....Bw.../~..@.H...9..... m.......>1...\F....C..xy...-(..W....[...
..._......&Q.p<...=....8...p...........X?6*...I.....P]S...3z..N....
.....l..f.[/..(.Z-t..._.m..V.u..._~m . t.M...}...g".:.5...pi.19......j
.......'PY]'..\<.3..G...^a...0..Y-...J.U..KI...s.v ...!x.....>.3
...U.6[...........0..}...Y...../.)...v....B. t...Q.T.......%Bs...By.]x
..jQ..O..;G....e.<z..S..a.......~.......Hi...........k.O.....r....h
..w...!=4.s8..>..N.......`.........m?.C\L0^x.S........I..9.>.%..
...G..F3e..u.c..s.RG/.z..U..W....A....FS.#......y0V.-i..j.....8.A.
<<< skipped >>>

GET /img/Tuburera/truste.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/png

Content-Length: 11597

Connection: keep-alive

x-amz-id-2: rcSLP3REe5XT9x654FFYdgUcC6bXnpyaNMHCktuPFPrPShGYzm7E hC2DjLWG9Gl

x-amz-request-id: 738C9AA11BE74E77

x-amz-version-id: TsQX4cb1jyoGu5DXk3rpuvCf_fAlhQQa

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:07:27 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:49 GMT

ETag: "9d7db4bf8aea860f288e41d97c3687a1"

Accept-Ranges: bytes
.PNG........IHDR...A...U.............tEXtSoftware.Adobe ImageReadyq.e&
lt;..,.IDATx..|..].u....ez/*..D....f....)6.KlB......%....;.>..8..&l
t;.Nl.......l.hB.Q..F..4.....sOy..w.......;..w............(... ...;yx&
gt;l..`.M....m..i..[..v....V.R1.y...r9...p.<....ab...H$......D#(...
.#...X.j.......?pp..O<..H4ZX}...,?...s'..a..}..-9..s7.X.Bn.a..gm~..
.y.`[[...W\.`CSc..{...bU.J....B.U..|!.U4....>.n....`..3......!.....
.........G|....._........c.....|.....m...?......q..&>..o~......g?..
......o....'?...[..G.6uv........;.../z..]....<'.U............,K}...
...p@ss3.../.P(.........PW..n..333....088(..v.Z|.c....c.....?._}.....k
.L$.w..u..C...0~..q ......L&....n...m..7.!....;.....;#...7}.&\s.5....O
~..z\....gPu.8...~(..m..........%.\...0s...8N.?..u.V?.H..]...7.w...r&.
....n..|.z.0....].#.=....754......s.[........w.u...I...,..;.|.........
..y..3......f...?.>...0..g.y..[.lYy2^ ..7M....Z.Bx..#.w...b.....a1.
....l....pTzS...*..(...:.jjj....w..e..w......k..... .........1:..>.
."TU....6b....}.........../.....~..7..e.d.A...MZD.r&..._5..>..8...z
.K.-..........oDSK3.mU84.A.6L.>.DV.....Yc~...Dkk........<.(...N.
... ..........ax..%....BN.9k.F.XBgg'....q...s..5k.l=a#....A<.,...kF
.....,.yd|.X.@X..l.7.p....ny.[.U........O....k"^....v|....e.g7HL......
......u0.&...S....0..P5....{/<.0..I.u.'....a0w..~..}.=.8..<.....
.~....p..TJ~...!....<.~...v.Z&r..O?s.H...X.l......M.....r....u.]'..
......?;9.z.Y#..P.\\~..x..g.._?........[W.u.Y/1|L..'."..>/V..s.='.f
..%..z.).?.....7......g...r.....g<..-....-Y.....%....E~2.......
<<< skipped >>>

GET /img/Tuburera/bar7.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/png

Content-Length: 10604

Connection: keep-alive

x-amz-id-2: wbFwazL iC0qAk7necqLr49o6FK/ c2nT1qexmXwcKzqzOrJWUJ MHezkDmMfrJr

x-amz-request-id: 90667C4E88F69EBC

x-amz-version-id: N2ls4ElWemvYIzegu69FA58gpcXntv9c

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:06:52 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:45 GMT

ETag: "4fa9087a65898badf6d8955c16d73809"

Accept-Ranges: bytes
.PNG........IHDR...'...(......{< ....tEXtSoftware.Adobe ImageReadyq
.e<..).IDATx..}.p....7..w...."H..xS.)J2.H.....Z. {.x..!Wy....T%....
T6..U...........,i..:m..u..H..).........>f&..=3.yx....R.Y..........
...Gy.....PRlX.k P..W..._.}..W.t=h.,..T*Yo.......r.m[.r..U.9..8....o:.
,..../p.......,Uu..Tl=...[Z....h.TT.R...R..g..%.........^o*..O.Q...U.'
....o.P.......tP..e.....B......L.m.......w.)..FQ.,..b......,qLq...9...
.vt...._...Wi.Y._.}..W.t=?.k.vc....bY.4M.X.4......<P.y.wK."..... ..
.....`...B..B..?^x.%.w.}...K.>..NU......>....:..{...k5. ...s*n.r
..~`9.UoT`...4..n....9...FL.OE.[.O........_...n.O....;.....D.A.......\
....R....,...chp.c.....(.....466bI{ ../ESC.j1..]...4...`T.....f.....$n
....#S(ZA....n~."..I.......d9....%.Y....H......s..\...V...uJ...MU.g...
.894)....[...\...iy..f...]..7...w..y.<.we9..s.b9..........?w ....~.
...t.....9s...i.$T......q...<uB.?.4.f...F.w\...5k....G$E..3..\.....
........PB......]w..;....A...MON.....?}./.."r.ql\..[..v....D../v"...T.
..U.|..........6...5.[y.n3......m]....H\.. XL..T.8.}....k.N.W..J..7.9.
......b...Q.\...A..8..S.T......:Q..\'?...f.......8t`?..f.....W.v.:t45.
.*Y.)IX......f........w....n.~...c..u.q....y.GC.Q.~....P.f........X..d
....8.O...~\.t.`NK..&...2m.(.T....$f.\b....c...R.1...T....C(.I...d.N..
3.....ww.EhjM...7.....$.....Y....s....<.W...}...ip..E))X.c6..d...a.
f...)...P......\*............o}...vC/.QH.appPR8..*.$.........k.....x?&
gt;.?...z..<..>....nk.,G...}>...W.....]Q...;SU...R..S.:/W4z..
7.W.....p......dO..^........2....-..?s....\0b....~p.c...eY.....G..
<<< skipped >>>

GET /img/Rewudaw/BG.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/jpeg

Content-Length: 102878

Connection: keep-alive

x-amz-id-2: tXUK9vSETJVjcpDr4vxSGPhkfuSPqLofpqhb9uRVUq/PD4o0Y7QFXbcttDaSBA39t2RbnCRhaKw=

x-amz-request-id: BFB3B107C082E179

x-amz-version-id: sCJ._v0SQy.IKyc6FrWiaRIAYL2XAV4H

x-amz-meta-cb-modifiedtime: Thu, 31 Dec 2015 19:47:01 GMT

Last-Modified: Thu, 31 Dec 2015 19:47:27 GMT

ETag: "d4337f9e3cdbb54bd455a9b749954a87"

Accept-Ranges: bytes
......JFIF.....`.`.....fExif..MM.*.................>...........F.(.
..........1.........N.......`.......`....paint.net 4.0.5....C.........
...........................................................C..........
...............................................................0.."...
.........................................................}........!1A.
.Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijs
tuvwxyz...............................................................
...............................................................w......
.!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcd
efghijstuvwxyz........................................................
............................?..5.u.... .z'.|.........z...G$....1..[K..
=.........^..g.....-.O..}.....6:....r[!gw.....{.[..[.....c\$Q......:M.
.6.^....9............6x.x...w...J.q..x.`..S.UO..._.q._....J..n..JJ.m.I
%.r.w...s. .NTd.\..T............Zm....|v...9...P.4.P.d:m......B.D.[.|3
...o..y.s=..R.].._L.x.C....:R\H.....Zy..2.<....O...4...u85.kO.[./..
.E../..u... ....h...Ju..8O....;v.._....R...4m.2.w.3.G...ZT.Zo.SI...Ke.
E.3.8...I7.........}.O....4x-..<j.$..Y..._....>.......C.Dg...G..
.......(...........Xh.^..h....M.}.U.5..M..O:...=Jy.,......*.'.Ic...<
;....#k.,.r..~.S.......D..e.Y..Y..L...HO..TO..".... ./j.p...5...Z.O.J.
..}.\9Z...m..c..%R.....2..........'.g...).....4.^O....].....}.j.....X.
C.o.n.d...s..qx...Y...f&..N..n|Is.C.K...~x...d.....*l.|~...~...>".7
...........mk..|<.6....E.^.~ ....o$..H.67.[..]....(..F....t...c
<<< skipped >>>

GET /img/FF_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 6157

Connection: keep-alive

x-amz-id-2: lWGCR7sUJtZ SNEO61HWdZuDs0L9Jt3NLu2M9NaEcbyE1oPWI6bLEkzl/7Lygbas

x-amz-request-id: 5BA1F1A50FAB4932

x-amz-version-id: wLXM_trCFKsgiAKj58s6fy6EyOPJSUfV

x-amz-meta-cb-modifiedtime: Thu, 12 Mar 2015 10:46:00 GMT

Last-Modified: Thu, 12 Mar 2015 10:46:07 GMT

ETag: "177a897550166829af6f7d037d86a2d6"

Accept-Ranges: bytes
.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:E6
EBD962C8A311E48FF2C56440BD2A7D" xmpMM:InstanceID="xmp.iid:E6EBD961C8A3
11E48FF2C56440BD2A7D" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.did:A5370A64F8C7E411A9
F2DF1F27361A01" stRef:documentID="xmp.did:A5370A64F8C7E411A9F2DF1F2736
1A01"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>...U....IDATx..Zil\.y=o.}...CR.6...}..6...v
....l(..h."......E...Q4M..1P.-..N....$.lk."k.,..HQ.Dr8..g.~{...,...&..
R.......r....> B....../..(.TU...m7..q.....S...W...H_...............
...)..,T.........h....H....!...]1#...........l'lx0....g.pZ..Z..k!lW...
.'9..T..T.................g.....u=.!OU.S..]FWb$.......r....VSQ7..u....
....C9.o.....;.......y..y.8.x..v@a.......=..9|......C.do2.M%.}.Y..T..l
..../.M..e....~.....s......W<G...3l9.1...g......D...F&...}..{'{...S
F:.C<l .V...Bw6.......DmT..t!...x:....{...c..O.y.Q.|..l.....f.\.&._
.i..v`9...CS......H....9..............Gx>.5........\..MO...,...
<<< skipped >>>

GET /img/Cazurazihiz/Cazurazihiz.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 5983

Connection: keep-alive

x-amz-id-2: ccv9kduy9eFKJMIUUKSYh5eewT796F2bYHLmLUOvlAPC7yrA17LdAytDQYKDm d2a1YdpA3M6w4=

x-amz-request-id: DC47B400D218DC6B

x-amz-version-id: wyC6mtJU.8C8djRcSmCE4rVxqum5xvWX

x-amz-meta-cb-modifiedtime: Thu, 31 Dec 2015 17:53:51 GMT

Last-Modified: Thu, 31 Dec 2015 17:54:18 GMT

ETag: "a22c3d2918d1834d285dae064d3cee86"

Accept-Ranges: bytes
.PNG........IHDR.......'......i:.....sRGB.........gAMA......a.....pHYs
..........o.d....tEXtAuthor.Nir SaharZb].... tEXtCreationTime.2015:06:
24 17:02:12a .A....tEXtSoftware.paint.net 4.0.6..c.....IDATx^.[y\Tu.F.
...a.a`.....4mQ.7..Y...Yo.........[...........H.............;....sirf.
.L.T?.x..{.s.\.<.9.9.........j..-....lA.....q.4.'.EN..........Z?-..
.h[..O....F._.>.......)~J$i.X..IP!Q..d./R...9.l..1.....}.. .\C..q..
0..A..PlT."..5...E.-...Z...O......B6!.>.Cs'Z.P.....u.X...9N.....8. 
.fW).:t@Ix.}..u.....@.).~1.[.=.@b.....>r.PLD..I..mA ;....t........l
..T....G...'...G$..iE.9........-.)....To?\Y.C.`r--...lp%a...T.f..be.. 
.p.w.b.8...hk.;.H...p...8jk.#...u..j.s'. r.9.,[&.=..9...)v........<
....t..........{..;..D.{.v......8. ....{:.b...Q..].q.I...".rp.v....J.9
:...#r.mq..=K..2Y..L..w..~"k1..........U..t.............q..A...Q.....0
.....!Jk..>Dd.Id; ".eC)...1R.lg'....U....w....b_..... 0$...V...QH..
`.L..bVIJ..r').fS.>b...R.|.?CjwXd..r9.rO.e._`C8s..>..S.....|.A=.
..{......#Gb..U8}.4.Z.\...C......1L.>....>S..8.c...]..7...K..[o.
.y.....{..h.....@.......q..I.........^M.....PRR./................k.k*.
..Z?d...4...ze8..'.VdC........Y.....@E.j..s.?q*.CC..;.....e.. ..4..>
;.".....:u.VgWJ...$.f.rC.....<.).^G{,..B...o.%..........#::...-Z..s
.b..ax..7.../ **..7?W(]..v....&&....a..-..e......}||p....Y..5l....>
..p..........4...g....C....{....a..a.....?...{..?..rrr......7...VXX..V
......c..Z...0.....H ...8...M)........T.....vm...2..~.. .c.{}.;..C....
.....z..u.....=?G........%b.{b..............JFd....0....7.9?"...&g
<<< skipped >>>

GET /img/Fividof/FS_BG.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 20910

Connection: keep-alive

x-amz-id-2: HQ1LxsBTvqZqYDrh6M/zoVyC0z7rDH98mZskcq4oav6EBVIpuw SWGw/0PJ/OdVAsAdJYzLF8W0=

x-amz-request-id: 60CEAC10DEF0656B

Last-Modified: Thu, 25 Aug 2016 16:15:53 GMT

ETag: "20838f981ab877adebe8cc27d8fd8e8a"

x-amz-version-id: NGHte6ooz0o7QShucGRMfn4HeyGT11cm

Accept-Ranges: bytes
.PNG........IHDR..............u......tEXtSoftware.Adobe ImageReadyq.e&
lt;..QPIDATx....p\.u.......9..s..pr.&..fd..%.A............^...z..d....
gK.% Z..H..C.sN ..r...}.sn7.. ..`...Pw.h4...=..~... .. .. .. .. .. .. 
.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .
. .. .. .. .. .. .. .. .. .. .. ....&.`aq..v-i..RV...<gV..4...V..kI
d....-.....A...n...}W ..[...t ..^....."..y.V...P[...Xm.j.....1.L.....&
lt;"gR..A.X..=..M.l..@..l....V)..Q.*3)..j(W?...=...6...j3....~.4...l:.
...\._.. ......C..)=-.;..J]. .Cm....W...>.V........6{Ndmj3...t....:
z.. ....S...K./... .. ....x....d.f......kR.T.(.t..N!.r.f.u(G..Z.^.)'..
.....yC5...E/.9.]....x8....7...5.t..._M.;(.. .|..m....vS@.hYVG.:m...O.
....). T.U\r.p.\..N...dB"....gq........<....v^m/.mg....m.I.X..A....
.N.;..4d.z.:5..T.J|26u...I`i..B...v....bF*.........HGS..w:1....U]...R.
Km.... ...v..~.d....f*..].Mk.u.(.........6....}.....dV.7.......w.#..\K
|..j.P.Q.......]..M.?.A....Y.G..H."kS..P.'...b...?.....;JM&miV..4v.ZQ.
.TBKn..;."..w.C.Jx.....G{1.5..6.|-.M_TO... Nf.._..ZZ.i.. ......A..D...
.^u7mT..e;.w.:.b.4o........M......f2l...7M./.m..8.\.a... ...4.d.....3j
.G...u..K./.... ...D.....h.d3.Y=KM&...T.D.Hm.0.c....`),L.b.._.Y...V...
6...gV._.@&......7K.`.Z......Sh....`0.F..[.....3j.K.j.qQ9...L...J.W...
. ..}$.....,...PIb....%.E..j.j...,.q...='.N..............7.y........2v
TYd.X..D..;[q..yt.u#.I.Ix.|d...gCv5XL.8...J<.W.._......*.F.~.......
.C...^..?Y...D6nW....Dk.6.O....RbS.../.01..n..V.Hv..(7.%.(.)....C..Z8.
....I..{/8.af...d..`..'/...6t.w.....zYJ......_..f..`.Y.k6..v.W.S..
<<< skipped >>>

GET /img/CH_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 4849

Connection: keep-alive

x-amz-id-2: hRwhydxNImwzzPR/2b9GjK6XfgeNkPblqSsAJ8faKBdoQeqQFYeB30OX3JU1oxYp

x-amz-request-id: 40553C13EE53B317

x-amz-version-id: omxwqkFcs1tUW940Ss4VTxiINXau15QT

x-amz-meta-cb-modifiedtime: Wed, 18 Mar 2015 10:35:00 GMT

Last-Modified: Wed, 18 Mar 2015 10:35:12 GMT

ETag: "ba264606ca1d89ed519c9b8b3515f163"

Accept-Ranges: bytes
.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:B8B544DFCD4F11E4BC7FA5DA
DF6159A3" xmpMM:DocumentID="xmp.did:B8B544E0CD4F11E4BC7FA5DADF6159A3"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B8B544DDCD4F11E4BC
7FA5DADF6159A3" stRef:documentID="xmp.did:B8B544DECD4F11E4BC7FA5DADF61
59A3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..<....eIDATx..Zyl..y..9...\rEQ.%J.M...I
.U...4E*..].A[.h...:hQ.)P .Z.@.(..H]4..*.R7Q.D.m].bK.%X.uQ$%...s.cvf..
.f.,W.%..x....y...}......!.Y;.c.YQ.=S.....gOv...6f.~.=9W.g.........:b4
..d..8.m....o=...;]`......I..'.......3..u1:...\......No..p..\...... .h
-..QF X@C.....*..#..........?..|.4>.........4...Ohl.^....Q.........
...?..B2.^...!8.)4h..Me...$/8...}}.8.v..{9.cc....T..).p..{U.......8.'.
...o...Z.....fw!..OBD...PiIE..\uFT. m....z..w.`...p...p....d27h.C.)N..
.*.<9.]o...-(.. .Y.T2.P8.x...d!..!...S......(.........5D..t...S.,].
...\;......H_8V..c...t9I......d.6.E..*.'..]O..1.!-!c.\7........N:.
<<< skipped >>>

GET /img/Fividof/BG.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 27707

Connection: keep-alive

x-amz-id-2: g605q2NKKixxbJLPZIN1bsjOUGJ0l/wdIrUW5dHtTAKje0wL61ynadgsK/8az9LRa98L96O0K3A=

x-amz-request-id: 783049A002A7BE3A

Last-Modified: Mon, 08 Aug 2016 08:08:18 GMT

ETag: "024f03602a6f7fe69592f9472cb01d4f"

x-amz-meta-cb-modifiedtime: Sun, 07 Aug 2016 14:10:06 GMT

x-amz-version-id: X3Cs5_ZFW8itsyxo6oqulRxPSOcm3fMR

Accept-Ranges: bytes
.PNG........IHDR...0.........6..I....tEXtSoftware.Adobe ImageReadyq.e&
lt;..k.IDATx....t..u.x.Wt7.... ..../.I..IY.#[.$/...I~.3.bYV...s&/.3o9y
......Ifb.yq.o.%[.%."...wp.Ap.Bb_..Fw.....F........'.......j.~u.w.%...
..@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ ...
..@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ ...
..@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ ..f.4Y....
.n.B..[w.>..H..B".H#.\'.j.v....../............a..].Rw..4= .w.:.."..
2.Q...P.;O=.W...$......W.[.....>\.ey...>........;.w...#.......k.
.....|$...k^.,..t.J5..@..jE<........k.T.......6x]...R.3.a......5.c.
.. .P..u......e...aM..F"'.;.m...g.....:.G.j-..".I.S.....M...r..B .x^T.
O./....Z....k.4..9..C .(\..3.......fE.....5->_.]...<.XL..CNM=R&g
t;< .1...H.G.5...fzma..p..S.\......<......=E{N.......e...]#....K
j{v4C9C..g.w.......5~A..[I...e.u.w^...fp.5..1......N...E`L...I^.xN}..&
gt;1..-....F.........[.iN*.i....E.k....5.....A.^P..\......w....d...th]
M]...8...HC%9h...v.I....?\...Y..O..b.,1....i.....i....z6...........o..
...c.I..4....e...A.}|.]......"\x..w o ..9..u..5.:E_..|.L9.4.y@P.4....!
.Ns.o..........z.......Z....V...$.W..y.5..........e..K.pn.y.....p.o...
.......|.t..-..9.;.....u...5...6..4\.X....g.......8/...........q{".k;^
.tn.>.M.. ).v.o.<..I...=.k..M.5.L.K.6.A[.q.c;b.k.X....-A.8..9W4 
..I.......%].'....D.h.....x...U.. ..x......8f.....E..t..5:...j..B.....
.y... ]....T.;.....n.6x,......V.0..>{.f..m.6..............0..?GC..d
C.l....?.;......x7.......G8.0....qs.....c..>.o...{.M..x.8....1.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com

HTTP/1.1 200 OK

Date: Tue, 13 Dec 2016 00:25:58 GMT

Server: Apache

Last-Modified: Sun, 11 Dec 2016 22:45:11 GMT

Expires: Thu, 15 Dec 2016 22:45:11 GMT

ETag: 8801994E2F8B53ECAB5430FEA9ECEB0829DD129C

Cache-Control: max-age=252552,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp33

Content-Length: 727

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0........~.=...<....8...22...2016
1211224511Z0s0q0I0... ........^..hl\.....W....r.=.....~.=...<....8.
..22... .n..u6l..n..|......20161211224511Z....20161215224511Z0...*.H..
...........;.....vfl6!..u.7...k.>W.7......}cNV....._..o.*...v..f..*
....P/MJ{V.2..._l_ab\...E.p.s...h...r...nZ...zH..z"..b..)....."}...M..
d..t...@d.#5..........]..D..1....\..aJ."o...rY..2..9.p.o...*...../...e
6Q.b7fx..n..{.~........?......a..G..N..M.t........J......U.>/...H.[
.}.S@.=S.....e.&o...@.....69EW@.{../..}F"6..}.Q. P..).5......,.Tc"d..l
..#.HC..#.:).O.vO.e ....$K.....xk. w.q.o..%r..9/....f4..T.).!....`.(..
E......S..h:q.... .a4B""..,,...S......o.UvA.74.k.i.Q......wH..........
B..........}M..q"..U.$j...8.0..`.(.o`....

GET /ofr/Solululadul/osutils.cis HTTP/1.1

Range: bytes=0-4012

Accept: */*

Host: cdnus.dobreprogramyplcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.0.10

Date: Tue, 13 Dec 2016 00:25:43 GMT

Content-Type: application/octet-stream

Content-Length: 4013

Connection: keep-alive

x-amz-id-2: mIZpgm2rh5XAf9NquHia2m5qHfXQQUYKJLyWHhp5idRP7ymw7evUkyJHYln/zMC1KLl3S12Av/I=

x-amz-request-id: C9F1960A94F91A3C

Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT

ETag: "569022425db355c9d82beba6efc44f22"

x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT

x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l

Content-Range: bytes 0-4012/4013
CIS................7...............P.......Vv/#..F D(.h]....TK..TK...#
a .Kv.>y......U.:.i.......<.*._fq.~k...*......w.......@...GR..J.
.....(......;.....c?..P....Rn..s..Sq..:.jF}..2.Io.^x.y.$.. ..Wc./..2..
.U....|.........a.'..z_S~..^v.6..L...Pj.5yMz`P.e.M.S........%K....3...
`y-'....jB....cIL<...q.HS..Eh....&.X?tK>..n..?.y[d]...R......WD.
\...&?..I......H..U.-gGq.../.6\..M`.j-5u...B.R..T.P_G.zLK.O3.c.O.}AD.d
h.Q.."a..CCB..5K:(..2..'1./.....5......e).....v.G...N...?dBrh......5.3
.y...Y0....J&.yQ..mpN[...7./....|.p.o...M>UB....., .z.....aT^9d..c.
..F*|.c(...;M"5...w-..H..|<...G.#.R.0.....#.5...~nZ...G..`...... ..
..lB..6..E%....=.....P....WY.!O)..VD.d.C..|.4..[a..>\..;...r6.../.G
.<.P...D..J.*.;..}.a.8.b.....Z....Fad..j...O..1....%k.$.....v.6VL.u
.......55....>.T..".QbOm3.....>.............V..}.".!..c%..K..cNh
Y...F.&...>.....].jI.07$Y..i8..S......HH ...0Z..y..7...y.R.,..h.k.[
g}..{......0.\j..z.V.>.%.i1`7.t..7...u.O..T,.@LT...(k..A;$..~.....e
.....k.w./.%.8.6.xn....P ";.i7.(@M..3.).P.&...\.g...H".su,........:m..
..6."../.8....c4.._.hBphnGq'....$...Z....,..]..R..yv)C.@...{..F...S.8.
.CY.s`...*..o..6m.......|q5..._.'C.....2....g..?511.8C.2..........qj.y
..K.;8.....1^....}%F..... .5v?.CE....~d.%....&;_Q..9%.F.$ G.d......[.G
.LU......6f.ne..........p.....s.......~...z..ap/.(...../.....QY..!...J
;.................,Gv....r..p...Y.k..2..X..{....Q\........6..^....[.4.
.W...?@...*......?;v..hn`..~.7Q..D.F...'o.3...6...._...4. .B..r .../..
......c...Q....Sx..i.k......6b. iHoR.K..p...........n..*.......=..
<<< skipped >>>

POST /DobreProgramy.pl_High/?v=6.0&c=852899565&t=1312873 HTTP/1.1

Accept: */*

Host: os.bororeb.com

User-Agent: ICAS

Content-Length: 1392

Cache-Control: no-cache

.I..~...$$......xh....).}........@89?`...(.r..Uh...v.:..

.......y..^...8.L.3m....s....H..=....c...F. s....Dx.Akkd...o.|..K..z.pW.?...... m.Y..Y.f...a
.&j}.R............S2.`....6.].......zn9...9..G...k.4.....^.....-....7xw..._.Q.,......'.j.}.T..qf.h1..=.L.}.~c.4...<.....i..4../..G
...c...~.U.s..9...[.N..T1.Z.%. .....j.I..."....h:b.9.......v...Y.2.v.......D......KQ(a.wm.. h.'..-...t7.El:....\U.e.w..O...t.pmX.K....D..H..J4.2..E......
..z_Df....C<.Sv.!X..C-5.yWh8.<..................F9y{.nf0
..<..5....`[..)....3C=.!..h...{.....>`...D.t0,f.e.......60Y....<.*.y.:....1.......(D..{.E..^Sm...$..{M\...r..t5.P._..:
.........Tq..|..'......c....W.....q..*8.D.

j`.2..0l.>....k.=1..ri
....?.....Qd.MSR. '..K4.../..w....k.E.......X.u..
...t?t..ev.....0...3..w...}-./.M...-.WU).......9..;..!...z.....k..F.>.P......KE^Y..- =..y.".\....?4WV.M..

1f...,..7.....g.y0.......D.....I.TdZ8b..hE....d....W..ca......Y.a....D.yk>.O.........YT.:.......)?....$f)..T.`.._..Y.7I.<4gY3....oa..j....;...ep..e......-c.{G...p.-x.82.J...CPO..j....1..F>..V....t.`.*Q..{..4...b.........B.s.J.........e$...c.?...CX.... ..}..d62.
.6'.v..Y&..)..k.......Y......"......Q.Cm..2...`.I..*..=u..6....[.X..5p..J<..r..i.%..
.8.&....m^.R..BM....\*.....h..e.
..o..GJ..."......*.".U.e....n.Nta.......=..?..,W.>....f.xac....W.
.......eh.V.s.V.v.Z=....a#......I%.^J-..
HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/plain

Date: Tue, 13 Dec 2016 00:25:38 GMT

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Server: nginx

X-ICSCT-CC: UA

X-ICSCT-GICSET: currentSet20160925CSAIRS

X-ICSCT-IP: 194.242.96.218

X-ICSCT-SERVER-NAME: ads.slave-132-prod-eu-west-1b-c4c6c248

X-ICSCT-TIMESTAMP: 20161212192538197

X-ICSCT-VERSION: 1.3.2

X-ICSCT-XC: 1f3cfb072bc5ded412eb0f20eaa0b3fa349c056a

X-ICSCT-XS: 91bba9083b637bbb85f2bc525458ea3d2e0cb405

X-Robots-Tag: none

transfer-encoding: chunked

Connection: keep-alive
1ed0..q...ns..np;.5....U_........./K....'.k....:G..2 7rs..L3Wv.,.0....
.....i.*.......~p.E.."XW..?"......).........&......V}.K...xN..........
(.F.c.6..$..I%. .<....C..m....f.iQ...8..-..M....s.....Q.a4... .f...
.n.p)...*....5...<..hn.?..m..X...&_..]....L{ 6J.............:.*..\P
.....O...l1/....>I...mJ&..){d.t...'.....@.....X0?..Yp.K...^...;@...
...H..F0....o....3R...LZ...*.@.kjq.....\..T.'.-5..'.*.......E..iX..l-.
.7I..jF.)z..H.......,..?.@.\M]]..........LN<.B&......@JFD[h.-.../.e
#.).p..N.$......t..~(.qHH......f2.O@..p.SN..k....-..^1N.gxdN.a.Q.1....
......."...}.*T...}...bS..0o..Y.rh...L..w..4QP.C}Nam...=......\mJ;...!
.r....Q........02..7?...~.".h.a........\....p..^.}.....N<.......c..
4Q...0..F........e...O.2_........m../.g.;...F.. ....B......}T.WK......
..........Y..x ....u......&..X..I-.......,...a....Y.O\....\Q.5...0....
L....n4..e...u..a.d]J=..G?....#.6U$..\..-.=Z.T.J.,.7[......a=^.4P...0.
.D.S.g"N.Y...L2...= ..=..,....@..4).y....#..b...@.|4..@V1~..^..[&.[...
.3Id....@.......%..d<:..=.[..b...2.QI.eL..|5....H.]uG....n...-G%...
3:...T...=.".tJm5 ...$..[.w.L...Z..1r..>.c......"........V....r. .W
.F...b.p...rD.K...X.......-.I.Zp'...F....!. .l@...f..$..Kq......'....t
.>..1O.J......5....^8./[.O......h.xU./....n.h......._..H..q.u......
.I..I'.....TR*..L..]hF....\0.]..$....-...6.....XKP.....:....d...4.....
....t9=.D.-.YD&.Ii..n..]\mG.A..6..7........ CZ...)|. ..h......Qj...R.U
x[.....k..w.3..6u8...h.C[..PZ...6f..!...!Y..m@..X..fK.....R......-.'%l
.3..N3.=...G.%`..du........i<..,...4.o.-.e.6. ...... .v..H#U...
<<< skipped >>>

GET /COMODORSACertificationAuthority.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com

HTTP/1.1 200 OK

Date: Tue, 13 Dec 2016 00:26:03 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d57767e944ceafdf9013082f81411b0681481588763; expires=Wed, 13-Dec-17 00:26:03 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Mon, 12 Dec 2016 19:59:09 GMT

ETag: W/"584f018d-30a"

X-CCACDN-Mirror-ID: rmdccacrl3

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Tue, 13 Dec 2016 04:26:03 GMT

Server: cloudflare-nginx

CF-RAY: 3105484b67764124-HAM
305..0...0.....0...*.H........0..1.0...U....GB1.0...U....Greater Manch
ester1.0...U....Salford1.0...U....COMODO CA Limited1 0)..U..."COMODO R
SA Certification Authority..161212195909Z..161216195909Z.00.0...U.#..0
.....~.=...<....8...22.0...U........0...*.H..............cu.....6H 
.....;.,e....m..;uC_O.h9SL..J...h....`L....C=.#:;......e.W3.i..D\..;^.
..a...#.g~.5...J.....J..Z60..6.O....T.U.%......l..Mo..$Tq?c.a.......h)
...y.">.....z..\...).B_g.....2&....je-v.ZL.G$E.5IY&.f......:I.O....
.I<L....q^.....%>..!(e..R..Bc/.qI........q...Z5..9.F#.4.........
..vL...(#X..Id...5.....8H.."......G.....yd>.....q..`.....}.*@3../H.
..|.e.c.T.F/.W..`....$.9c......'j.a...u.#.(.b... .".|..{..../Hu...'.|.
wN...b.w..B9b..0p.D...X...%....o..MNyCIi..pqB.y. ....T}...M.:s.<x..
.q0..p.8..#..Vi....h........0..HTTP/1.1 200 OK..Date: Tue, 13 Dec 2016
 00:26:03 GMT..Content-Type: application/x-pkcs7-crl..Transfer-Encodin
g: chunked..Connection: keep-alive..Set-Cookie: __cfduid=d57767e944cea
fdf9013082f81411b0681481588763; expires=Wed, 13-Dec-17 00:26:03 GMT; p
ath=/; domain=.comodoca.com; HttpOnly..Last-Modified: Mon, 12 Dec 2016
 19:59:09 GMT..ETag: W/"584f018d-30a"..X-CCACDN-Mirror-ID: rmdccacrl3.
.Cache-Control: public, max-age=14400..CF-Cache-Status: HIT..Expires: 
Tue, 13 Dec 2016 04:26:03 GMT..Server: cloudflare-nginx..CF-RAY: 31054
84b67764124-HAM..305..0...0.....0...*.H........0..1.0...U....GB1.0...U
....Greater Manchester1.0...U....Salford1.0...U....COMODO CA Limited1 
0)..U..."COMODO RSA Certification Authority..161212195909Z..161216
<<< skipped >>>

HEAD /ofr/Solululadul/osutils.cis HTTP/1.1

Accept: */*

Host: cdneu.dobreprogramyplcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: application/octet-stream

Content-Length: 4013

Connection: keep-alive

x-amz-id-2: RFxp/IeGoOV9VauHEovMYSOGghIv7TmBStAJ0YlNl2GoAPsPG4/4Qr0JHGlxnCpLevEyTZWZzwQ=

x-amz-request-id: 9E953689273B2B16

Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT

ETag: "569022425db355c9d82beba6efc44f22"

x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT

x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l

Accept-Ranges: bytes
HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Tue, 13 Dec 2016 00:25:40 
GMT..Content-Type: application/octet-stream..Content-Length: 4013..Con
nection: keep-alive..x-amz-id-2: RFxp/IeGoOV9VauHEovMYSOGghIv7TmBStAJ0
YlNl2GoAPsPG4/4Qr0JHGlxnCpLevEyTZWZzwQ=..x-amz-request-id: 9E953689273
B2B16..Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT..ETag: "569022425d
b355c9d82beba6efc44f22"..x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 
14:16:17 GMT..x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l..Acce
pt-Ranges: bytes......


GET /ofr/Solululadul/asgnd.cis HTTP/1.1

Range: bytes=0-101028

Accept: */*

Host: cdneu.dobreprogramyplcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:42 GMT

Content-Type: application/octet-stream

Content-Length: 101029

Connection: keep-alive

x-amz-id-2: dQ5GZhJbm460bZAf9RDvuSrDFCZPaVITqQc/GHAzXf4kWT9F I6FTEyvA73/ulzp

x-amz-request-id: 7977B875E949F9AD

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT

ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"

Content-Range: bytes 0-101028/101029
CIS................?...............P..............M.U....$..q.X]....9u
..9u...#a!.s..2.....{8.u..i3.\...Q.....X..}.E..c.).........&`.......B&
gt;Zr..|...E....=..>.o.u..........=|....:._-@.6.d.b.......F'/.C^..t
...e%.s^.3..4..&..o)Y....UrU.R@.........i.%?...lW.-..g.'..KC...'..0E.m
.d.....x.#]...y..u...?.x.V[....o5.x..MQ\....nX.@.9r..iJ.8...L.E...c.4.
.6.x..@'..[..C(4.&.../A..i........e...`T..H. ........)....9(!.D..m...0
..e.,...~..<. ..L.}...................../...sC..#..}.... .......9.9
.....Ji..Xb.Yjk.../...6.@b...i..&....F....M..a....u..B..~_2....h.:nu..
..-..QiL.P|.LB.).....X..v5Z.$aP.".*...z.b5J..z....h.a>?n~h.$..;.V.'
i...2......Y..q^Z4..\....=`....o.M....~.....:u..^.....A@......k..b...Z
<.!..;......&y..!4...#..S.p;wb....@a...._.......At.5..pz........t.5
H.. 8.-..7...{.P.a;..ia..@.Ac.1.....T...,dmoE's;....5...B.7.vQ$9......
y{.j...F....|...9.u....M......1./.-t....dI#d..C9..Lg...../. .v.......1
T..60.2........#..B..............8.....y#~5A...~t...K...{a.|.z....~.*.
.b*.49k.2....>..]s...W...B.n....zK.,..Vk.....h...........w...".....
.I..XW[..}W...y0f..k.~..O6.97#Gk8.5(....Y.W..k...Lz....6fz.....)|.}../
h(8....0dzx.\........._..b...'..Y..w/*H..\.B...\.......1&..Vg..[..N(.Z
I.......G..[.x....0:.eJ.J~..)o..,....T...i..Z.Q......P!.J......_...F.1
er.8...#d...).......Z..im..F.i....%".o.....F.z.V..Q..K....R..W ./.".E.
.dR...y......'Tu....9U..$4."..wP...d9.....x$...W`....8....#u...1..\,.S
.:.kdU..[...,.a"....". P....!.V.K.Q"M.G.e....w!C..../..... m9J1..&I..z
&.2.I..-B.......{.=Ftm....6....A...3..=@t..67.-M.U.Z/..c..^W/Wo .h
<<< skipped >>>

GET /pl1-sst-x.json HTTP/1.1

Accept: */*

Host: config.sensic.net

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

HTTP/1.1 200 OK

Content-Type: application/json; charset=utf-8

Content-Length: 274

Connection: keep-alive

Date: Thu, 22 Sep 2016 19:52:16 GMT

Last-Modified: Mon, 05 Sep 2016 10:24:21 GMT

ETag: "c5a9574673773c034c79a971904d6ad0"

Cache-Control: max-age=2592000

x-amz-version-id: bnmLALsHBmemZPs7BLapB6YixtqwNrwy

Accept-Ranges: bytes

Server: AmazonS3

Age: 1789407

X-Cache: Hit from cloudfront

Via: 1.1 ec27b2a550cb7db6ef54f74603010b29.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cEh4NqecaxvvOyZBPR-n0X-BQVraaH2Jm-9-irJQqM4DhzENA_uCnA==
{"version":"5","tech":"sst-x","enabled":false,"project":"pl1","project
Version":"1.4","trackingUrl":"https:\/\/pl1-sst.sensic.net","dnt":fals
e,"suiUrl":"https:\/\/sui-generator.sensic.net","systemParams":{"versi
on":true,"useragent":true,"referer":true,"os":true,"lang":true}}HTTP/1
.1 200 OK..Content-Type: application/json; charset=utf-8..Content-Leng
th: 274..Connection: keep-alive..Date: Thu, 22 Sep 2016 19:52:16 GMT..
Last-Modified: Mon, 05 Sep 2016 10:24:21 GMT..ETag: "c5a9574673773c034
c79a971904d6ad0"..Cache-Control: max-age=2592000..x-amz-version-id: bn
mLALsHBmemZPs7BLapB6YixtqwNrwy..Accept-Ranges: bytes..Server: AmazonS3
..Age: 1789407..X-Cache: Hit from cloudfront..Via: 1.1 ec27b2a550cb7db
6ef54f74603010b29.cloudfront.net (CloudFront)..X-Amz-Cf-Id: cEh4Nqecax
vvOyZBPR-n0X-BQVraaH2Jm-9-irJQqM4DhzENA_uCnA==..{"version":"5","tech":
"sst-x","enabled":false,"project":"pl1","projectVersion":"1.4","tracki
ngUrl":"https:\/\/pl1-sst.sensic.net","dnt":false,"suiUrl":"https:\/\/
sui-generator.sensic.net","systemParams":{"version":true,"useragent":t
rue,"referer":true,"os":true,"lang":true}}..
<<< skipped >>>

GET /CRL/Omniroot2025.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 16 Nov 2013 06:15:02 GMT

If-None-Match: "200da-5b6-4eb453c33260e"

User-Agent: Microsoft-CryptoAPI/6.1

Host: cdp1.public-trust.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Date: Tue, 13 Dec 2016 00:26:38 GMT

Etag: "200da-c30-5430486bd6ad7"

Last-Modified: Tue, 06 Dec 2016 22:00:03 GMT

Server: ECS (arn/45CB)

X-Cache: HIT

Content-Length: 3120
0..,0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U..
..CyberTrust1"0 ..U....Baltimore CyberTrust Root..161206213102Z..17030
3213102Z0..s0....'k...120111220757Z0....'k...120111220847Z0....'.C..13
0130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140
212185542Z0....'yr..150701184507Z0....'#...100303201301Z0....''q..1004
14175202Z0....'L...110224181251Z0....'Pn..110309142119Z0....'....10021
6203312Z0....'#...100303201213Z0....'3#..100908172555Z0....''n..101208
175627Z0....''m..101208175749Z0....''p..101208175916Z0....'H...1101141
62156Z0#...'X>..110815145134Z0.0...U.......0#...'Z2..110818184101Z0
.0...U.......0....'g...120111164333Z0....'g...120111164409Z0....'g...1
20111164519Z0....'....100216213519Z0....''s..100414175225Z0....''k..10
0414181839Z0....'3"..100908172705Z0....'3$..100908172728Z0....''o..101
208175645Z0....''l..101208175727Z0....'H...110119195142Z0....'Nz..1103
02154045Z0....'c...111207220933Z0....'g...120111164445Z0....''r..10041
4175143Z0....'8...101012182723Z0....'e...120111163041Z0....'VJ..110714
160903Z0....'s...130123162633Z0....'....130904190524Z0....'....1310242
14319Z0....'....140129172435Z0....'....140129172453Z0....'....13102421
4310Z0....'....131101204601Z0....'....140219171632Z0....'.^..140409155
638Z0....'i...140709171930Z0....'/:..141119193302Z0....'J...1506031846
05Z0....'k...150603185020Z0....'k...150603185058Z0....'k...15060318513
1Z0....'k...120111220827Z0....'8...140716191203Z0....'....131219195909
Z0....'....140219171545Z0....'k...151105070000Z0....'q...160126173
<<< skipped >>>

GET /ofr/Solululadul/asgnd.cis HTTP/1.1

Range: bytes=0-101028

Accept: */*

Host: cdnus.dobreprogramyplcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.0.10

Date: Tue, 13 Dec 2016 00:25:43 GMT

Content-Type: application/octet-stream

Content-Length: 101029

Connection: keep-alive

x-amz-id-2: sVVw879Rw1z0U8R9/j v07WScKQK/sIYEvWMRFfijxkiF65X38cehO6jREX5W/K2cEtAjn70WeU=

x-amz-request-id: D36AFB311361DCAA

Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT

ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

Content-Range: bytes 0-101028/101029
CIS................?...............P..............M.U....$..q.X]....9u
..9u...#a!.s..2.....{8.u..i3.\...Q.....X..}.E..c.).........&`.......B&
gt;Zr..|...E....=..>.o.u..........=|....:._-@.6.d.b.......F'/.C^..t
...e%.s^.3..4..&..o)Y....UrU.R@.........i.%?...lW.-..g.'..KC...'..0E.m
.d.....x.#]...y..u...?.x.V[....o5.x..MQ\....nX.@.9r..iJ.8...L.E...c.4.
.6.x..@'..[..C(4.&.../A..i........e...`T..H. ........)....9(!.D..m...0
..e.,...~..<. ..L.}...................../...sC..#..}.... .......9.9
.....Ji..Xb.Yjk.../...6.@b...i..&....F....M..a....u..B..~_2....h.:nu..
..-..QiL.P|.LB.).....X..v5Z.$aP.".*...z.b5J..z....h.a>?n~h.$..;.V.'
i...2......Y..q^Z4..\....=`....o.M....~.....:u..^.....A@......k..b...Z
<.!..;......&y..!4...#..S.p;wb....@a...._.......At.5..pz........t.5
H.. 8.-..7...{.P.a;..ia..@.Ac.1.....T...,dmoE's;....5...B.7.vQ$9......
y{.j...F....|...9.u....M......1./.-t....dI#d..C9..Lg...../. .v.......1
T..60.2........#..B..............8.....y#~5A...~t...K...{a.|.z....~.*.
.b*.49k.2....>..]s...W...B.n....zK.,..Vk.....h...........w...".....
.I..XW[..}W...y0f..k.~..O6.97#Gk8.5(....Y.W..k...Lz....6fz.....)|.}../
h(8....0dzx.\........._..b...'..Y..w/*H..\.B...\.......1&..Vg..[..N(.Z
I.......G..[.x....0:.eJ.J~..)o..,....T...i..Z.Q......P!.J......_...F.1
er.8...#d...).......Z..im..F.i....%".o.....F.z.V..Q..K....R..W ./.".E.
.dR...y......'Tu....9U..$4."..wP...d9.....x$...W`....8....#u...1..\,.S
.:.kdU..[...,.a"....". P....!.V.K.Q"M.G.e....w!C..../..... m9J1..&I..z
&.2.I..-B.......{.=Ftm....6....A...3..=@t..67.-M.U.Z/..c..^W/Wo .h
<<< skipped >>>

POST /?v=2.0&pcrc=1858890704 HTTP/1.1

Accept: */*

Host: rp.bororeb.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1936

Cache-Control: no-cache

...3E.Q)_l.y...K..a.hr...:%..

..q...pF=.>. ....$.XB..P.vB'....q.

#.&.C..Ud4.Z......8.....I.#.\a..1<.....,:P...v.Fu.g...Er.........Z...CJ..F..{....[%0,.M.F.=......A.. ..a... .......X.1.W..N.z#...I=JO....-..7.j $a......x..|9....n......}...
..}y.cN.4!H..q...._......W

........nD|L.\. (x._..c..X....b<@..ye....*..Y7...H;.9...Tga6-..k.z.#..q..E.......U...gw..w..)i.b...yv......7W7l..

...X.ic.1..i.%....8Ib$."y.....r.q.}.H.t-.X..#......).......c.~...B.......`.-.. .....1s.*....7A$mp........
.U.8.Yp......n..]{.....'.....8....s....a..A.....$..Y.bAR..._Yd.{.9.......m..D'4...u.........%......O...G...i.'C.B.{..nh.m*.....I.$,.;..#..f.LA..*J&_,..
..H3!..8.w..4C...*s2...'G,.P..h....(..hy..[.WHs].{L..Ozz..7..{.{......m;|C...
....V ...>.O...M.N..hj.......

..J.UI.K..@...L.[.0....$-.......4 .c$K....@.H}....4.......B...kvC...~.

.....e...!.c.._..e...=.;[. .Y.....25.qg.}.@.X 4...U....s.c.-.&..&%.....hK|..K........D..9D..9.GQ.v...b8..:%...zDtK}..A..=...-.1q..NT,O`.....lC.<.0...r..=>w....'a.<(*{N)3._.d$y.Xz.K.
.v.*3}...Kv.~px-EW.={XPf.;z.....oNM....o ..,R...#.S. ].U.#..NP0AQ.uo;..t......

9.x../G..`...Uj.\...".O..H...`..^...k....x.]Y . .Kg`.^...b.>....

Guz...,.\2............k..{...Au..H  9F.>aRq...a.F...J.%..s.....
eY.tFe&.&b.....u.^./...)@.\C.r|.....&{....j.gU<rX]..F....)}...9ch....L.}5....>T4.
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Dec 2016 00:25:36 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue
, 13 Dec 2016 00:25:36 GMT..Content-Length: 4..Connection: keep-alive.
.DONE....


POST /?v=2.0&pcrc=775274733 HTTP/1.1

Accept: */*

Host: rp.bororeb.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 2352

Cache-Control: no-cache

...4.....>.K..~.w..J.i.6D%..5.. z)

J".]M...4...*....j.........J%n.4^....p.......e...}

$.f.K{......X....uX$.^.......H..G.d.T.R.5...f.=._(&..Qi.........t...T.N......b:.......y.Y.`.!]...=...e.'o.{...f...M.,......?..;?.F.;]...HK.....}..).hS..,2..p..Sme......\...U4...kl.$.R.........Z.T.B..... ..l....F......Y....?$.R.?..[O.$ .C.5..O.LtR.S.....??.Q.#......$c..

..S...5(gS=.c.Y..t...am|a...;f%....4...<.n.dg}\.........T0..u..W.y.-...'.AM0.......|@.....vA....D..G.:)%.~.q....NO..F.).1....B.. ..-.......N...Y&..<.....Lm....o.....D..cq.AO....R...s....J-..kK....F.Bkb.4..)0....<....v1%J..(
AM...K.....8EX... ..Z..fd...0z.........$w..{:.A.......... .4...e&.`|J... sR.:......S~.....W....-.K
"pBI......0..w\
3.G.iU.5S|B...T.D....o..b.j.2r.(G!M..B......K.B..^.....s>.....c.!;=//o.....R).X.Y.6....Ox...y6'`."r$.pg.**.. ...>....s!.x.B....U.._...$.....5...V..L_../.&y.."....i....4..Zl]...........TR0.Y.z.v.%....j~]gT ..(N]..h.\.. .<.A........f&...g.v@..PmO..r^.b.q.. S..|-U......{....C:
.6.s.(Y2........'%V.#mF.-<y|9n.(..s.:z.q~R7s...JV-/..5.b.t.i..}

...BD./...mG...W..I.....2K....x..".4y..m5.N...7.r....6........#7f~..q.PS.~.9z.......n..#C......
........fd..8V!...`.

..\..C..4......J.3%^4.8/,F......Sy.n.E5.Xk.\.....T5Lw...Y)[..8..<..~_.!..b.3.`.tA;.X6.(...

..N.....6x:.TO....6....\...i.........`.Z..R.........:L...
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Dec 2016 00:25:38 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue
, 13 Dec 2016 00:25:38 GMT..Content-Length: 4..Connection: keep-alive.
.DONE....


POST /?v=2.0&pcrc=1988936779 HTTP/1.1

Accept: */*

Host: rp.bororeb.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1568

Cache-Control: no-cache

....V.....2$.....j'.`*\.8..,u.4#..y.....e<.........~.Q..h.c.!ob

.......k..C....o]...1.4.a.--Kg.Nf.......pd....\....i.......Pf...P....."... l...0O.Ur...4..m..C...>`.
}7...{.yQ..V.....6.a.pU..../Z..{?.giI.........H.......fig...,.#..l..p.,0.F|7.S..c$a.c...........et...p.<M...w.N.r..:..".w.&.ejF!....I....:....{....../.a-(

...
A/.....[.I>]M.........;..n1s..d.-....<..A.=-....W.MeU4......%..6s..t...}.*....U.....*.4`.!2......Z..3..A?|-.....5.U....E...K~.#.....`TS.......)..."..zq..).H..F.W}....`-.P`;.Ir.~.py..b..f..]..8!.@.L..1p$......zft...}.....3..t.. ...{a.=7...i;.....T.y2...F.M..2$..k.A7.<...t|.....Y.on.PW.U;.....=x.Zn<t]...`....>EN..IK..Dw.........9..c0....a.&..o......
.g...u..X.={..x.....9o...E.~5b:..\..dn"1..........T..]/..R.</...q....Z.0.}........'.i....._.<...c..5M).G....1..H.Y..>.;..8..m>0]..!*U......xV? ...*......}....32-qcy.1T*....ud..g QU....s.(a...vI9....@.E...T..8.L..\....:.
..w...x.$..:A^.6..M7)2j...^.(r....d...^..W.2...M~n.......Z.....R.A.6..........}.#.....K....

....O......j.?...Qjj...l?E..%.l.g...r:..........uS.i..D9.$...G.m.pP......V.u..^....E..9....6(....Z...6..9.e9...5
..%.^.r......T.d..BR.y.P..h-K.1....C._f..(.....kN.......y.....S.R6\..{. *6.z.D.......Jk......0..IP......}.v..8>.....O]n...B_......@.d.X.o..w9.........,.....5...\![...A47#i..]......D|..s.t...e
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Dec 2016 00:25:57 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue
, 13 Dec 2016 00:25:57 GMT..Content-Length: 4..Connection: keep-alive.
.DONE..

GET /pub/videolan/vlc/2.2.2/win32/vlc-2.2.2-win32.exe HTTP/1.1

Range: bytes=15564800-30510919

Accept: */*

Host: download.videolan.org

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.11.6

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: application/octet-stream

Content-Length: 14946120

Connection: keep-alive

Last-Modified: Sat, 06 Feb 2016 09:50:03 GMT

ETag: "56b5c1cb-1d18f48"

Content-Range: bytes 15564800-30510919/30510920

X-Clacks-Overhead: GNU Terry Pratchett
..S.]@....& d..A.......G.....X<p.^...y[.iy..35...`.....d.*).%.....%
~%T...y....A...p.=C..J<|R...!...SG...|..!...'..R .c;.....Nd.......^
z....[.\....X...i'yY...%....0.jjo=D.V..T5jv.?.^.d.....Qx.k.....*...N..
..N......d...x.....?.6.#.2.....sL..).....%8'.*.K...~]..%......|...].T@
..b.j..EJ.Z..j.....0I.K.......g.O..."H.../{..T...u..N...;DR.Jezb.=hRI.
...,.6.Mz?..v.0..NM...v.7.....a.r.........Y.;..K.?&IB..6/.L}.u........
..5...0...[....!S.....9.3{......."F<f.^NL..(..c....I..............j
.~G'.(q..I...H.L...D...v......>`.bU:..q.?..9#.fC..i....m.(.e.....l.
....R>W..p\./.g..q$..|: WS.j........:.......E...[.....Y......@Gd..\
..h..PY........My.-W...@..s..]d..Ce"`8|...jT...`o.s........<..?|..4
...F..m;a.f9...3n...Z.*o.g#.[..f.[.w,a.....@^....023z....;oP..........
\....X...%..O...........d'6.w.J.@..............u.KX.I..K;E............
.q......H......F..X...;.!G..>......u....[..'....e...... ;...kk.z.J.
..xI. ...'I...Q0.b.c...M....}..M......aw.V.N....u..$...G}.....F_..._..
Y=u..\].$..P....b&..a.......P.....u..G..~]..b...\_...gp^....J..".jjZk.
.E..8.(..).I.....fF..;H... !....7.h..K..$q.N......xl1..'.8.8./H.i7....
-.Er....k...Z.|J.6............uK$.=.....=...*o...!<....Ne@ ....}.%.
...g....m'.x...i.e4.-.....a..6.F...0.....4/^....Q|...I.\...^PMK..0..kb
3.1.9...u....#......t5.r..`Et.".e...\..nH........v.F.... .3~.|%'......
i.*..,......-...Z9...4...d.^........G......C..h.....$.99../........R..
>...I.Z.8i...#....E.k..}...'F.?.Z.........RT@IK ePn.in.T..*.....Y..
./..^........r.>e.....@.i...G5Z.....1..#.*.....8....fY..6....*.
<<< skipped >>>

HEAD /ofr/Solululadul/asgnd.cis HTTP/1.1

Accept: */*

Host: cdneu.dobreprogramyplcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: application/octet-stream

Content-Length: 101029

Connection: keep-alive

x-amz-id-2: dQ5GZhJbm460bZAf9RDvuSrDFCZPaVITqQc/GHAzXf4kWT9F I6FTEyvA73/ulzp

x-amz-request-id: 7977B875E949F9AD

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT

ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"

Accept-Ranges: bytes
HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Tue, 13 Dec 2016 00:25:40 
GMT..Content-Type: application/octet-stream..Content-Length: 101029..C
onnection: keep-alive..x-amz-id-2: dQ5GZhJbm460bZAf9RDvuSrDFCZPaVITqQc
/GHAzXf4kWT9F I6FTEyvA73/ulzp..x-amz-request-id: 7977B875E949F9AD..x-a
mz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3..x-amz-meta-cb-modifie
dtime: Wed, 20 Jan 2016 14:37:36 GMT..Last-Modified: Wed, 20 Jan 2016 
14:38:52 GMT..ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"..Accept-Ranges:
 bytes..

GET /?f=json HTTP/1.1

Accept: */*

Host: sui-generator.sensic.net

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Cache-Control: public, max-age=126144000

Content-Type: application/json; charset=UTF-8

Date: Tue, 13 Dec 2016 00:25:37 GMT

Expires: Sat, 12 Dec 2020 00:25:37 GMT

Server: Apache

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

X-Maker: DomiX

X-V-API: 1.6.2

X-XSS-Protection: 1; mode=block

Content-Length: 79

Connection: keep-alive
{"id":"2279428cc7ff9feadfcc05bb2dcad8b9|68444","cd":1481588737,"lt":16
07732737}HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Cache-Contro
l: public, max-age=126144000..Content-Type: application/json; charset=
UTF-8..Date: Tue, 13 Dec 2016 00:25:37 GMT..Expires: Sat, 12 Dec 2020 
00:25:37 GMT..Server: Apache..Timing-Allow-Origin: *..X-Content-Type-O
ptions: nosniff..X-Maker: DomiX..X-V-API: 1.6.2..X-XSS-Protection: 1; 
mode=block..Content-Length: 79..Connection: keep-alive..{"id":"2279428
cc7ff9feadfcc05bb2dcad8b9|68444","cd":1481588737,"lt":1607732737}..

POST /?v=1.03&c=8b3a4081&at=740357246&cntr=0 HTTP/1.1

Accept: */*

Host: info.bororeb.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 172

Cache-Control: no-cache

6l7GU7LYt04pVHc/00d7JnebO9zNClW1HChgRzJAaHN0Ws7tGqBG0g4IpRF2Y2WJBa4s7wtRV9e/xw6zG/PtKOcd/jCSpNUEb9Len6j36LuQO 6ffOkV9C QeWysc5LISC4soJFcNlZXA RgdfnOzhnMjnIphWFG7nZHvzFRPSQ=
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 13 Dec 2016 00:25:37 GMT

Content-Length: 704

Connection: keep-alive
URtj3NkzNBN4mJ0gp0we790pt9ctigwSyTlvze9FbjkGoIlUlj3RCGW5AWTsfr0raHpOob
NtGkrjG21dglxX3p/0bSzeWifgsGEOtalbbnbvaL/UwWBHtAmHyivWL8QJmUUBEKke3D6I
0PKSbLnMB8VgtyWyF3ciM1lRmOBXrEBfDVSiYLjelEa1Lp9cV8U7dp5MavbUcGDNJqUvgN
7S pmLGFu04/Eh9SmlkuZdZ0w6LfBlFhPaBoucz4m4H3/hc/3mgqvncyEzmPaRjoaLnnk0
vJz/AWYOyWKzgBj/3oGFoJ6g/LVSzULM3AZoHwWGeekzz178fNpGzHjAiKn1u3Wr4S4w8C
b4vfb0bmi3izLK971DG174ggPs4SeZz8f04OhVabiXA4aflfXpxEZ3aUd efM2gq8w8DCb
Q zNrVJBsy VJfTNX7d9cXfyPJSPncSAfAolxRR OYGXPu0IYjd AlWDX167X38CJ75APY
HM62JaD2SslhUTX/8 p8E07dhwtmuxxfXcUisZUvcJFo5UHlEqm9qrHEUl8NJxh r xOdt
pB9E k2HhubMra/EfcNLlNu B6/ELI2sCNBjhW77XHgvGKT1zWrDE7s43GN5iWc4lQN2Cj
YBq0RB YUexmW/maEJoYuY6UjNoEy azihBlAWuql/QefiWtB56nzbk8nwyJG8Y0uSIr0c
qWLKHTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Tue, 13 Dec
 2016 00:25:37 GMT..Content-Length: 704..Connection: keep-alive..URtj3
NkzNBN4mJ0gp0we790pt9ctigwSyTlvze9FbjkGoIlUlj3RCGW5AWTsfr0raHpOobNtGkr
jG21dglxX3p/0bSzeWifgsGEOtalbbnbvaL/UwWBHtAmHyivWL8QJmUUBEKke3D6I0PKSb
LnMB8VgtyWyF3ciM1lRmOBXrEBfDVSiYLjelEa1Lp9cV8U7dp5MavbUcGDNJqUvgN7S pm
LGFu04/Eh9SmlkuZdZ0w6LfBlFhPaBoucz4m4H3/hc/3mgqvncyEzmPaRjoaLnnk0vJz/A
WYOyWKzgBj/3oGFoJ6g/LVSzULM3AZoHwWGeekzz178fNpGzHjAiKn1u3Wr4S4w8Cb4vfb
0bmi3izLK971DG174ggPs4SeZz8f04OhVabiXA4aflfXpxEZ3aUd efM2gq8w8DCbQ zNr
VJBsy VJfTNX7d9cXfyPJSPncSAfAolxRR OYGXPu0IYjd AlWDX167X38CJ75APYHM62J
aD2SslhUTX/8 p8E07dhwtmuxxfXcUisZUvcJFo5UHlEqm9qrHEUl8NJxh r xOdtpB9E 
k2HhubMra/EfcNLlNu B6/ELI2sCNBjhW77XHgvGKT1zWrDE7s43GN5iWc4lQN2CjYBq0R
B YUexmW/maEJoYuY6UjNoEy azihBlAWuql/QefiWtB56nzbk8nwyJG8Y0uSIr0cq
<<< skipped >>>

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy+emBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQCdZZ9r88cafMgPHXnOMOGm HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com

HTTP/1.1 200 OK

Date: Tue, 13 Dec 2016 00:26:11 GMT

Server: Apache

Last-Modified: Mon, 12 Dec 2016 21:03:34 GMT

Expires: Fri, 16 Dec 2016 21:03:34 GMT

ETag: 749E739399D22393DA8DD7E8A4945B1BCD655D58

Cache-Control: max-age=332842,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp25

Content-Length: 472

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0........j:.Z.....Vs.C.:(....2016121
2210334Z0t0r0J0... ........z.>...*,.(....F.@.......j:.Z.....Vs.C.:(
......e.k...|...y.0......20161212210334Z....20161216210334Z0...*.H....
...........D.N...pD.{$Eb2..`>.[.. l..d.......G".[..$>.K-........
:.a#Xu......jIA}.. .F..j...\...|U*...~... .*0.......;...s....^...2...)
....(..........o.oJ...:.0...8.I$..b.rJ...Q@.h....6F6.}...n..........@.
./....}...m...V.xR....v....y..%.-...S........E..=.#.7.......!..

HEAD /pub/videolan/vlc/2.2.2/win32/vlc-2.2.2-win32.exe HTTP/1.1

Accept: */*

Host: download.videolan.org

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.11.6

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: application/octet-stream

Content-Length: 30510920

Connection: keep-alive

Last-Modified: Sat, 06 Feb 2016 09:50:03 GMT

ETag: "56b5c1cb-1d18f48"

Accept-Ranges: bytes

X-Clacks-Overhead: GNU Terry Pratchett
HTTP/1.1 200 OK..Server: nginx/1.11.6..Date: Tue, 13 Dec 2016 00:25:40
 GMT..Content-Type: application/octet-stream..Content-Length: 30510920
..Connection: keep-alive..Last-Modified: Sat, 06 Feb 2016 09:50:03 GMT
..ETag: "56b5c1cb-1d18f48"..Accept-Ranges: bytes..X-Clacks-Overhead: G
NU Terry Pratchett......


GET /pub/videolan/vlc/2.2.2/win32/vlc-2.2.2-win32.exe HTTP/1.1

Range: bytes=0-30510919

Accept: */*

Host: download.videolan.org

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.11.6

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: application/octet-stream

Content-Length: 30510920

Connection: keep-alive

Last-Modified: Sat, 06 Feb 2016 09:50:03 GMT

ETag: "56b5c1cb-1d18f48"

Content-Range: bytes 0-30510919/30510920

X-Clacks-Overhead: GNU Terry Pratchett
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L...n..V
............................]C............@...........................
.......t........ ......................................p..Pk..........
.q....................................................................
...........................text............................... .0`.dat
a...............................@.`..rdata...i.......j................
..@.`@.bss......... ........................`..idata..................
............@.0..ndata..............................@.`..rsrc...Pk...p
...l..................@.0.............................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U..WVS.......U..E....t...F
..........B..H...H.......E..5 .B..D$..E...$....B.SS...E..E......D$..E.
..$....B..E.WW.E......E..}.9}........E.)..E..FT.........FP.....E.....}
.........FT.......FP..E.....}.......FT..........FP........E.....}.....
.....E..M...$..`.B.R...E...D$..E...$.D$.....B.....<$..h.B..E..Q.H..
..~X........F4..$..d.B...W..........$.E......E......D$.......x.B.RR.FX
..$.D$...|.B.QQ.5p.B...$.|$....E.R.E.R..$.D$. ....D$..D$......D$...B..
...B..U......$.T$...QQ.<$..h.B.S.E..D$..E...$....B.PP1....D$..E
<<< skipped >>>

GET /img/Malaromoro/bg1.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/jpeg

Content-Length: 190754

Connection: keep-alive

x-amz-id-2: Xm5lXmLP2cUl2h qsCCcipUNqtJpSKI73ydSseaplmaDEaSDB/zdYhr /X M03gK

x-amz-request-id: 0C7DBCA71A368EB7

x-amz-version-id: EqXw9hQ1szW0X1KVab90EKpMdqK_JEeL

x-amz-meta-cb-modifiedtime: Sun, 16 Mar 2014 10:17:54 GMT

Last-Modified: Sun, 16 Mar 2014 10:45:33 GMT

ETag: "04007b142892c379ac83bd75ac617cf6"

Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A49514ECFC9DE3118
7F4F8E0F4860236" xmpMM:DocumentID="xmp.did:0699FCAEAA0111E389E68AC7CC9
63200" xmpMM:InstanceID="xmp.iid:0699FCADAA0111E389E68AC7CC963200" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:069AD74DE0A9E311B383BEF54B638275" stRef:doc
umentID="xmp.did:A49514ECFC9DE31187F4F8E0F4860236"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
....................0.................................................
..................................................!.1".A..Q2#.aq$..B3%
...4.....R..Ue&........................!.1..A"Qa.q.2#....B....R...br3.
..$.CScs.4.T%....Dt.U&............?..../*z..E].c..H..S..^g*...B....a.&
lt;.Q.....A ...$..M.>..M..........i6l{..p..rMdu..A1$...........r5W.
.S.......mmk......}u.......=#<...Dh...;.V.....N.r#;Q~...us..EO.
<<< skipped >>>

GET /img/Tuburera/logo_b.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/png

Content-Length: 11762

Connection: keep-alive

x-amz-id-2: H3uBwzKM1BCL4 SQoFrUXTe byulszniMUXp0E7iZXMnRoTShOGexE7xccEJWUsA

x-amz-request-id: A12753E650C026CC

x-amz-version-id: akDXJVqWGXlhXhhZ8YepY7NAR4.yDN8P

x-amz-meta-s3fox-modifiedtime: 1392281588994

x-amz-meta-s3fox-filesize: 11762

Last-Modified: Thu, 13 Feb 2014 09:38:37 GMT

ETag: "cc4bec630c2ec102cb6159e463ede5cc"

Accept-Ranges: bytes
.PNG........IHDR.......-.......;.....pHYs..........o.d...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;.
.m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
.b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /img/Rewudaw/BG_FS.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/jpeg

Content-Length: 72475

Connection: keep-alive

x-amz-id-2: gT5ACYuYz0TmukbUeTSna4RXN8mPlRWJgvk twwTZM ltxHhFZ76HloYWMbSJimfLwJPn6KzZyw=

x-amz-request-id: 69BDBE6F970D29A1

x-amz-version-id: Nz7N2MAKlOO7oSd4nN3DlfFquV7Kpg4k

x-amz-meta-cb-modifiedtime: Wed, 06 Jan 2016 14:31:32 GMT

Last-Modified: Wed, 06 Jan 2016 14:31:44 GMT

ETag: "9146e3b2964074e188543372a5757a2f"

Accept-Ranges: bytes
......JFIF.....`.`.....fExif..MM.*.................>...........F.(.
..........1.........N.......`.......`....paint.net 4.0.6....C.........
...........................................................C..........
.................................................................."...
.........................................................}........!1A.
.Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijs
tuvwxyz...............................................................
...............................................................w......
.!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcd
efghijstuvwxyz........................................................
............................?..^.;.O.|:.#....j.}...i..zu.Y]....x.T....
.kI....&)6...Uj.5...7.-...'..-.'......E..Z.....6........@.J....`.p..Y.
..&...Y.....%......7v...p.K.c......#..#..K..,.Z=..$W.i.|......g.;..H..
...7.....UtTe.[.M.J-.....J.Zz........E.HA..[.R.v.../....|W..u]S_...g.V
yg..!......h.....1....\.Z....}ona...<J..I...m......U.!._.6....8....
$Pq#g.!.:...$......gut.[j...........(...'..m.7V.l......{.....>.P...
.S...p.R.[.E.k ].....mo..QN..\.4...t.......>4.n.w..G..............(
5.3..]...x..ebnd.Hp..&X.............5.W....o... ...kAo...v.j0]E5......
....E.Y.D.......GZ.P.,...k....F......x`72..f.WF..J..8.IB...N..d/..%...
..c.WA.?.O.......y..>../..}.Z../N./. {....`...:..[G.....^./.,>..
iZ..*r..S.jta)...\]Y(BZ... Y......^......q.%.J..j....e...]hwz..$.a..c.
!q...5.S`..U1m.\.vF.!.q..k.<3.xj.L>...z..g....MI .x.HY.V...O
<<< skipped >>>

GET /img/IE_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 5921

Connection: keep-alive

x-amz-id-2: B8btCOVZ17R0ljuFrv/sB2mXcSnGaatPVRrWU6EWCjthMT1MJmQzVL LjbXe4cNw

x-amz-request-id: 8EB4CE7B0C022CF0

x-amz-version-id: JCaAVEF0XYSznIkNb1ccJeiC74z2Hy2T

x-amz-meta-cb-modifiedtime: Thu, 12 Mar 2015 10:46:00 GMT

Last-Modified: Thu, 12 Mar 2015 10:46:07 GMT

ETag: "d86b9d354a5cdd126ae5250c162630d3"

Accept-Ranges: bytes
.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:10
B50654C8A411E4A871F63F79D4AE1E" xmpMM:InstanceID="xmp.iid:10B50653C8A4
11E4A871F63F79D4AE1E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.did:A5370A64F8C7E411A9
F2DF1F27361A01" stRef:documentID="xmp.did:A5370A64F8C7E411A9F2DF1F2736
1A01"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.. Y....IDATx..Z{.......].==...a....A....Z.
$$.=..s.G...M6.Y_..l.&.$..yxt..W.9.....b|F.. 1.A..F`...GwOwuW....W.3A.
.`..{..........{...a!.}T_.L..4.t..\...a.?......C.....kPL*.S...........
}..k.w}..8.5C...E...?.$..?^......N......Iz...3TKW.B.)....).R.....E.C..
.......L.~..v.......%B'N..%..U.e]........!.~.:8O.ZG..Ie.1.).....h.X...
d_...W.L..bi.6.ps....1x.....O.....Zx.,..W.F.r..[..<.L.?...XqZ..t...
XEP...*RI\0.0)D...=.n.....|.(S(...O....We.k.8.X.........# ..........P.
...S...m.##...Vq..Rt.."."# ..........>..nA...1.... E.cE...h......$.
1..JQ..!..o...;$..O.GA J.R.cV.Xp..f<.s}4<........7..A'..V.RX
<<< skipped >>>

GET /img/Nininininon/Nininininon.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 415606

Connection: keep-alive

x-amz-id-2:  /H9 4xozfQORxo7W4UWAgqPm1eXpuNaYuoFpZVnZrWIOAcqHThzifkF/u39ulPDtmvoz kYl/0=

x-amz-request-id: D175858B8AA34001

x-amz-version-id: s.HW.VrEMobnKgHFcVDtYUH1Ob1rUFLd

x-amz-meta-cb-modifiedtime: Wed, 09 Dec 2015 16:17:48 GMT

Last-Modified: Wed, 09 Dec 2015 16:18:51 GMT

ETag: "2cad81e24a9d1d2c55b26ee3c73b61e5"

Accept-Ranges: bytes
.PNG........IHDR...0.........A.>.....sRGB.........gAMA......a.....p
HYs.......... ......IDATx^...LVi.........C..h,...q.............b..((U.
.......DAE.......{.}ko.{..y...|W\.zm...c.u.k....e.7):...;.);....$...PQ
Y@...T.>.......T;YP.f7a...u.6q[.R........w...5..Z...,......4...Q`bJ
EE(......@.-kj.-.s.....u...\.JYu.Ua^TW$..w......s.......G...hhh.2d.`Y.
.{.......w.8....9...csvq|...~.....g.v..;..{.&.........8..FN....s..QjcJ
...J./Sl|.../.....P......r;...)..G.j]Zo<....1......._"..O....y;nPz.
...L.wp!..O.o....%.v.......G..'4&.S_.CMn.yw..u.Dmz.5NO(.t.5!....R/."N.
.~..E..}.9B..)....0.GcG...e..?....9*.r.n.....9..b..........K.._y~....'
...6...-({v... ...R.....h*R_...%g.:R..A]..j._Q.PH}....]...=...hN..^...
.f...M..;.^}...-..|i.q..YS..JS.'Zs.i.k..yP..BkN..'\..s....T{..:.....4y
.c.4x.4d...Z9X.Y.....T......M..D...alG..5....s...qn.w..{.d.7...g-.....
C...x..2#}J..QpZ..kSj.....(7e..G8....M.....i6......S....N{x$..\.d.-E..
..!...........%<..g.i..e.zKUm<.n.....Z.....O...V.=.........$...t
...X4D...?c..c.4x.....>.q..1~.`A....X.KWx...[#F.w.H....60.d.'.n....
~.|.....).5..q.3N.^?....Qq..(F....T^<E...............ObF@(...4.?...
.N\...ek.~.@.g$.......<..r..w.... .-4...H...h..f..;.ZY.R.J....3..J.
.H.g..M&X.1q..f.........C.. .Mu...jR#..ap.Mu_............&V.......C0.Z
..9.g..(h....$.9:b>z...7..~.. Q...x.. ...{.2.B......\.....=:z.,..e.
.sZ?........g...i....hOKg...L]..l..r^~f.......?... . .u.....4.k.5...ZE
{b...Q...1..5&\..;#...?..........._nT...G.R...........d......'.m;....O
SD...(.S../.j..3.~..~...~K.3...k..|.,&........0_|..M*<......C..
<<< skipped >>>

GET /imgc/ToolIcon/13060/g_-_32x32_-_s_13060x20130323113056_0.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: gallery.dpcdn.pl

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: public,max-age=2592000

Content-Type: image/png

Last-Modified: Mon, 28 Nov 2016 16:37:59 GMT

Accept-Ranges: bytes

ETag: "6e93dcc79549d21:0"

Server: Microsoft-IIS/10.0

X-Powered-By: ASP.NET

Access-Control-Allow-Origin: *

Date: Tue, 13 Dec 2016 00:25:37 GMT

Content-Length: 1388
.PNG........IHDR... ... .....szz.....sRGB.........gAMA......a.....pHYs
.................IDATXG.W]h\E........d.d7?m.&.ZHi..XP..>......h..DD
..}..}Q.|R..T..v.DA..&.-B.$n.....M...g.....w.3sg7....7 ~0........3gf.V
../.h....0..)F.904....M.7.......|.{.90VD..kXgw..ohiA...q....cE.,.|...b
.\.3.].W.Z*.."..h.A.*..R7u.9.......p....-..XC..-7..........vz.....B`..
../....`....C 01q ...l..q..2...!0-.O.4p....a..TaU`.."02...2..J..i.4...
R.F .......7.y..t]....'..]..B ......;-...4..s.R..... S].......6....G."
.5x......Ga|.3..pr.pK?..!5Q7..G....g...'uo.WpgV....0..s..[..I.k.......
....y...A..N.....*..\.u.0,..Y2.$.*.E.W.E.............0.........y......
5J....6.".y.....k..S..;..bq......l..3..(.]Q.vW\.}...X.........Q....CG.
QU...k..T|;R..Y.Y>{...O~..X.5.\?w.v..MF.."..........t:...y..M..v<
;...Z.K...<.r......|.......R....L&..q$...T........d.<x.....,....
.Se...4..h(.R=>.W.r..J.iM...r.pv..al.;*QE..f..*........;R.... Z.`n.
F.$........)..U!.y.[../R..4w.a...n..ulC!...../.J....{`.....po...8.....
FJD....K.8....E*e."...x....B.l .....K......_......%y.Jr.I.<.]9.....
K\.5.U!`...DY..3.4...%./.(FK....TT..~.1{5...........wk.<K/-Z.g....@
L*.oe..3.....gU....c..C....T.]Z....4......oPJ4..*.U...... Y..c....&...
...|m.G.WC*=....kt..qJ"..zT......$..8...C...m...3 ......Mc..".D...N.0.
.Bk*..%.......#K;%.Hn.n.r...]&....L.T.K............w:..._...k......R.T
. ..P.......,..0.....^..]%x..t..\.aQZ..3.....dX....$.N..%........u...W
....IEND.B`...
<<< skipped >>>

GET /COMODORSADomainValidationSecureServerCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com

HTTP/1.1 200 OK

Date: Tue, 13 Dec 2016 00:26:02 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=db0813972783077165f70e987d2413f6f1481588762; expires=Wed, 13-Dec-17 00:26:02 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Mon, 12 Dec 2016 13:12:08 GMT

ETag: W/"584ea228-117cf0"

X-CCACDN-Mirror-ID: rmdccacrl7

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Tue, 13 Dec 2016 04:26:02 GMT

Server: cloudflare-nginx

CF-RAY: 3105484746ce4124-HAM
5c48..0...w0...^...0...*.H........0..1.0...U....GB1.0...U....Greater M
anchester1.0...U....Salford1.0...U....COMODO CA Limited1604..U...-COMO
DO RSA Domain Validation Secure Server CA..161212131208Z..161216131208
Z0...d0!....w`.h.**..$.R.\..140220191049Z0"....P{.... .]A....m..140404
195800Z0!.......u,y".QU..A...140410154408Z0"........fU.%....}....14041
0172927Z0".....,.jc...Q..FV....140410185945Z0!...0...:.Km.~..V....1404
10214937Z0!..cE...2!D....,It...140410215014Z0!..W...!...Lf`...7...1404
10215026Z0"......*{u.....BZ.....140410223535Z0!.....(..7./.9..n....140
410224524Z0!..].F.L.....|.O .,..140410224851Z0!..\...Y...N.........140
410230501Z0"....P.#.~..>.U><.....140411065449Z0!...'.k.WJpt.?
.......140411131823Z0!..b.B.F.. .&.D...X..140411131850Z0"....5......0.
?.B!....140411131922Z0".....@.wb0}=..L{.....140411131938Z0!..2..r.....
...G..F..140411131956Z0!..U......g._w.R./e..140411172311Z0!..4...Y/X..
f...cb...140411174902Z0!........~4...LV..(..140411185644Z0".....uU_o..
..C.m.M]..140412001353Z0".......r.!......-p...140412001402Z0"......xW 
{d...rW?.P..140412021032Z0".......#.8...d.."L#..140412114042Z0"....x.{
...!..........140412155740Z0!..L....7.-~.r.J*....140412163423Z0!..M..\
_L.3..5}.).5..140412171532Z0"......b/.m.../.Z.Y...140412175728Z0!..0..
..........T.3..140412183108Z0".....dIk......b..C...140412200345Z0"....
......_$.........140413022007Z0"............C..c.....140413104918Z0"..
....n...xS.Y.E..J..140413123759Z0!..p..J.)vO.'...x.]..140413143438Z0!.
.4...r..V..g.B.....140413190918Z0!..'..]...<.......t..140413193
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.usertrust.com

HTTP/1.1 200 OK

Date: Tue, 13 Dec 2016 00:25:55 GMT

Server: Apache

Last-Modified: Sun, 11 Dec 2016 22:45:11 GMT

Expires: Thu, 15 Dec 2016 22:45:11 GMT

ETag: A176BC46920F884D610EFF3F907B4F582FD001BB

Cache-Control: max-age=252555,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp28

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...2016121
1224511Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T..
.'f.V.I....p...."....20161211224511Z....20161215224511Z0...*.H........
........}.S....0.^6...!q)k.=.H/.l.n..t..xM.R.}.*%.o4..Kg..:W."..An.L..
...v....S0vL....q..3.RV..yD((2.M...............P.A...:.....|..F..V....
P*..|....;...KV..K.....z....bv......O...i.k..Y$p.Jw.C.3..L.U/?.1..q.Bf
.....np..<D..H...vd..2..]...,.a............^.....p...

GET /AddTrustExternalCARoot.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.usertrust.com

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 Dec 2016 00:25:56 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 602

Last-Modified: Mon, 12 Dec 2016 19:59:09 GMT

Connection: close

ETag: "584f018d-25a"

X-CCACDN-Mirror-ID: rmdccacrl8

Cache-Control: max-age=3600

Accept-Ranges: bytes
0..V0..>...0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$
..U....AddTrust External TTP Network1"0 ..U....AddTrust External CA Ro
ot..161212195909Z..161216195909Z0i0!..S{vVO)...iC.".,y..151214155830Z0
!..F....L...e.n.B.d..151214155830Z0!..:...u....t........151214155830Z.
00.0...U.#..0......z4.&...&T....$.T.0...U........0...*.H..............
.Jj.N.Bm.|...{. .Sc99p...3.e4.m.....&.*.{...._....V...1..........7K-.^
,...k.Z..f2...y........bB...... . .b...........H.....|.F.=I?k.V.......
....n.u.T.4M|..e...B...?.&....P.'2lh......g...{./..$P..c.&.V......Z...
....mIy.....<.XwJ6.. ...R....o. ..._.:.)..."...

The Installer connects to the servers at the folowing location(s):

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

LzmaDecode failed (%d)

onwEB

shell32.dll

/SUPPRESSMSGBOXES

/PASSWORD=password

Specifies the password to use.

For more detailed information, please visit hXXp://VVV.jrsoftware.org/ishelp/index.php?topic=setupcmdline

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.0)

Inno Setup Messages (5.5.3)

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

(Np{.Mp

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

4.5.4.0

%original file name%.exe_3308_rwx_01210000_00110000:

.idata

.edata

P.reloc

P.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

u%CNu

.Owner

>A(.kc'/_^w

4L.dp

73.aQ

2A.nOa

/-.vvvv

.HICv

g.Qo^p

\.DDyv

v&d.Bd

m72

d.tbyC

.CLn&dhO$bqr)

.Ozdq

,.QP[

QW.KU 

.Yq$P

.WW>E

/.RRRR

:..tO$

pÜp

.heOY

..Fd8

.LdJ$

.BF$.

c%uQtD

.P}%x

lUdP

T.aGd

d%4X{

Gf%C"

@g_.DW\c/

HCP(W%fW

9H.xbZ

g-.PL

}?Qx.jo.a

<fN%S

.yd;=\owl

@y.GfM

.oHhw\K

.xa#;

>U.vu

*M%d*u

.soy9

bx.BXf

"*o.om

y p.vc

.ISQ/r$rm8H=(%

e:\%-

L.MQLR/

.FE6;

/3ZAB%UXm

p}.dT

.EsY)$

&:i[.srK?

:..TN:

.DEIOe

:.rwA

~e5"%dZ8H

%fnZNwdI3l(

úTbg

-bcJ}.X

P%Cq'v

.gLL?

Ly|.kN

Ü||vh

}.Ak1

Fk0d.lOq5TD5

_O9P%d

.QM_D

"g-.dM

k.jfz

b.ORP0a

.MB\\

Bzr/.Rt

g.hOQ

}DUFTP

j.aj*M1

dwJcrt

E:\Ev

<a.fT

z.XZmT

%u"95

|Y.ie

hv.sw3c

X.GU04

8Õ%

cH.RA

@.SXC\

Iw2.YW{'b

nK%DL

3e.IQo

/.an.Mw

mi.UG

sQ.BoS

\?JLM%F

.Wun'^',

<..KZ

.pFSU>

]&B.CY96A

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

oleaut32.dll

RegFlushKey

RegCreateKeyExA

GetWindowsDirectoryA

GetCPInfo

GenericLoader.dll

>!>%>)>->1>5>9>

0"0-030;0@0

7"7&7*7$8

9 9/93979;9?9

:":&:*:.:2:6:::

KWindows

.NSKF"oc

.fdYA

c.Ql*Qg?"

w Vy:.zr3[X@

a.Vh1j

!`.fy

8$%XY:K

.tUh#

{.VmgH

u7.gDD

U%uj2@Y

fr.Bu

.Ee_SF$

DVI.Qs

N.Xct

Of`.cu

.V.Es

0n%7X

crT:j

.YiCre

.ls:3

z.bH6

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Ancestor for '%s' not found

Cannot assign a %s to a %s

Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot open file %s$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

%original file name%.exe_3308_rwx_01420000_0009C000:

.rsrc

~H.Pp

kernel32.dllwGetLo

{_.SCK_LINES/

GI.vr

Keywor

%s[%d]d=

_%di#w

.FDiag

Lz.Ix}

%XV;P

Ha=.hnY`

"%cgk

E(AL("%s",4),"

4'.Yt

.Rx>U

.dD}ohD

#t%D@

hy[I%X

,keysK<

P.csy

%XG?;

.Xx%P,

LPC#I%xI/ 

%F$wm

o[0%F

tLcibD.ZP

I.eeln

.ye/y`F

ToiZc.Xhj

I.cG/

.DZOLdyE

pu.Pt

jguZ$C%c

T,/.Om

%u3,]

T7\webqskv`T-Y

nz-X.EoT

s:.LG

/=xR%U

.ojxQ/

t<PTXXv.MB

leQ_lgdljn-:Pr-30f?.Vf0WQ

ssav.Fp

.[FQ.nw

sLtMuYvT.wh

THttp8hbD

,M.DJ

x.NDhi

.SK@./(Lk

ic6.fA

RI.AT'

.VFEBfAR

oc/K-33?.}M:.jG

mw.ll

,.Ri"ko

%sg}ai

URLs1n/

A6;,.Jid

#gST.tI

.dhs!

.dlpO

.SJ}wF

lO3?:96=>?59:;.ZQ

6?0N2=.Lq

FW]E).rO

30Lk-oo7L<AL.tK

;768>1-80

-[4/>;84

0FQO%SGl

D['-L}

 ;7.Q,>N-Y,[ T,Tc.Uv`HzR

Tgm.mX

\S2..st

bnfoa.nvQP

]H.if7

Eoi]`^.OI

bh[muQ.PT

Tz.yOrs

.Lb/L}

.Xjc'

pk`a.ET

)hix.CB

hhFhy,.kle

TPipe.y

QWLHEM G.sO@KB4>c.

URNDT].Lw/OFL[^\\[@IAJH-B

wLJ_.gROUHUO

ym^rk.Um_

J B.BR6

nCff1w.jzW

b.vokV/i4

X.hxM<

.FEG?'$

,%C;.'

.vri=

IWeb@

%D,33

%xpFRbtW0m#

|%xoDwu

'%s'R

I6E.Adv

o.nBx

.1..WAHO9[Z

1%X)w

-|~.US

cnyzgcEi.Tc0

?X A,]-` 4.dH

*.lJ,e

Zq.KJ

D.Xre

/@anldf.RW

(%.WwX

I.PP5%

cbie.eN

X(kbm N.qX

,E.gf

2<<_3'.rB

mjC.Oon1I

gZY*rf.aeW

?.YH2

.qB/hkk[lfqd.@ 

NPIPE_DATA

WHKz).jGNNL6.i-6

HL-N.PLNYCD_^.e`

HMVH9>.PERU

.CONTA

v=.vpF

}g`.NrWGiiq

Zz.tc

.fhEjmy|

.FnNFv

xEXE&0

>$.PG

Z-1,NaW.ezfc.bzG

u-f.wo[

]no^dun.Vx

Z.OO*YpC('

M@VNJPu.Ig~%

z`o1caig2,.hf5b"0cfh

jzp-Z.df4oZIOo4

&.rP,6

GUkszv.ra

hbbxl,.blrl

<.ZR3

.zx0&

;s1%c {a

&.Kb$

KO.az

~fT%s*

AV.mvd

N^.Oa

M%r.rm,

-p%X.SJ

o.th-

#.OR0

}%c.d

[x?.ML

@d.nL

"$ %),'8

1 0 .'7(2':

 /*-( ,'.-!

*/.)*72-7)

,d2.PMDF<7I

HP.re

KERNEL32.DLL

advapi32.dll

comctl32.dll

comdlg32.dll

gdi32.dll

mpr.dll

ole32.dll

oleaut32.dll

shell32.dll

URLMON.DLL

user32.dll

version.dll

HtmlUIInstallerSADLL.dll

%original file name%.exe_3308_rwx_014C1000_00161000:

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

EVariantBadIndexError

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

Uh%fN

USER32.DLL

comctl32.dll

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeywordH

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys

AutoHotkeys8`P

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown8;O

OnKeyPress

OnKeyUpD:O

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

A`bng`@ikc-4,uUxlxs-4,Ht.HA

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

TThreadExecuter

TScanAllWindowsCallBackData

Portuguese

ZkkdDocjn^g-4,o.ye

^ioM-3,iiziGmwItI.cG

\h-2,Jfal\`dgxj-4.DZ

,-\ T,/.Om

hcl.sf

webqskv`T-Y

oj-2,`ac<<*kcb.jo

ak-2,`ob<< T,jcb.je

Uh|%S

UhI%S

IN]JVN]K]KJ]B]F^UF@@]\v-2,ujbRBjazsnc^s`lkr-1,`-1,].jl

7Teah P,Ckh`-3,fkgo-2,7*NNYO.uh

1.2.3

THttpTimeOutThread

THttpCallBackShell

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

Jmvgknm Q,2,,<,./accwcxgeni5 W,O_GB R,=>)27,.Pkbjhu-4-.,IV,,8)37,.Spejblx Q,2,,< W.g W

Ecezcb-4 S,Tmeic6.fA

Bc/K-33,`-1.jG

Jbhblnrefc V,H-0,bv-1,li.AT

Uju-0,c-2 W,Ht-2,h-4.Rq

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

ebP-3,dLfnda`-4,`yj-4.PL

Retrieved Filename from Url:

) is different than supported (

Urls stored in Chunks Map differ from the ones provided, ignoring the Chunks Map:

Chunks Map contains URLs, but the size is illegal:

New Source created, url:

, httpCode:

, url:

, Url:

, old Url:

, new Url:

Switching suspended Server back to use; Url:

, HttpCode:

TDownloadConnection.Destroy() was called from not authorized thread (

HttpCode:

Unsupported 3xx redirect response, code:

]DKizHi-4,exc-1,Hc`hk-3.GI

L_LCUNTF, KHC.op

0.0.0.0

3?:96=>?59:;.ZQ

6?0N2=.Lq

;768>1-80

cabinet.dll

\fgejnhg,.Dhr,.f-3- ,z`b, -2,gbyz,..8y

Unable to extract the file via CMD, gonna try regular write:

000000000000

Report is too long, data will be lost; RepCnt:

Report seems to be larger than recommended, can happen only on special ocasions; RepCnt:

 ;7.Q,>N-Y,[ T,Tc.Uv

Reporting failed on first attempt, second attempt is cancelled (finallizing)! HttpRes:

First report attempt failed, going for second! HttpRes:

The report failed! HttpRes:

Report sent, Url:

Y]H.if

d-3,tdcQqdc.Lb

TUninstallExecuter

)hix.CB

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

RootKey:

RegDelKey:

ExecuteCmd: key=

KillProcess: key=

: key=

Remaining uninstall instructions after exeution:

ExecuteCmd:

ExecuteCmd: ExitCode:

TPipeServer

TPipeObject

TPipeServerListener

TPipeClientU

Starting default pipe server, PipeName:

isrPipe

Falied to start default pipe server, PipeName:

CJ[hx.Xu

_.Wo*BC-T5p7d.V-b,

Downloading Bundles data from adServer on url:

NAER_[URNDT].Lw

Report main param:

Report Url changed dynamically from:

Exclusive Execution mode is switched to:

Report param

Report param:

Package execution returned bad ExitCode:

Package execution failed, bad ErrorCode:

LJ_.ge

Download request queued, urls:

fxk S,Cym^rk.Um

Starting Report, status:

ole32.dll

olepro32.dll

IWebBrowser

IWebBrowserAppL

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizable

OnWindowSetLeft

OnWindowSetTopX

OnWindowSetWidth

OnWindowSetHeight

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPathD

OnTranslateUrll

OnCommandExecx

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

OnKeyDown

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

hXXp://

hXXps://

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

OnKeyUp

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

JS event callback execute start:

JS event callback execute end:

JS function sync-execution failed with message:

] execution failed with message:

MAPI32.DLL

LeftPopup

not supported

YR-0,xh]izn.cQ

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

-0,cnyzgcEi.Tc

https

Log server Url is invalid:

Sf[.t,T*.lJ,e

Sending Log to the following Url:

Log Http request has failed, res:

Log Url changed to:

MSGALL

irsoMsgDialog

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoGetRegKeyInfo

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoExecuteDllInProcess

irsoSaveExecuteUsingCMD

irsoIsMutexExists

irsoCreatePipeServer

irsoStopPipeServer

irsoSendDataToPipeServer

irsoSetDebugLogUrl

irsoGetDebugLogUrl

irsoGetWebBrowserHandle

irsoGetCurExeCheckSum

irsoGetExeInjection

TExecArgs@

iubnyybRolkanldf.RW

b-1,[-1,e.Hv

.html

H-4,njBdi-2,o-4,r.vY

-4,fhxXahcxgw.rg

gghYcjrf.ae

jehGbeags.qB

PIPE_DATA

PIPE

LNYCD_^.eP

HMVH9>.PE

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

IE WebBrowser docRendMode:

IE WebBrowser docRendMode is not 7 (

THtmlUIExeAppU

Pipe [

HtmlUIExeApp

Pipe command unknown:

ung`.Nr

HtmlUiExeApp

gbo`dhfm.cV

irsoExecutePackage

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

irsoReportPackageInfo

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoGetPackageExecResult

irsoGetPackageDwnldUrls

irsoSetPackageRelProgressShare

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetOperaVer

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoReportStart

irsoReportInfo

irsoSetExclusiveExec

isroSetReportUrl

-11,jycmjaOaahDgvyc-11.Pg

An attempt to download bundle data was denied: adServer domain name must remain the same! Url:

zfc.bz

]no^dun.Vx

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\GCAPMA][.oj

TcUlue.PL

W`mmqzeon,.wvamaff P,4.]

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

e-1,f.Cw

-0,ilCcbd.LG

)h-4,k.bR

Failed to execute the Watcher in mode

Watcher was successfuly executed in mode:

Ukszv.ra

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

FbghLbtaYhe.AU

1.2.1

inflate 1.2.1 Copyright 1995-2003 Mark Adler

deflate 1.2.1 Copyright 1995-2003 Jean-loup Gailly

?456789:;<=

!"#$%&'()* ,-./0123

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

&.Kb$

~fT%s:

.wIXS{;

AV.mvd

M%r.rm,

mQ%dG

-p%X.SJ

o.th-

#.OR0

}%c.d

[x?.ML

@d.nL

GetProcessHeap

GetCPInfo

RegQueryInfoKeyA

RegOpenKeyExA

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCloseKey

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

GetKeyboardType

"$ %),'8

38000=344

4? 3!0 3!6

&W!%D)*

H.JXA

1 0 .'7(2':

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

&)"%&$&'&",,/- '

944(@32%2u8

.PMDF<7I

2222444424

.idata

.edata

P.reloc

P.rsrc

 /*-( ,'.-!

*/.)*72-7)

,d2.PMDF<7I

HP.re

Attempt to access registry key: "

supported by OS for "HKEY_CURRENT_USER\Software\"; access directly under "HKEY_CURRENT_USER\Software\Wow6432Node".

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Execution AdminMode ADM_DEGRADE is not supported; using ADM_AS_DESKTOP instead. File:

There is no source with range support for connection, picking one without.

None of our requests are passing in Proxy Mode - suspecting inability to download from current server, trying another HEAD request to make sure.

File size seems to be changed from the same source after HEAD request, suspecting rare case of lack of HEAD support - disabling it.

Only HEAD requests are passing in Proxy Mode - unable to work with this server (probably no Range support)

TDownloadAccelerator.Run() was ignored, since another download is currently in progress.

Urls:

Pause request ignored, servers without HTTP Range support will cause download restart.

The source dropped range support.

The source does not have range support - ignored range request.

UnregDLL executed: "

UnregAODLL executed: "

ExecuteCmd: Exe:

Stopping default pipe server

Waiting for all the ongoing reports to complete...

; main package already reported

InstallerName altered after at least one report already sent.

Changing Report URL request was denied due to lack of Privilege Mode.

Installer Report Url changed after at least one report already sent.

Installer Account Name altered after at least one report already sent.

SDT changed after at least one report already sent.

package already reported

Starting execute (NoExecute - skip), exe:

Starting execute, exe:

MSI package detected. switching to synchronous package execution

Execute request queued, exe:

errorUrl

\bin\SubWCRev.exe

Failed to launch htmlUI from the following url:

Log server Url is not provided.

Log Http request has timed out.

Remote mask loading is currently not supported. mask:

Registry entry removed: HtmlUI Browser object's IE7 fallback support is now enabled.

There is a registry hack to prevent HtmlUI Browser object's IE7 fallback - failed to remove it (HKEY_CURRENT_USER).

There is a registry hack to prevent HtmlUI Browser object's IE7 fallback - failed to remove it (HKEY_LOCAL_MACHINE).

Loading in stealth mode, url:

Read form default pipe timed out, can't determine if there's another instance running

Pipe server TIMED OUT , can't determine if there's another instance running. continuing..

CANNOT start default pipe server, possible reason is that another instance of this installer is stuck

Please login as administrator and try again.

Failed to remove the "Zone.Identifier" AltStream

Successfuly removed the "Zone.Identifier" AltStream

Failed to execute a Watcher process.

Watcher found a problem, but can't report - essential report data is missing.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form

!Control '%s' has no parent window

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot open file %s

Invalid stream format$''%s'' is not a valid component name

Ancestor for '%s' not found

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation!Invalid variant operation ($%.8x)

Variant is not an array5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value"'%s' is not a valid currency value!'%g' is not a valid date and time

'%s' is not a valid GUID value

I/O error %d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Installer file.
   
3. Delete or disinfect the following files created/modified by the Installer:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Grey_Button.png (698 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\CH_logo_new[1].png (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\bootstrap_41124.html (156 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Resume_Button.png (718 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\FR.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Progress.png (104 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00140251.log (16 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\main.css (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (688 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\ie6_main.css (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\BG.png (20 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\g_-_32x32_-_s_13060x20130323113056_0[1].png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp.CIS (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\button.css (417 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\0A7D17F4_stp.EXE.part (2856 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D (388 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\checkbox.css (190 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (684 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp\osutils.vbs (18 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Close_Hover.png (207 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bg2[1].jpg (5184 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Loader.gif (10 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab561B.tmp (51 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (471 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\button-bg.png (131 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\progress-bar.css (506 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg2.png (978 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0060A9F9287878B15AB61E0E47645E5 (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Icon_Generic.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Grey_Button_Hover.png (719 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\EN.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\logo[1].png (200 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_7C90AA5E29A4A4431A9E53E5B55F2F3D (680 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\sponsored.png (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\3F8C9735_stp\asgnd.json (6341 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC42971B7939A9CA55C44CFC893D7C1D (360 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Pause_Button.png (577 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\3F8C9735_stp.CIS.part (819 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\BG[1].jpg (7704 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\browse.css (337 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Close.png (207 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\ProgressBar.png (812 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\form.bmp.Mask (244 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FF_logo_new[1].png (6 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\Nininininon[1].png (41648 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D (602 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\truste[1].png (200 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (727 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0060A9F9287878B15AB61E0E47645E5 (392 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Color_Button_Hover.png (818 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Cazurazihiz[1].png (5 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Quick_Specs.png (221 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\BG_FS[1].jpg (5600 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bar7[1].png (200 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\IE_logo_new[1].png (5 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\csshover3.htc (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar561C.tmp (2712 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_7C90AA5E29A4A4431A9E53E5B55F2F3D (472 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bg1[1].jpg (12860 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Color_Button.png (808 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\BG[1].png (1160 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp.CIS.part (843 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FS_BG[1].png (584 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\logo_b[1].png (200 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0014009C.log (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D (773 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\PL.locale (4 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.